CVE-2020-10994: Medium severity Python Pillow vulnerability
An out-of-bounds read flaw was found in python-pillow in the way JP2 images are parsed. An application that uses python-pillow to decode untrusted images may be vulnerable to this issue. This flaw allows an attacker to read data. The highest threat from this vulnerability is to confidentiality.
Other sources
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
— GitHub
In libImaging/Jpeg2KDecode.c in Pillow before 7.0.0, there are multiple out-of-bounds reads via a crafted JP2 file.
Pull Request:
https://github.com/python-pillow/Pillow/pull/4538
Upstream Advisory:
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
— Red Hat
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10994?
CVE-2020-10994 is an out-of-bounds read vulnerability found in python-pillow.
How does CVE-2020-10994 impact applications?
Applications that use python-pillow to decode untrusted JP2 images may be vulnerable to data leakage.
What is the severity rating of CVE-2020-10994?
CVE-2020-10994 has a severity rating of 5.5 (medium).
Which versions of python-pillow are affected by CVE-2020-10994?
Versions up to and excluding 7.1.0 of python-pillow are affected by CVE-2020-10994.
How can I remediate CVE-2020-10994?
To remediate CVE-2020-10994, upgrade python-pillow to version 7.1.0 or later.