GitHub Advisoryadvisory · PyPI
GHSA-j7mj-748x-7p78 DOS attack in Pillow when processing specially crafted image files
HIGH
Official page ↗
- Aliases
- CVE-2019-16865
- Ecosystem
- PyPI
- Packages
- pillow
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
- Reviewed
- 2019-10-17
Affected packages
• PyPI pillow: < 6.2.0 → fixed in 6.2.0
Description
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Related
Alias · CVE (1)
- CVE-2019-16865 An issue was discovered in Pillow before 6.2.0. vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16865 advisory
- https://github.com/python-pillow/Pillow/issues/4123 web
- https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb web
- https://www.debian.org/security/2020/dsa-4631 web
- https://usn.ubuntu.com/4272-1 web
- https://ubuntu.com/security/notices/USN-4272-1 web
- https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3 web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU web
- https://github.com/python-pillow/Pillow package
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml web
- https://github.com/advisories/GHSA-j7mj-748x-7p78 advisory
- https://access.redhat.com/errata/RHSA-2020:0694 web
- https://access.redhat.com/errata/RHSA-2020:0683 web
- https://access.redhat.com/errata/RHSA-2020:0681 web
- https://access.redhat.com/errata/RHSA-2020:0580 web
- https://access.redhat.com/errata/RHSA-2020:0578 web
- https://access.redhat.com/errata/RHSA-2020:0566 web