CVE-2021-34552: Pillow Buffer Overflow Vulnerability
Summary
CVE-2021-34552: Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. Affects pillow across 2 version ranges.
>= 1.0.0, < 1.1.8
>= 1.2.0, < 8.2.1
Fixed in 1.1.8 or 8.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- pillow · PyPI
- py3-pillow · Alpine:v3.15
- pillow · PyPI
The same CVE-2021-34552 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It is widely used in various applications and frameworks to handle image-related tasks. However, versions up to 8.2.0 of Pillow and PIL (Python Imaging Library) up to 1.1.7 are susceptible to a buffer overflow vulnerability in the Convert.c module. This vulnerability allows an attacker to exploit controlled parameters passed into the convert function, potentially leading to arbitrary code execution.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation in the convert function of Pillow and PIL. By crafting malicious input, an attacker can trigger a buffer overflow in the Convert.c module. This can result in the execution of arbitrary code, potentially compromising the integrity and confidentiality of the affected system. The severity of this vulnerability is assessed as critical with a CVSSv3 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.1.81.1.8 -
>= 1.2.0, < 8.2.18.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization measures when using the convert function in Pillow or PIL. By carefully validating and filtering user-supplied input, the risk of triggering the buffer overflow can be reduced. Here is an example of how to sanitize input using Python's built-in string manipulation functions:
input_data = sanitize_input(user_input)
convert(input_data)
Conclusion
In conclusion, the Pillow buffer overflow vulnerability (CVE-2021-34552) poses a significant risk to systems utilizing vulnerable versions of Pillow and PIL. It is crucial for developers to update their dependencies to the patched versions and implement proper input validation to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functions and utilities to handle image-related tasks, such as resizing, cropping, and applying filters.
PIL stands for Python Imaging Library. It is an older version of Pillow and provides similar functionality for image processing and manipulation in Python.
The buffer overflow vulnerability in Pillow occurs due to a lack of proper input validation in the convert function. Attackers can exploit this by passing controlled parameters that trigger the overflow in the Convert.c module.
This vulnerability can allow attackers to execute arbitrary code on the affected system. This can lead to various consequences, including unauthorized access, data theft, and system compromise.
Yes, a fix is available for this vulnerability. Developers should update Pillow or PIL to version 1.1.7 or higher for PIL, and version 8.2.0 or higher for Pillow. These versions include the necessary patches to mitigate the buffer overflow vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
