CVE-2021-28677
mediumPriorität · verfolgen · 31EPSS 0.025 · 84. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (20)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2022-1835Red Hat Enterprise Linux (python-pillow): Mehrere SchwachstellenDeutsch2021-11-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in python-pillow ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.
- GHSA-q5hq-fp76-qmrcUncontrolled Resource Consumption in Pillow2021-06-08ghsa · osvUS
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
- BIT-pillow-2021-286772024-03-06vendor · osvUS
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
- PYSEC-2021-932021-06-02vendor · osvUS
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (25)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/python-pillow/Pillow/pull/5377cnnvd
- https://github.com/python-pillow/Pillow/releases/tag/8.2.0Patchcnnvd
- https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/cnnvd
- https://packetstormsecurity.com/files/162718/Ubuntu-Security-Notice-USN-4963-1.htmlcnnvd
- https://packetstormsecurity.com/files/163500/Gentoo-Linux-Security-Advisory-202107-33.htmlcnnvd
- https://packetstormsecurity.com/files/164871/Red-Hat-Security-Advisory-2021-4149-03.htmlcnnvd
- https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-opencnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan