RHSA-2020:3185: Important: python-pillow security update

Published Jul 28, 2020
·
Updated

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.Security Fix(es): python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538) python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

21 affected componentsFixes available
redhat/python-pillow<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debugsource<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow-tk-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debugsource<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow-tk-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debugsource<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python3-pillow-tk-debuginfo<5.1.1-12.el8_2
5.1.1-12.el8_2
redhat/python-pillow-debuginfo<5.1.1-12.el8_2.aa
5.1.1-12.el8_2.aa
redhat/python-pillow-debugsource<5.1.1-12.el8_2.aa
5.1.1-12.el8_2.aa
redhat/python3-pillow<5.1.1-12.el8_2.aa
5.1.1-12.el8_2.aa
redhat/python3-pillow-debuginfo<5.1.1-12.el8_2.aa
5.1.1-12.el8_2.aa
redhat/python3-pillow-tk-debuginfo<5.1.1-12.el8_2.aa
5.1.1-12.el8_2.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/python-pillow to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2
  2. Upgrade

    Upgrade redhat/python-pillow-debuginfo to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2
  3. Upgrade

    Upgrade redhat/python-pillow-debugsource to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2
  4. Upgrade

    Upgrade redhat/python3-pillow to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2
  5. Upgrade

    Upgrade redhat/python3-pillow-debuginfo to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2
  6. Upgrade

    Upgrade redhat/python3-pillow-tk-debuginfo to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2
  7. Upgrade

    Upgrade redhat/python-pillow-debuginfo to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2.aa
  8. Upgrade

    Upgrade redhat/python-pillow-debugsource to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2.aa
  9. Upgrade

    Upgrade redhat/python3-pillow to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2.aa
  10. Upgrade

    Upgrade redhat/python3-pillow-debuginfo to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2.aa
  11. Upgrade

    Upgrade redhat/python3-pillow-tk-debuginfo to a version that resolves this vulnerability.

    Fixed in 5.1.1-12.el8_2.aa
  12. Upgrade

    Upgrade python-pillow to a version that resolves this vulnerability.

    Patch CVE-2020-5313
  13. Upgrade

    Upgrade python-pillow to a version that resolves this vulnerability.

    Patch CVE-2020-11538

Event History

Aug 7, 2025
Advisory Published
via Red Hat·06:38 AM
Data Sourced
via Red Hat·06:38 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

What is the severity of RHSA-2020:3185?

The severity of RHSA-2020:3185 is categorized as critical due to out-of-bounds reads and writes in the python-pillow package.

2

How do I fix RHSA-2020:3185?

To fix RHSA-2020:3185, you should update the python-pillow package to version 5.1.1-12.el8_2 or later.

3

Which packages are affected by RHSA-2020:3185?

The affected packages include python-pillow, python3-pillow, and their respective debuginfo and debugsource variants.

4

What vulnerabilities are addressed in RHSA-2020:3185?

RHSA-2020:3185 addresses vulnerabilities that lead to potential out-of-bounds reads and writes during image parsing.

5

Is there a specific version to upgrade to for RHSA-2020:3185?

Yes, you should upgrade to version 5.1.1-12.el8_2 or later to mitigate the vulnerabilities addressed in RHSA-2020:3185.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203