GHSA-g4m4-9q4c-mfw6
Fiona affected by CVE-2020-14152 related to madler-zlib
GHSA-g4m4-9q4c-mfw6 is a high vulnerability (CVSS 8.7) in fiona, published July 16, 2024. No source lists public exploit code. Fixed in fiona 1.10b2.
- Severity
- 8.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.10b2fiona +1 more
Description
Summary
Vulnerability scan of fiona shows CVE-2020-14152. The vulnerability is in libjpeg, a transitive dependency of fiona (via GDAL and PROJ).
Details
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
Impact
fiona will not open JPEG files and is not vulnerable to attack in that way. fiona might be vulnerable to malformed PROJ grid files using JPEG compression. No such vulnerability or compromise has been demonstrated.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fionaPyPI | before 1.10b2 | 1.10b2 |
fionaPyPI | before 1.10b2, plus listed versions 0.100.120.12.10.130.14 Show 45 moreShow less0.150.160.16.10.50.60.6.10.6.20.70.80.90.9.11.01.0.11.0.21.0.31.11.1.11.1.21.1.31.1.41.1.51.1.61.10a11.10a21.10b11.2.01.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.81.5.01.5.11.6.01.6.11.6.21.6.31.6.3.post11.6.41.7.0 | 1.10b2 |
What each source reports
GitHub Advisories Score used
Fiona affected by CVE-2020-14152 related to madler-zlib
Summary
Vulnerability scan of fiona shows CVE-2020-14152. The vulnerability is in libjpeg, a transitive dependency of fiona (via GDAL and PROJ).
Details
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
Impact
fiona will not open JPEG files and is not vulnerable to attack in that way. fiona might be vulnerable to malformed PROJ grid files using JPEG compression. No such vulnerability or compromise has been demonstrated.
- Record
GHSA-g4m4-9q4c-mfw6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Fiona affected by CVE-2020-14152 related to madler-zlib
Summary
Vulnerability scan of fiona shows CVE-2020-14152. The vulnerability is in libjpeg, a transitive dependency of fiona (via GDAL and PROJ).
Details
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
Impact
fiona will not open JPEG files and is not vulnerable to attack in that way. fiona might be vulnerable to malformed PROJ grid files using JPEG compression. No such vulnerability or compromise has been demonstrated.
- Record
GHSA-g4m4-9q4c-mfw6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/Toblerity/Fiona/security/advisories/GHSA-g4m4-9q4c-mfw6
nvd.nist.gov/vuln/detail/CVE-2020-14152
Left out here: 62 versions. The JSON record has them.