There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
This seems to be the fix for this flaw:
The flaw is in the FpxImagePlugin file, which can be loaded only if the python module "olefile" is present in the system. Otherwise, the plugin will not load because it will raise a ModuleNotFoundError during the `import olefile` statement.
RHEL 7 and RHEL 8 do not provide any package for the olefile module, thus FpxImagePlugin.py is never loaded and they are not affected by this flaw.
Created python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1799348]
Created python3-pillow tracking bugs for this issue:
Affects: epel-7 [bug 1799349]
This issue did not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include python-olefile, which is necessary to use the FPX image plugin.
This issue has been addressed in the following products:
Red Hat Quay 3
Via RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):