The previous fix for CVE-2020-35654 was insufficient due to incorrect error checking in TiffDecode.c.
Created mingw-python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1934683]
Created python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1934681]
Created python2-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1934682]
Created python3-pillow tracking bugs for this issue:
Affects: epel-7 [bug 1934684]
Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.
Upstream patch seems to be:
python-pillow as shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw as the flaw was introduced in a newer version than shipped.
This issue has been addressed in the following products:
Red Hat Quay 3
Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):