CVEvulnerability
CVE-2021-28678
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-06-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-345
Description
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Affected configurations
• python pillow (< 8.2.0)
• fedoraproject fedora 33
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://github.com/python-pillow/Pillow/pull/5377 Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ lists.fedoraproject.org
- https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/202107-33 Third Party Advisory
- https://github.com/python-pillow/Pillow/pull/5377 Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ lists.fedoraproject.org
- https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/202107-33 Third Party Advisory