Bug 1935384 (CVE-2021-27921)

Summary:	CVE-2021-27921 python-pillow: Excessive memory allocation in BLP image reader
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb, cstratak, kaycoth, lbalhar, manisandro, miminar, orion, paul, python-maint, rhel8-maint, rschiron, tomckay, torsava
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-pillow 8.1.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 14:09:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1935385, 1935386, 1935387, 1935388, 1935584, 1939594, 1939595
Bug Blocks:	1934710

Description Guilherme de Almeida Suckevicz 2021-03-04 19:26:20 UTC

Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

Reference:
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html

Comment 1 Guilherme de Almeida Suckevicz 2021-03-04 19:26:55 UTC

Created mingw-python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1935388]


Created python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1935385]


Created python2-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1935386]


Created python3-pillow tracking bugs for this issue:

Affects: epel-7 [bug 1935387]

Comment 3 Jason Shepherd 2021-03-08 03:04:01 UTC

Mitigation:

Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.

Comment 5 Riccardo Schirone 2021-03-16 16:44:29 UTC

Upstream patch seems to be https://github.com/python-pillow/Pillow/commit/480f6819b592d7f07b9a9a52a7656c10bbe07442

Comment 7 Lumír Balhar 2021-04-08 15:25:29 UTC

CVEs 2021-27921, 27922, and 27923 share the same fix but upstream has only ICNS file in the tests to check it. Do you plan to create also BLP and ICO files to test all three possible variants of the issue?

Comment 9 errata-xmlrpc 2021-10-19 12:11:01 UTC

This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917

Comment 10 Product Security DevOps Team 2021-10-19 14:09:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27921

Comment 11 errata-xmlrpc 2021-11-09 17:24:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4149 https://access.redhat.com/errata/RHSA-2021:4149