CVE-2021-28678 — Insufficient Verification of Data Authenticity in Pillow

CWE-345 — Insufficient Verification of Data Authenticity CWE-20 — Improper Input Validation8 documents7 sources

Severity

5.5MEDIUMNVD

EPSS

0.1%

top 70.60%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Python Pillow Fedoraproject Fedora

Timeline

PublishedJun 2

Latest updateJun 8

Description

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDpython/pillow< 8.2.0

▶PyPIpython/pillow5.1.0 — 8.2.0

▶Debianpython/pillow< 8.1.2+dfsg-0.2+3

Also affects: Fedora 33

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

Insufficient Verification of Data Authenticity in Pillow↗2021-06-08

▶

OSV

Insufficient Verification of Data Authenticity in Pillow↗2021-06-08

▶

CVEList

CVE-2021-28678: An issue was discovered in Pillow before 8↗2021-06-02

▶

OSV

CVE-2021-28678: An issue was discovered in Pillow before 8↗2021-06-02

▶

📋Vendor Advisories

Ubuntu

Pillow vulnerabilities↗2021-05-19

▶

Red Hat

python-pillow: Excessive looping in BLP image reader↗2021-04-01

▶

Debian

CVE-2021-28678: pillow - An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did...↗2021

▶