PT-2022-6570 · Pypi+2 · Pillow+2
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Pillow versions 9.2.0 through 9.2.x and prior to 9.3.0 can be simplified to:
Pillow versions 9.2.0 through 9.3.0, but since 9.3.0 is the fixed version, the correct representation is:
Pillow versions prior to 9.3.0
Description
The issue is related to the Pillow library's handling of image decoding, specifically in the TiffImagePlugin.py module. A large value in the
SAMPLESPERPIXEL tag can lead to a denial of service attack, causing memory and runtime exhaustion when setting up the context for image decoding.Recommendations
For Pillow versions prior to 9.3.0, update to version 9.3.0 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
TiffImagePlugin.py module or limiting the value of the SAMPLESPERPIXEL tag to prevent exploitation.Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Pillow
Red Os