Bug 2087609 (CVE-2022-30595)

Summary:	CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	cstratak, epel-packagers-sig, infra-sig, manisandro, python-maint, python-sig, torsava
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-pillow 9.1.1	Doc Type:	If docs needed, set a value
Doc Text:	A heap buffer overflow vulnerability was found in python-pillow. This security vulnerability occurs when reading a TGA file with RLE packets that cross scan lines, where pillow reads the information past the end of the first line without deducting that from the length of the remaining file data.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-06-13 11:50:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2087610, 2087611, 2087612, 2087613
Bug Blocks:	2087614

Description Sandipan Roy 2022-05-18 05:50:32 UTC

"CVE-2022-30595: When reading a TGA file with RLE packets that cross scan lines, Pillow reads the information past the end of the first line without deducting that from the length of the remaining file data. This vulnerability was introduced in Pillow 9.1.0, and can cause a heap buffer overflow."

Introduced in 9.1.0, so only unstable is affected. Please bump to 9.1.1.

https://bugs.gentoo.org/845192

Comment 1 Sandipan Roy 2022-05-18 05:53:28 UTC

Created mingw-python-pillow tracking bugs for this issue:

Affects: fedora-34 [bug 2087611]
Affects: fedora-35 [bug 2087613]


Created python-pillow tracking bugs for this issue:

Affects: fedora-34 [bug 2087612]
Affects: fedora-35 [bug 2087610]

Comment 3 Product Security DevOps Team 2022-06-13 11:50:02 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-30595