Bug 1789540 (CVE-2019-19911)

Summary:	CVE-2019-19911 python-pillow: uncontrolled resource consumption in FpxImagePlugin.py
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb, cstratak, dbecker, jjoyce, jschluet, lhh, lpeer, manisandro, mburns, miminar, orion, python-maint, sclewis, slinaber, tomckay, torsava, tsmetana
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-pillow 6.2.2	Doc Type:	If docs needed, set a value
Doc Text:	A denial of service vulnerability was found in Pillow in versions before 6.2.2, where the FpxImagePlugin.py file calls the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows systems running 32-bit Python, this flaw results in an OverflowError or MemoryError due to the 2 GB limit. On Linux systems running 64-bit Python, this flaw results in the termination of the process by the out-of-memory (OOM) killer. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-04 20:41:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1799348, 1799349
Bug Blocks:	1789544

Description Pedro Sampaio 2020-01-09 19:00:50 UTC

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. 

References:

https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html

Comment 2 Riccardo Schirone 2020-02-06 16:23:39 UTC

This seems to be the fix for this flaw:
https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d

Comment 3 Riccardo Schirone 2020-02-06 16:41:45 UTC

The flaw is in the FpxImagePlugin file, which can be loaded only if the python module "olefile" is present in the system. Otherwise, the plugin will not load because it will raise a ModuleNotFoundError during the `import olefile` statement.

RHEL 7 and RHEL 8 do not provide any package for the olefile module, thus FpxImagePlugin.py is never loaded and they are not affected by this flaw.

Comment 4 Riccardo Schirone 2020-02-06 16:43:55 UTC

Created python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1799348]


Created python3-pillow tracking bugs for this issue:

Affects: epel-7 [bug 1799349]

Comment 5 Riccardo Schirone 2020-02-06 16:45:12 UTC

Statement:

This issue did not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include python-olefile, which is necessary to use the FPX image plugin.

Comment 6 errata-xmlrpc 2021-02-04 16:14:23 UTC

This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420

Comment 7 Product Security DevOps Team 2021-02-04 20:41:56 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19911