CVE-2021-28678

Katalog CVE

CVSS 5.5 · Medium EPSS 0,73%

Kerentanan Insufficient Verification of Data Authenticity pada python pillow, fedoraproject fedora. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Rincian

Terbit di NVD

2 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos release notes · advisory vendor
• https://github.com/python-pillow/Pillow/pull/5377 patch · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-33 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3...