CVE-2021-28677

Source
https://nvd.nist.gov/vuln/detail/CVE-2021-28677
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-28677.json
Aliases
Related
Published
2021-06-02T16:15:08Z
Modified
2023-12-06T01:01:01.924504Z
Details

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

References

Affected packages

Alpine:v3.14 / py3-pillow

Package

Name
py3-pillow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
8.2.0-r0

Affected versions

7.*

7.1.1-r0
7.1.2-r0
7.2.0-r0

8.*

8.1.0-r0
8.1.2-r0
8.1.2-r1

Alpine:v3.15 / py3-pillow

Package

Name
py3-pillow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
8.2.0-r0

Affected versions

7.*

7.1.1-r0
7.1.2-r0
7.2.0-r0

8.*

8.1.0-r0
8.1.2-r0
8.1.2-r1

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
0The exact introduced commit is unknown
Fixed

Affected versions

1.*

1.0
1.2
1.7.6
1.7.7
1.7.8

2.*

2.0.0
2.1.0
2.2.0
2.2.1
2.2.2
2.3.0
2.5.0
2.6.0
2.6.0-rc1
2.7.0
2.8.0
2.8.1
2.9.0
2.9.0.dev0
2.9.0.dev1
2.9.0.dev2

3.*

3.0.0
3.1.0
3.1.0-rc1
3.2.0
3.3.0
3.3.1
3.4.0

4.*

4.0.0
4.0.0a
4.1.0
4.2.0
4.3.0

5.*

5.0.0
5.1.0
5.2.0
5.3.0
5.4.0

6.*

6.0.0
6.1.0
6.2.0

7.*

7.0.0
7.1.0
7.2.0

8.*

8.0.0
8.1.0