CVE-2021-28678
published 2021-06-02CVE-2021-28678: An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data…
PriorityP418medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.73%
50.2th percentile
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pillow | < pillow 8.1.2+dfsg-0.2 (bookworm) | pillow 8.1.2+dfsg-0.2 (bookworm) |
| fedoraproject | fedora | — | — |
| python | pillow | < 8.2.0 | 8.2.0 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 5.1.0 < 8.2.0 | 8.2.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Pillow vulnerabilities
vendor_ubuntu·2021-05-19
CVE-2021-28677 Pillow vulnerabilities
Title: Pillow vulnerabilities
Summary: Pillow could be made to crash or hang if it opened a specially crafted
file.
It was discovered that Pillow incorrectly handled certain image files. If a
user or automated system were tricked into opening a specially-crafted
file, a remote attacker could cause Pillow to crash or hand, resulting in a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-pillow: Excessive looping in BLP image reader
vendor_redhat·2021-04-01·CVSS 5.5
CVE-2021-28678 [MEDIUM] CWE-20 python-pillow: Excessive looping in BLP image reader
python-pillow: Excessive looping in BLP image reader
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
A flaw was found in python-pillow. BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data.
Mitigation: To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.
Package: python-pillow (Red Hat Enterprise Linux 7) - Out of support scope
Package: quay/quay-rhel8 (Red Hat Quay 3) - Affected
Debian
CVE-2021-28678: pillow - An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did...
vendor_debian·2021·CVSS 5.5
CVE-2021-28678 [MEDIUM] CVE-2021-28678: pillow - An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did...
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Scope: local
bookworm: resolved (fixed in 8.1.2+dfsg-0.2)
bullseye: resolved (fixed in 8.1.2+dfsg-0.2)
forky: resolved (fixed in 8.1.2+dfsg-0.2)
sid: resolved (fixed in 8.1.2+dfsg-0.2)
trixie: resolved (fixed in 8.1.2+dfsg-0.2)
GHSA
Insufficient Verification of Data Authenticity in Pillow
ghsa·2021-06-08
CVE-2021-28678 [MEDIUM] CWE-345 Insufficient Verification of Data Authenticity in Pillow
Insufficient Verification of Data Authenticity in Pillow
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
OSV
Insufficient Verification of Data Authenticity in Pillow
osv·2021-06-08
CVE-2021-28678 [MEDIUM] Insufficient Verification of Data Authenticity in Pillow
Insufficient Verification of Data Authenticity in Pillow
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
OSV
CVE-2021-28678: An issue was discovered in Pillow before 8
osv·2021-06-02·CVSS 5.5
CVE-2021-28678 [MEDIUM] CVE-2021-28678: An issue was discovered in Pillow before 8
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python-pillow/Pillow/pull/5377https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-doshttps://security.gentoo.org/glsa/202107-33https://github.com/python-pillow/Pillow/pull/5377https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-doshttps://security.gentoo.org/glsa/202107-33
2021-06-02
Published