Bug 1163441 (CVE-2014-3598) - CVE-2014-3598 python-pillow: Jpeg2KImagePlugin infinite loop DoS
Summary: CVE-2014-3598 python-pillow: Jpeg2KImagePlugin infinite loop DoS
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-3598
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1130713
TreeView+ depends on / blocked
 
Reported: 2014-11-12 17:16 UTC by Tomas Hoger
Modified: 2023-05-12 05:54 UTC (History)
4 users (show)

Fixed In Version: python-pillow 2.5.3, python-pillow 2.6.0
Clone Of:
Environment:
Last Closed: 2014-11-12 17:17:54 UTC
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2014-11-12 17:16:00 UTC
An infinite loop flaw was found in the way the Jpeg2KImagePlugin module of the python Pillow library parsed JPEG2000 files.  A specially-crafted image could cause an application using Pillow to consume an excessive amount of CPU time.

The affected Jpeg2KImagePlugin was only introduced upstream in Pillow version 2.4.0.  Issue was corrected in version Pillow 2.5.3.  The versions of python-imaging and python-pillow packages as shipped in released versions of Red Hat Enterprise Linux and Fedora were not affected by this issue, as they are based on PIL and Pillow versions that do not include affected module.

Upstream commit fixing this issue:

https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d

Acknowledgements:

Red Hat would like to thank Andrew Drake of Dropbox for reporting this issue.

Comment 1 Tomas Hoger 2014-11-12 17:17:54 UTC
Statement:

This issue did not affect the versions of python-imaging as shipped with Red Hat Enterprise Linux 5 and 6, and the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, as they did not include the affected Jpeg2KImagePlugin module.


Note You need to log in before you can comment on or make changes to this bug.