Skip to content
OpenAdvisories
Medium ALAS2023-2023-453 1 CVE

Moderate: python-pillow security update (Amazon Linux 2023)

Published Dec 6, 2023 · Updated Dec 14, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-44271: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 python-pillow-debuginfo 0:9.4.0-2.amzn2023.0.3
Amazon Linux · 2023 python-pillow-debugsource 0:9.4.0-2.amzn2023.0.3
Amazon Linux · 2023 python3-pillow 0:9.4.0-2.amzn2023.0.3
Amazon Linux · 2023 python3-pillow-debuginfo 0:9.4.0-2.amzn2023.0.3
Amazon Linux · 2023 python3-pillow-devel 0:9.4.0-2.amzn2023.0.3
Amazon Linux · 2023 python3-pillow-tk 0:9.4.0-2.amzn2023.0.3
Amazon Linux · 2023 python3-pillow-tk-debuginfo 0:9.4.0-2.amzn2023.0.3

Vulnerabilities 1

  • High 7.5
    CVE-2023-44271

    Pillow Denial of Service vulnerability

    An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textleng…

    pillow pillow pillow pillow-python2 Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-44271.html