CVE-2021-28676: Input Validation
A flaw was found in python-pillow. FliDecode.c did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. This issue dates to the PIL fork. The highest threat from this vulnerability is to system availability.
Other sources
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
FliDecode.c did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. This dates to the PIL fork.
References: https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security https://github.com/python-pillow/Pillow/pull/5377
— Red Hat
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-28676?
CVE-2021-28676 is a vulnerability in Pillow before version 8.2.0 that could lead to an infinite loop on load, potentially impacting system availability.
How does CVE-2021-28676 affect the system availability?
CVE-2021-28676 can affect system availability by causing an infinite loop on load.
What is the severity of CVE-2021-28676?
CVE-2021-28676 is classified as a high severity vulnerability with a severity value of 7.
Which software is affected by CVE-2021-28676?
Python Pillow versions before 8.2.0, specifically version 0:5.1.1-16.el8, are affected by CVE-2021-28676.
How do I fix CVE-2021-28676?
To fix CVE-2021-28676, upgrade to version 8.2.0 of Python Pillow, which includes the necessary security patches.