PT-2022-28191 · Pillow · Pillow

Published 2022-03-11 · Updated 2022-03-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Pillow (affected versions not specified)

Description The issue concerns the JpegImagePlugin, which may append an EOF marker to the end of a truncated file. If this EOF marker is not properly detected, it could lead to an infinite loop where the plugin continuously attempts to process the file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-4FX9-VC88-Q2XC

Affected Products

Pillow

References · 4

• https://osv.dev/vulnerability/GHSA-4fx9-vc88-q2xc · Vendor Advisory
• https://github.com/python-pillow/Pillow · Note
• https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd · Note
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file · Note