Moderate: python-pillow security update
Summary
ALSA-2021:4149: Moderate: python-pillow security update. Affects python3-pillow versions < 5.1.1-16.el8. Fixed in 5.1.1-16.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. It is widely used in various applications for image manipulation and processing.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the python-pillow library. These vulnerabilities include out-of-bounds reads, negative-offset memcpy, regular expression denial of service, excessive memory allocation, infinite loop, buffer overflow, and buffer over-read issues. These vulnerabilities could potentially lead to various security risks such as information disclosure, denial of service, and potential remote code execution.
How To Fix
Minimum fixed version
5.1.1-16.el8
This is the first release that contains the fix.
sudo dnf update python3-pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the python-pillow package to the latest version is crucial to mitigate the security risks associated with these vulnerabilities. It is recommended to follow the provided instructions and update the package as soon as possible. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python3-pillow →
FAQ
Python-pillow is a Python image processing library that provides extensive file format support and powerful image-processing capabilities.
These vulnerabilities could potentially lead to information disclosure, denial of service, and potential remote code execution.
You can check the version of python-pillow installed on your system by running the following command:
pip show pillow
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update to the latest version of python-pillow.
You can find more information about these vulnerabilities, including their CVE identifiers, in the references section of the official security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
