CVE-2021-28678

low-risk
Published 2021-06-02

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (2)

Affected Vendors

Python Fedoraproject

References (8)

Patch https://github.com/python-pillow/Pillow/pull/5377
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Release Notes https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-f...
Third Party Advisory https://security.gentoo.org/glsa/202107-33
Patch https://github.com/python-pillow/Pillow/pull/5377
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Release Notes https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-f...
Third Party Advisory https://security.gentoo.org/glsa/202107-33
25
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 7/34 · Low