{"id":"UBUNTU-CVE-2021-21235","details":"kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.","modified":"2026-05-20T16:04:44.297204858Z","published":"2021-01-06T02:15:00Z","upstream":["CVE-2021-21235"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-21235"},{"type":"REPORT","url":"https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2"},{"type":"REPORT","url":"https://crates.io/crates/kamadak-exif"},{"type":"REPORT","url":"https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-21235"}],"affected":[{"package":{"name":"rust-kamadak-exif","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/rust-kamadak-exif?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1-2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.3.1-2","binary_name":"librust-kamadak-exif-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-21235.json"}},{"package":{"name":"rust-kamadak-exif","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/rust-kamadak-exif?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1-2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.3.1-2","binary_name":"librust-kamadak-exif-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-21235.json"}},{"package":{"name":"rust-kamadak-exif","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/rust-kamadak-exif?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.5-1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.5.5-1","binary_name":"librust-kamadak-exif-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-21235.json"}},{"package":{"name":"rust-kamadak-exif","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/rust-kamadak-exif?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.5-1"],"ecosystem_specific":{"binaries":[{"binary_name":"librust-kamadak-exif-dev","binary_version":"0.5.5-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-21235.json"}},{"package":{"name":"rust-kamadak-exif","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/rust-kamadak-exif?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.5-1","0.6.1-1"],"ecosystem_specific":{"binaries":[{"binary_name":"librust-kamadak-exif-dev","binary_version":"0.6.1-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-21235.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}