Описание
Pillow subject to DoS via SAMPLESPERPIXEL tag
Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2022-45199
- https://github.com/python-pillow/Pillow/pull/6700
- https://github.com/python-pillow/Pillow/commit/2444cddab2f83f28687c7c20871574acbb6dbcf3
- https://bugs.gentoo.org/878769
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42980.yaml
- https://github.com/python-pillow/Pillow/releases/tag/9.3.0
- https://security.gentoo.org/glsa/202211-10
Пакеты
pillow
>= 9.2.0, < 9.3.0
9.3.0
Связанные уязвимости
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Уязвимость библиотеки для работы с изображениями Pillow, связанная с неконтролируемым потреблением ресурсов, позволяющая нарушителю выполнить атаку типа «отказ в обслуживании»
ALT-PU-2022-3019: package `python3-module-Pillow` update to version 9.3.0-alt1