Bug 1789540 (CVE-2019-19911) - CVE-2019-19911 python-pillow: uncontrolled resource consumption in FpxImagePlugin.py
Summary: CVE-2019-19911 python-pillow: uncontrolled resource consumption in FpxImagePl...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-19911
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1799348 1799349
Blocks: 1789544
TreeView+ depends on / blocked
 
Reported: 2020-01-09 19:00 UTC by Pedro Sampaio
Modified: 2021-02-16 20:47 UTC (History)
17 users (show)

Fixed In Version: python-pillow 6.2.2
Doc Type: If docs needed, set a value
Doc Text:
A denial of service vulnerability was found in Pillow in versions before 6.2.2, where the FpxImagePlugin.py file calls the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows systems running 32-bit Python, this flaw results in an OverflowError or MemoryError due to the 2 GB limit. On Linux systems running 64-bit Python, this flaw results in the termination of the process by the out-of-memory (OOM) killer. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-02-04 20:41:56 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0420 0 None None None 2021-02-04 16:14:26 UTC

Description Pedro Sampaio 2020-01-09 19:00:50 UTC 
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. 

References:

https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
Comment 2 Riccardo Schirone 2020-02-06 16:23:39 UTC 
This seems to be the fix for this flaw:
https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
Comment 3 Riccardo Schirone 2020-02-06 16:41:45 UTC 
The flaw is in the FpxImagePlugin file, which can be loaded only if the python module "olefile" is present in the system. Otherwise, the plugin will not load because it will raise a ModuleNotFoundError during the `import olefile` statement.

RHEL 7 and RHEL 8 do not provide any package for the olefile module, thus FpxImagePlugin.py is never loaded and they are not affected by this flaw.
Comment 4 Riccardo Schirone 2020-02-06 16:43:55 UTC 
Created python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1799348]


Created python3-pillow tracking bugs for this issue:

Affects: epel-7 [bug 1799349]
Comment 5 Riccardo Schirone 2020-02-06 16:45:12 UTC 
Statement:

This issue did not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include python-olefile, which is necessary to use the FPX image plugin.
Comment 6 errata-xmlrpc 2021-02-04 16:14:23 UTC 
This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
Comment 7 Product Security DevOps Team 2021-02-04 20:41:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19911
Note You need to log in before you can comment on or make changes to this bug.