Pillow Denial of Service vulnerability

高 7.5CVE-2023-44271 · BIT-pillow-2023-44271 · GHSA-8ghj-p4vj-mr35 · 03/11/2023 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
pillow PyPI	`< 10.0.0`	`10.0.0`
pillow python	`< 10.0.0`	`10.0.0`

概要

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

NVD の説明

参考情報

nvd.nist.gov/vuln/detail/CVE-2023-44271 · ADVISORY
python-pillow/Pillow#7244 · WEB
python-pillow/Pillow commit 1fe1bb4 · WEB
devhub.checkmarx.com/cve-details/CVE-2023-44271 · WEB
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
lists.debian.org/debian-lts-announce/2024/03/msg00021.html · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4 · WEB
devhub.checkmarx.com/cve-details/CVE-2023-44271 · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4 · Mailing List
GitHub Advisory GHSA-8ghj-p4vj-mr35 · ADVISORY

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン