Upstream information
Description
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
CNA (GitHub) | |
---|---|
Base Score | 5.3 |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | None |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | Low |
Integrity Impact | None |
Availability Impact | None |
CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- SUSE-SU-2025:0297-1, published 2025-01-30T14:03:41Z
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2025-14710 |
SUSE Timeline for this CVE
CVE page created: Mon Jan 27 20:01:14 2025CVE page last modified: Mon Jun 16 17:19:46 2025