GHSA-4fx9-vc88-q2xc Infinite loop in Pillow
An attacker can cause a denial of service via infinite loop in Pillow by providing a truncated JPEG file that bypasses EOF detection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-4fx9-vc88-q2xc?
GHSA-4fx9-vc88-q2xc is a denial of service vulnerability in Pillow, published on 11 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.
If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.
Which versions are affected by GHSA-4fx9-vc88-q2xc?
2 open source packages ship an affected version, including Pillow and pillow.
| Package | Affected | Fixed in |
|---|---|---|
Pillow PyPI | All versions | 9.0.0 |
pillow PyPI | All versions | 9.0.0 |
How do I fix GHSA-4fx9-vc88-q2xc?
Upgrade Pillow to 9.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-4fx9-vc88-q2xc being exploited?
There is no known exploitation of GHSA-4fx9-vc88-q2xc in the wild and no public exploit code.