New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BE-157/CVE-2021-28675 #15

Merged

icanhasmath merged 1 commit into 6.2.x from BE-157/CVE-2021-28675

Apr 14, 2023

rickprice commented Apr 12, 2023

BE-157 CVE-2021-28675

commit 22e9bee
Author: Eric Soroos eric-github@soroos.net
Date: Sun Mar 7 19:04:25 2021 +0100
Fix DOS in PSDImagePlugin -- CVE-2021-28675

PSDImagePlugin did not sanity check the number of input layers and
vs the size of the data block, this could lead to a DOS on
Image.open prior to Image.load.
This issue dates to the PIL fork

rickprice commented

View reviewed changes

docs/releasenotes/6.2.2.2.rst Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_tiff_crashes.py Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_file_webp.py Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_file_ppm.py Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_file_gd.py Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_file_jpeg2k.py Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_file_spider.py Outdated Show resolved Hide resolved

rickprice commented

View reviewed changes

Tests/test_image.py Outdated Show resolved Hide resolved

rickprice force-pushed the BE-157/CVE-2021-28675 branch 3 times, most recently from 5d807a8 to 0090b52 Compare

April 14, 2023 16:31


          BE-157-CVE-2021-28675

28ef1d4

Fix DOS in PSDImagePlugin -- CVE-2021-28675

* PSDImagePlugin did not sanity check the number of input layers and
  vs the size of the data block, this could lead to a DOS on
  Image.open prior to Image.load.
* This issue dates to the PIL fork

Apply fix 8febdad

rickprice force-pushed the BE-157/CVE-2021-28675 branch from 0090b52 to 28ef1d4 Compare

April 14, 2023 21:33

icanhasmath merged commit 97671b5 into 6.2.x

icanhasmath deleted the BE-157/CVE-2021-28675 branch

April 14, 2023 21:36

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet