Bug 1163441 (CVE-2014-3598)

Summary: CVE-2014-3598 python-pillow: Jpeg2KImagePlugin infinite loop DoS
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: manisandro, miminar, steve.traylen, tsmetana
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-pillow 2.5.3, python-pillow 2.6.0 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-11-12 17:17:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1130713    

Description Tomas Hoger 2014-11-12 17:16:00 UTC 
An infinite loop flaw was found in the way the Jpeg2KImagePlugin module of the python Pillow library parsed JPEG2000 files.  A specially-crafted image could cause an application using Pillow to consume an excessive amount of CPU time.

The affected Jpeg2KImagePlugin was only introduced upstream in Pillow version 2.4.0.  Issue was corrected in version Pillow 2.5.3.  The versions of python-imaging and python-pillow packages as shipped in released versions of Red Hat Enterprise Linux and Fedora were not affected by this issue, as they are based on PIL and Pillow versions that do not include affected module.

Upstream commit fixing this issue:

https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d

Acknowledgements:

Red Hat would like to thank Andrew Drake of Dropbox for reporting this issue.
Comment 1 Tomas Hoger 2014-11-12 17:17:54 UTC 
Statement:

This issue did not affect the versions of python-imaging as shipped with Red Hat Enterprise Linux 5 and 6, and the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, as they did not include the affected Jpeg2KImagePlugin module.