CVE-2021-28677

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of r and n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

Affected Software

Name	Vendor	Start Version	End Version
Pillow	Python	*	8.2.0 (excluding)
Red Hat Enterprise Linux 8	RedHat	python-pillow-0:5.1.1-16.el8	*
Pillow	Ubuntu	bionic	*
Pillow	Ubuntu	devel	*
Pillow	Ubuntu	esm-infra-legacy/trusty	*
Pillow	Ubuntu	esm-infra-legacy/xenial	*
Pillow	Ubuntu	esm-infra/bionic	*
Pillow	Ubuntu	esm-infra/focal	*
Pillow	Ubuntu	esm-infra/xenial	*
Pillow	Ubuntu	focal	*
Pillow	Ubuntu	groovy	*
Pillow	Ubuntu	hirsute	*
Pillow	Ubuntu	impish	*
Pillow	Ubuntu	jammy	*
Pillow	Ubuntu	kinetic	*
Pillow	Ubuntu	lunar	*
Pillow	Ubuntu	mantic	*
Pillow	Ubuntu	noble	*
Pillow	Ubuntu	oracular	*
Pillow	Ubuntu	plucky	*
Pillow	Ubuntu	questing	*
Pillow	Ubuntu	resolute	*
Pillow	Ubuntu	stonking	*
Pillow	Ubuntu	trusty	*
Pillow	Ubuntu	trusty/esm	*
Pillow	Ubuntu	upstream	*
Pillow	Ubuntu	xenial	*
Pillow-python2	Ubuntu	focal	*
Pillow-python2	Ubuntu	groovy	*
Python-imaging	Ubuntu	precise/esm	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-28677
CWE	https://cwe.mitre.org/data/definitions/.html

Affected Software

References