Bug 1163441 – CVE-2014-3598 python-pillow: Jpeg2KImagePlugin infinite loop DoS

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1163441 - (CVE-2014-3598) CVE-2014-3598 python-pillow: Jpeg2KImagePlugin infinite loop DoS

Summary:	CVE-2014-3598 python-pillow: Jpeg2KImagePlugin infinite loop DoS

Status:	CLOSED NOTABUG

Aliases:	CVE-2014-3598

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140901,repor...
Keywords:	Security

Depends On:
Blocks:	1130713
	Show dependency tree / graph

Reported:	2014-11-12 12:16 EST by Tomas Hoger
Modified:	2014-11-12 12:17 EST (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	python-pillow 2.5.3, python-pillow 2.6.0
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-11-12 12:17:54 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Tomas Hoger 2014-11-12 12:16:00 EST

An infinite loop flaw was found in the way the Jpeg2KImagePlugin module of the python Pillow library parsed JPEG2000 files.  A specially-crafted image could cause an application using Pillow to consume an excessive amount of CPU time.

The affected Jpeg2KImagePlugin was only introduced upstream in Pillow version 2.4.0.  Issue was corrected in version Pillow 2.5.3.  The versions of python-imaging and python-pillow packages as shipped in released versions of Red Hat Enterprise Linux and Fedora were not affected by this issue, as they are based on PIL and Pillow versions that do not include affected module.

Upstream commit fixing this issue:

https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d

Acknowledgements:

Red Hat would like to thank Andrew Drake of Dropbox for reporting this issue.

Comment 1 Tomas Hoger 2014-11-12 12:17:54 EST

Statement:

This issue did not affect the versions of python-imaging as shipped with Red Hat Enterprise Linux 5 and 6, and the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, as they did not include the affected Jpeg2KImagePlugin module.

Note You need to log in before you can comment on or make changes to this bug.