7.5high
CVE-2019-16865
DOS attack in Pillow when processing specially crafted image files
Also known as GHSA-j7mj-748x-7p78, PYSEC-2019-110
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.1%
percentile 88%
Public exploits
0
none known
Summary
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Exploit prediction (EPSS)
3.13% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | pillow | <6.2.0 | 6.2.0 |
Classification
- Weakness
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- pillow.readthedocs.io /en/latest/releasenotes/6.2.0.html · x_refsource_MISC, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPR · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OX · vendor-advisory, x_refsource_FEDORA, x_transferred
- usn.ubuntu.com /4272-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
- access.redhat.com /errata/RHSA-2020:0566 · vendor-advisory, x_refsource_REDHAT, x_transferred
- debian.org /security/2020/dsa-4631 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- access.redhat.com /errata/RHSA-2020:0580 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2020:0578 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2020:0681 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2020:0683 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2020:0694 · vendor-advisory, x_refsource_REDHAT, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2019-16865 · advisory
- github.com /python-pillow/Pillow/issues/4123 · web
- github.com /python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb · web
- usn.ubuntu.com /4272-1 · web
- ubuntu.com /security/notices/USN-4272-1 · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJ · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC · web
- github.com /python-pillow/Pillow · package
- github.com /pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml · web
- github.com /advisories/GHSA-j7mj-748x-7p78 · advisory
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJ · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC · web
Sources
- CVE List: CVE-2019-16865
- GitHub Advisory: GHSA-j7mj-748x-7p78
- NVD: CVE-2019-16865
- OSV: PYSEC-2019-110
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.