CVE-2023-44271

Description

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Scores

Weaknesses (CWE)

• CWE-770

Advisories

• GHSA-8ghj-p4vj-mr35 — Pillow Denial of Service vulnerability
• PYSEC-2023-227 — An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a s

European references

• ENISA EUVD · EUVD-2023-0199
• GCVE · GCVE-0-2023-44271

Affected configurations (NVD CPE)

• cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* < 10.0.0
• cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Affected products

References

• https://github.com/python-pillow/Pillow/pull/7244
• https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
• https://devhub.checkmarx.com/cve-details/CVE-2023-44271/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4/
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html

Sources