PT-2020-12212 · Psd Tools · Psd-Tools

Kyamagu · Published 2020-03-14 · Updated 2020-03-19 · CVE-2020-10571

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.9.4

Description An issue was discovered in the Cython implementation of RLE decoding, which did not check for malicious or malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.

Recommendations For versions prior to 1.9.4, upgrade to version 1.9.4 to resolve the issue. As a temporary workaround for already installed psd-tools with the Cython extension, consider upgrading to version 1.9.4, as without Cython present on installation, the buffer overflow does not occur, but an IndexError will be thrown.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2020-10571

GHSA-22JR-VC7J-G762

PYSEC-2020-91

Affected Products

Psd-Tools

References · 12

• https://github.com/psd-tools/psd-tools/pull/198 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10571 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10571 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-22jr-vc7j-g762 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-91 · Vendor Advisory
• https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4 · Note
• https://github.com/psd-tools/psd-tools · Note
• https://github.com/psd-tools/psd-tools/commit/fd51f8b4a52bc9c1c06d1035dfdf2cd920e87074 · Note
• https://github.com/psd-tools/psd-tools/security/advisories/GHSA-22jr-vc7j-g762 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2020-91.yaml · Note
• https://github.com/advisories/GHSA-22jr-vc7j-g762 · Note
• https://t.me/cvenotify/1690 · Telegram Post