CVE-2021-26926
Description
From CVE.org
A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 7.1 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Red Hat CVSS v3 Score Explanation
According to our analysis, this issue can either trigger crash of an application using the Jasper library, or it can cause it to possibly disclose portion if its memory. Therefore, this issue may have Availability or Confidentiality impact. As those impacts do not happen at the same time, there are two separate CVSS vectors for each impact, with C:N/I:N/A:H and C:H/I:N/A:N respectively, both with the numeric CVSS score of 5.5.
According to the information from NVD, they do not currently support assigning multiple CVSS scores to one issue, which with context explaining its applicability. Therefore, they decided to combine both impact to a single score. Red Hat is following the CVSS scoring guidance to use the highest possible CVSS scores in case of multiple scores, without combining impacts that do not happen at the same time into the same score.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
