Log in Start free

Vulnerability · Published Nov 3, 2023 · Assigned by mitre

CVE-2023-44271

High 7.5

In plain English

A high-severity security flaw in the python3-pillow package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.4%top 28.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8python3-pillow5.1.1-20.el8ALSA-2024:3005
AlmaLinux:8python3-pillow-devel5.1.1-20.el8ALSA-2024:3005
AlmaLinux:8python3-pillow-doc5.1.1-20.el8ALSA-2024:3005
AlmaLinux:8python3-pillow-tk5.1.1-20.el8ALSA-2024:3005
Debian:12pillow9.4.0-1.1+deb12u1DSA-5704-1
Debian:12pillow9.4.0-1.1+deb12u1DEBIAN-CVE-2023-44271
Debian:13pillow10.0.0-1DEBIAN-CVE-2023-44271
Debian:14pillow10.0.0-1DEBIAN-CVE-2023-44271
PyPIpillow10.0.0GHSA-8ghj-p4vj-mr35
PyPIpillow10.0.0PYSEC-2023-227
Rocky Linux:8python-pillow0:5.1.1-20.el8RLSA-2024:3005
Ubuntu:22.04:LTSpillow9.0.1-1ubuntu0.2USN-6618-1
Ubuntu:22.04:LTSpillow9.0.1-1ubuntu0.2UBUNTU-CVE-2023-44271

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References