Bug 1935384 (CVE-2021-27921) - CVE-2021-27921 python-pillow: Excessive memory allocation in BLP image reader
Summary: CVE-2021-27921 python-pillow: Excessive memory allocation in BLP image reader
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-27921
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1935385 1935386 1935387 1935388 1935584 1939594 1939595
Blocks: 1934710
TreeView+ depends on / blocked
 
Reported: 2021-03-04 19:26 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-11-09 17:24 UTC (History)
13 users (show)

Fixed In Version: python-pillow 8.1.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
Clone Of:
Environment:
Last Closed: 2021-10-19 14:09:06 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3917 0 None None None 2021-10-19 12:11:03 UTC
Red Hat Product Errata RHSA-2021:4149 0 None None None 2021-11-09 17:24:30 UTC

Description Guilherme de Almeida Suckevicz 2021-03-04 19:26:20 UTC 
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

Reference:
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
Comment 1 Guilherme de Almeida Suckevicz 2021-03-04 19:26:55 UTC 
Created mingw-python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1935388]


Created python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1935385]


Created python2-pillow tracking bugs for this issue:

Affects: fedora-all [bug 1935386]


Created python3-pillow tracking bugs for this issue:

Affects: epel-7 [bug 1935387]
Comment 3 Jason Shepherd 2021-03-08 03:04:01 UTC 
Mitigation:

Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.
Comment 5 Riccardo Schirone 2021-03-16 16:44:29 UTC 
Upstream patch seems to be https://github.com/python-pillow/Pillow/commit/480f6819b592d7f07b9a9a52a7656c10bbe07442
Comment 7 Lumír Balhar 2021-04-08 15:25:29 UTC 
CVEs 2021-27921, 27922, and 27923 share the same fix but upstream has only ICNS file in the tests to check it. Do you plan to create also BLP and ICO files to test all three possible variants of the issue?
Comment 9 errata-xmlrpc 2021-10-19 12:11:01 UTC 
This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917
Comment 10 Product Security DevOps Team 2021-10-19 14:09:06 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27921
Comment 11 errata-xmlrpc 2021-11-09 17:24:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4149 https://access.redhat.com/errata/RHSA-2021:4149
Note You need to log in before you can comment on or make changes to this bug.