CVE-2023-44271

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Allocation of Resources Without Limits or Throttling pada python pillow, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Rincian

Terbit di NVD

3 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 patch
• https://github.com/python-pillow/Pillow/pull/7244 patch
• https://devhub.checkmarx.com/cve-details/CVE-2023-44271/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCU... mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html