PYSEC-2021-94

At a glance

Published: 2021-06-02
Updated: 2023-12-06
CVE: CVE-2021-28678
Aliases: BIT-pillow-2021-28678, GHSA-hjfx-8p6c-g7gx

Description

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Affected packages

Package	Versions
PyPI · pillow	introduced 0, fixed 8.2.0

References

https://github.com/python-pillow/Pillow/pull/5377 WEB
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ WEB
https://github.com/advisories/GHSA-hjfx-8p6c-g7gx ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database