REDHAT-BUG-2497452: High severity Pillow Pillow vulnerability
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdfchar() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image.decompressionbombcheck(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 12.3.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2497452?
The severity of REDHAT-BUG-2497452 is categorized as high, with a risk score of 7.
How do I fix REDHAT-BUG-2497452?
To fix REDHAT-BUG-2497452, update Pillow to version 12.3.0 or later.
What is the impact of REDHAT-BUG-2497452?
The impact of REDHAT-BUG-2497452 is that attacker-controlled dimensions can be passed to Image.new(), which may lead to decompression bomb vulnerabilities.
Which versions of Pillow are affected by REDHAT-BUG-2497452?
Versions of Pillow prior to 12.3.0 are affected by REDHAT-BUG-2497452.
Is there a workaround for REDHAT-BUG-2497452?
There is no official workaround for REDHAT-BUG-2497452; upgrading to a patched version is recommended.