CVE-2022-45199: High severity Python Pillow vulnerability
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Other sources
Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pillowto a version that resolves this vulnerability.Fixed in 9.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.3.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-45199.
What is the severity of CVE-2022-45199?
The severity of CVE-2022-45199 is high, with a severity value of 7.5.
How does Pillow before 9.3.0 allow denial of service?
Pillow before 9.3.0 allows denial of service by not properly handling a large value in the SAMPLESPERPIXEL tag, which can lead to a memory and runtime denial of service in TiffImagePlugin.py.
How can I fix CVE-2022-45199?
You can fix CVE-2022-45199 by updating your Pillow package to version 9.3.0 or later.
Where can I find more information about CVE-2022-45199?
You can find more information about CVE-2022-45199 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-45199), [GitHub PR](https://github.com/python-pillow/Pillow/pull/6700), [GitHub Commit](https://github.com/python-pillow/Pillow/commit/2444cddab2f83f28687c7c20871574acbb6dbcf3).