Fluid Attacks Database

Description

Pillow denial of service An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
alpine v3.15	py3-pillow	=7.1.1-r0 \|\| =7.1.2-r0 \|\| =7.2.0-r0 \|\| =8.1.0-r0 \|\| =8.1.2-r0 \|\| =8.1.2-r1 \|\| >=0 <8.2.0-r0	8.2.0-r0
alpine v3.14	py3-pillow	=7.1.1-r0 \|\| =7.1.2-r0 \|\| =7.2.0-r0 \|\| =8.1.0-r0 \|\| =8.1.2-r0 \|\| =8.1.2-r1 \|\| >=0 <8.2.0-r0	8.2.0-r0
pypi	pillow	>=0 <8.2.0	8.2.0
debian 13	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
debian 14	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
debian 11	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
rpm rhel7	python-pillow	-	-
rpm rhel8	python-pillow	<0:5.1.1-16.el8	0:5.1.1-16.el8

Aliases

1. CVE-2021-286752. NVD-2021-286753. OSV-DEBIAN-2021-286754. OSV-2021-286755. OSV-ALPINE-2021-286756. GHSA-g6rj-rv7j-xwp47. GCVE-2021-286758. SECURITY-TRACKER-CVE-2021-286759. SECURITY-CVE-2021-2867510. security.gentoo.org

References

1. https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c6234972. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-139.yaml3. https://lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL4. https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.