PT-2022-6570 · Pypi+2 · Pillow+2

Hugovk · Published 2022-11-07 · Updated 2024-03-06 · CVE-2022-45199

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 9.2.x and prior to 9.3.0 can be simplified to: Pillow versions 9.2.0 through 9.3.0, but since 9.3.0 is the fixed version, the correct representation is: Pillow versions prior to 9.3.0

Description The issue is related to the Pillow library's handling of image decoding, specifically in the TiffImagePlugin.py module. A large value in the SAMPLESPERPIXEL tag can lead to a denial of service attack, causing memory and runtime exhaustion when setting up the context for image decoding.

Recommendations For Pillow versions prior to 9.3.0, update to version 9.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the TiffImagePlugin.py module or limiting the value of the SAMPLESPERPIXEL tag to prevent exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2022-3019

ALT-PU-2023-7942

ALT-PU-2023-8182

BDU:2023-02448

BIT-PILLOW-2022-45199

CVE-2022-45199

GHSA-Q4MP-JVH2-76FJ

OESA-2022-2113

OESA-2023-1024

PYSEC-2022-42980

Affected Products

Alt Linux

Pillow

Red Os

References · 25

• https://github.com/python-pillow/Pillow/pull/6700 · Patch
• https://github.com/python-pillow/Pillow/commit/2444cddab2f83f28687c7c20871574acbb6dbcf3 · Patch
• https://osv.dev/vulnerability/OESA-2023-1024 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42980 · Vendor Advisory
• https://bugs.gentoo.org/878769 · Patch
• https://security.gentoo.org/glsa/202211-10 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pillow-2022-45199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45199 · Security Note
• https://osv.dev/vulnerability/GHSA-q4mp-jvh2-76fj · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45199 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02448 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2113 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-45199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45199 · Vendor Advisory
• https://github.com/python-pillow/Pillow · Note