Описание
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
A flaw was found in Pillow, a Python imaging library. An attacker could exploit this vulnerability by tricking a user into processing a specially crafted malicious PSD file. This could lead to memory corruption, potentially causing the application to crash or allowing for arbitrary code execution.
Отчет
This is an Important severity flaw in Pillow, a Python imaging library, that could lead to arbitrary code execution. The vulnerability requires a user to process a specially crafted malicious PSD file, which could result in memory corruption and allow an attacker to execute arbitrary code. Red Hat products that process untrusted image files using Pillow are at risk if they do not adequately sanitize input or operate in a sandboxed environment.
Меры по смягчению последствий
To mitigate this vulnerability, users should avoid processing untrusted or suspicious PSD image files with applications that utilize the Pillow library. Implementing strict input validation and sanitization for image uploads and processing workflows can reduce the risk. Additionally, running applications that process untrusted content within a sandboxed environment can limit the potential impact of successful exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| Lightspeed Core | lightspeed-core/lightspeed-stack-rhel9 | Not affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-ocp-rag-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-neuron-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-spyre-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaii/vllm-cpu-rhel9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
Pillow is a Python imaging library. From version 10.3.0 to before vers ...
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
EPSS
7.8 High
CVSS3