Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag. Patches The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks. Workarounds No workarounds exist. Users must upgrade to tinytag 2.3.0.
Recommended action: Upgrade to 2.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. Details In tag 2.2.0 (6f1d3060f393743c2ec34d07c0855cceed827244), the reachable call path is: - TinyTag.get in tinytag/tinytag.py#L144-L154 - load in tinytag/tinytag.py#L259-L266 - parsetag and parseid3v2 in tinytag/tinytag.py#L1059-L1092 - parseframe for SYLT / SLT in tinytag/tinytag.py#L1316-L1318 - parsesyncedlyrics and findstringendpos in tinytag/tinytag.py#L1219-L1248 and tinytag/tinytag.py#L1340-L1352 The root cause is that parsesyncedlyrics assumes findstringendpos always returns a position greater than the current offset. That assumption is false when no string terminator is present in the…
Recommended action: Upgrade to 2.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.