CVE-2021-28678: Input Validation
A flaw was found in python-pillow. BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data.
Other sources
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data. This dates to Pillow 5.1.0.
References: https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security https://github.com/python-pillow/Pillow/pull/5377
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2021-28678?
CVE-2021-28678 is a vulnerability found in the python-pillow library, allowing for a Denial of Service (DoS) attack by running the decoder on empty data.
What is the severity of CVE-2021-28678?
CVE-2021-28678 has a severity score of 7.5, which is considered high.
How do I fix CVE-2021-28678?
To fix CVE-2021-28678, you should update python-pillow to version 8.2.0 or higher.
Where can I find more information about CVE-2021-28678?
You can find more information about CVE-2021-28678 in the following references: [https://www.cve.org/CVERecord?id=CVE-2021-28678](https://www.cve.org/CVERecord?id=CVE-2021-28678), [https://nvd.nist.gov/vuln/detail/CVE-2021-28678](https://nvd.nist.gov/vuln/detail/CVE-2021-28678), [https://bugzilla.redhat.com/show_bug.cgi?id=1958263](https://bugzilla.redhat.com/show_bug.cgi?id=1958263), [https://access.redhat.com/errata/RHSA-2021:4149](https://access.redhat.com/errata/RHSA-2021:4149).
What is the Common Weakness Enumeration (CWE) of CVE-2021-28678?
CVE-2021-28678 is associated with CWE-20 (Improper Input Validation) and CWE-345 (Insufficient Verification of Data Authenticity).