An infinite loop flaw was found in the way the Jpeg2KImagePlugin module of the python Pillow library parsed JPEG2000 files. A specially-crafted image could cause an application using Pillow to consume an excessive amount of CPU time. The affected Jpeg2KImagePlugin was only introduced upstream in Pillow version 2.4.0. Issue was corrected in version Pillow 2.5.3. The versions of python-imaging and python-pillow packages as shipped in released versions of Red Hat Enterprise Linux and Fedora were not affected by this issue, as they are based on PIL and Pillow versions that do not include affected module. Upstream commit fixing this issue: https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d Acknowledgements: Red Hat would like to thank Andrew Drake of Dropbox for reporting this issue.
Statement: This issue did not affect the versions of python-imaging as shipped with Red Hat Enterprise Linux 5 and 6, and the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, as they did not include the affected Jpeg2KImagePlugin module.