GHSA-hjfx-8p6c-g7gx

Insufficient Verification of Data Authenticity in Pillow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-28678

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Pillow	>= 5.1.0, < 8.2.0	8.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-28678 advisory
https://github.com/python-pillow/Pillow/pull/5377 web
https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1 web
https://github.com/advisories/GHSA-hjfx-8p6c-g7gx advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-94.yaml web
https://github.com/python-pillow/Pillow package
https://lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL web
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos web
https://security.gentoo.org/glsa/202107-33 web