QID 357365

Date Published: 2024-04-02

QID 357365: Amazon Linux Security Advisory for python-pillow : ALAS2-2024-2508

An issue was discovered in pillow before 10.0.0.
It is a denial of service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory.
This occurs for truetype in imagefont when textlength in an imagedraw instance operates on a long text argument. (
( CVE-2023-44271) affected versions of this package are vulnerable to denial of service (dos) when using arbitrary strings as text input and the number of characters passed into pil.imagefont.imagefont.getmask() is over a certain limit.
This can lead to a system crash. affected versions of this package are vulnerable to denial of service (dos) if the size of individual glyphs extends beyond the bitmap image, when using pil.imagefont.
Imagefont function.
Exploiting this vulnerability could lead to a system crash. affected versions of this package are vulnerable to command injection in filenames that contain single quotes via load_djpeg.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5.4 severity.

Solution

Please refer to Amazon advisory: ALAS2-2024-2508 for affected packages and patching details, or update with your package manager.

Vendor References

ALAS2-2024-2508 - alas.aws.amazon.com/AL2/ALAS-2024-2508.html

CVEs related to QID 357365

CVE-2023-44271 |

Software Advisories

Advisory ID	Software	Component	Link
ALAS2-2024-2508	amazon linux 2		alas.aws.amazon.com/AL2/ALAS-2024-2508.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].