CVE-2021-25288: Critical severity Python Pillow vulnerability
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2kugrayi.
Other sources
There is an out-of-bounds read in J2kDecode in j2kugrayi. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-pillowto a version that resolves this vulnerability.Fixed in 0:5.1.1-16.el8 - Upgrade
Upgrade
redhat/python-pillowto a version that resolves this vulnerability.Fixed in 8.2.0 - Upgrade
Upgrade
pip/Pillowto a version that resolves this vulnerability.Fixed in 8.2.0 - Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 8.2.0 - Configuration
Keep the invoice generation feature disabled.
Red Hat Quay invoice generation = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25288?
The severity of CVE-2021-25288 is critical with a CVSS score of 9.1.
How can I fix CVE-2021-25288?
To fix CVE-2021-25288, upgrade to version 8.2.0 of Pillow.
What is the affected software for CVE-2021-25288?
The affected software for CVE-2021-25288 includes Python Pillow versions up to and excluding 8.2.0, as well as Red Hat's python-pillow package versions 0:5.1.1-16.el8.
What is the CWE of CVE-2021-25288?
The CWE of CVE-2021-25288 is CWE-125.
Are there any references for CVE-2021-25288?
Yes, there are references available for CVE-2021-25288. You can find them at the following URLs: [link1], [link2], [link3].