Skip to content
OpenAdvisories
Medium ALAS2-2023-2105 1 CVE

Moderate: python-pillow security update (Amazon Linux 2)

Published Jun 21, 2023 · Updated Jun 29, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28675: An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 python-pillow 0:2.0.0-23.gitd1c6db8.amzn2.0.6
Amazon Linux · 2 python-pillow-debuginfo 0:2.0.0-23.gitd1c6db8.amzn2.0.6
Amazon Linux · 2 python-pillow-devel 0:2.0.0-23.gitd1c6db8.amzn2.0.6
Amazon Linux · 2 python-pillow-doc 0:2.0.0-23.gitd1c6db8.amzn2.0.6
Amazon Linux · 2 python-pillow-sane 0:2.0.0-23.gitd1c6db8.amzn2.0.6
Amazon Linux · 2 python-pillow-tk 0:2.0.0-23.gitd1c6db8.amzn2.0.6

Vulnerabilities 1

  • Medium 5.5
    CVE-2021-28675

    Pillow denial of service

    An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

    pillow pillow pillow pillow-python2 Debian Ubuntu Alpine PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-28675.html