Invalid tile boundaries could lead to an OOB Read in TiffReadRGBATile in In TiffDecode.c.
Created mingw-python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1934695]
Created python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1934693]
Created python2-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1934694]
Created python3-pillow tracking bugs for this issue:
Affects: epel-7 [bug 1934696]
This issue did not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 8 as they did not include the vulnerable code, which was introduced in a newer upstream version than what what shipped.
Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.
This issue has been addressed in the following products:
Red Hat Quay 3
Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):