GitHub Advisoryadvisory · PyPI

GHSA-hjfx-8p6c-g7gx Insufficient Verification of Data Authenticity in Pillow

MEDIUM Published 2021-06-08 Modified 2024-10-14 Official page ↗
Aliases
CVE-2021-28678
Ecosystem
PyPI
Packages
Pillow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-345
Reviewed
2021-06-03

Affected packages

• PyPI Pillow: >= 5.1.0, < 8.2.0 → fixed in 8.2.0

Description

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Related

Alias · CVE (1)

  • CVE-2021-28678 An issue was discovered in Pillow before 8.2.0. vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References