CVE-2021-25288: Critical severity python imaging library (pillow) vulnerability
Published Apr 1, 2021
·Updated
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2kugrayi.
Other sources
There is an out-of-bounds read in J2kDecode in j2kugrayi. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.
Affected Software
5 affected componentsFixes available
redhat/python-pillow<0:5.1.1-16.el8
0:5.1.1-16.el8
redhat/python-pillow<8.2.0
8.2.0
pip/Pillow>=2.4.0<8.2.0
8.2.0
Python Pillow<8.2.0
Fedoraproject Fedora=33
Remediation
Information
To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.
Event History
Apr 1, 2021
CVE Published
12:00 AM
Jun 2, 2021
CVE Published
via MITRE·03:13 PM
Data Sourced
via MITRE·03:13 PM
Description
Jun 8, 2021
Advisory Published
via GitHub·06:49 PM
Frequently Asked Questions
1
What is the severity of CVE-2021-25288?
The severity of CVE-2021-25288 is critical with a CVSS score of 9.1.
2
How can I fix CVE-2021-25288?
To fix CVE-2021-25288, upgrade to version 8.2.0 of Pillow.
3
What is the affected software for CVE-2021-25288?
The affected software for CVE-2021-25288 includes Python Pillow versions up to and excluding 8.2.0, as well as Red Hat's python-pillow package versions 0:5.1.1-16.el8.
4
What is the CWE of CVE-2021-25288?
The CWE of CVE-2021-25288 is CWE-125.
5
Are there any references for CVE-2021-25288?
Yes, there are references available for CVE-2021-25288. You can find them at the following URLs: [link1], [link2], [link3].