csaf_redhat - RHSA-2021:4149

RHSA-2021:4149

Vulnerability from csaf_redhat

Published

2021-11-09 17:42

Modified

2024-11-13 23:33

Summary

Red Hat Security Advisory: python-pillow security update

Notes

Topic

An update for python-pillow is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es): * python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287) * python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288) * python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290) * python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292) * python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293) * python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921) * python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922) * python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923) * python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675) * python-pillow: Infinite loop in FLI image reader (CVE-2021-28676) * python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677) * python-pillow: Excessive looping in BLP image reader (CVE-2021-28678) * python-pillow: Buffer overflow in image convert function (CVE-2021-34552) * python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653) * python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for python-pillow is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)\n\n* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)\n\n* python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)\n\n* python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)\n\n* python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)\n\n* python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)\n\n* python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)\n\n* python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)\n\n* python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)\n\n* python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)\n\n* python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)\n\n* python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)\n\n* python-pillow: Buffer overflow in image convert function (CVE-2021-34552)\n\n* python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)\n\n* python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2021:4149",
            url: "https://access.redhat.com/errata/RHSA-2021:4149",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/",
         },
         {
            category: "external",
            summary: "1915420",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1915420",
         },
         {
            category: "external",
            summary: "1915432",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1915432",
         },
         {
            category: "external",
            summary: "1934685",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1934685",
         },
         {
            category: "external",
            summary: "1934699",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1934699",
         },
         {
            category: "external",
            summary: "1934705",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1934705",
         },
         {
            category: "external",
            summary: "1935384",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1935384",
         },
         {
            category: "external",
            summary: "1935396",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1935396",
         },
         {
            category: "external",
            summary: "1935401",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1935401",
         },
         {
            category: "external",
            summary: "1958226",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958226",
         },
         {
            category: "external",
            summary: "1958231",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958231",
         },
         {
            category: "external",
            summary: "1958240",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958240",
         },
         {
            category: "external",
            summary: "1958252",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958252",
         },
         {
            category: "external",
            summary: "1958257",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958257",
         },
         {
            category: "external",
            summary: "1958263",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958263",
         },
         {
            category: "external",
            summary: "1982378",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1982378",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4149.json",
         },
      ],
      title: "Red Hat Security Advisory: python-pillow security update",
      tracking: {
         current_release_date: "2024-11-13T23:33:33+00:00",
         generator: {
            date: "2024-11-13T23:33:33+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.0",
            },
         },
         id: "RHSA-2021:4149",
         initial_release_date: "2021-11-09T17:42:23+00:00",
         revision_history: [
            {
               date: "2021-11-09T17:42:23+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2021-11-09T17:42:23+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-13T23:33:33+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AppStream (v. 8)",
                        product: {
                           name: "Red Hat Enterprise Linux AppStream (v. 8)",
                           product_id: "AppStream-8.5.0.GA",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:enterprise_linux:8::appstream",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python-pillow-0:5.1.1-16.el8.src",
                        product: {
                           name: "python-pillow-0:5.1.1-16.el8.src",
                           product_id: "python-pillow-0:5.1.1-16.el8.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow@5.1.1-16.el8?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python3-pillow-0:5.1.1-16.el8.aarch64",
                        product: {
                           name: "python3-pillow-0:5.1.1-16.el8.aarch64",
                           product_id: "python3-pillow-0:5.1.1-16.el8.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                        product: {
                           name: "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                           product_id: "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                        product: {
                           name: "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                           product_id: "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                        product: {
                           name: "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                           product_id: "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                        product: {
                           name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                           product_id: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=aarch64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python3-pillow-0:5.1.1-16.el8.ppc64le",
                        product: {
                           name: "python3-pillow-0:5.1.1-16.el8.ppc64le",
                           product_id: "python3-pillow-0:5.1.1-16.el8.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                        product: {
                           name: "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                           product_id: "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                        product: {
                           name: "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                           product_id: "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                        product: {
                           name: "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                           product_id: "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                        product: {
                           name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                           product_id: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=ppc64le",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python3-pillow-0:5.1.1-16.el8.x86_64",
                        product: {
                           name: "python3-pillow-0:5.1.1-16.el8.x86_64",
                           product_id: "python3-pillow-0:5.1.1-16.el8.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                        product: {
                           name: "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                           product_id: "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                        product: {
                           name: "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                           product_id: "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                        product: {
                           name: "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                           product_id: "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
                        product: {
                           name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
                           product_id: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=x86_64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python3-pillow-0:5.1.1-16.el8.s390x",
                        product: {
                           name: "python3-pillow-0:5.1.1-16.el8.s390x",
                           product_id: "python3-pillow-0:5.1.1-16.el8.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                        product: {
                           name: "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                           product_id: "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                        product: {
                           name: "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                           product_id: "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                        product: {
                           name: "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                           product_id: "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                        product: {
                           name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                           product_id: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=s390x",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-0:5.1.1-16.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
            },
            product_reference: "python-pillow-0:5.1.1-16.el8.src",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
            },
            product_reference: "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
            },
            product_reference: "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debuginfo-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
            },
            product_reference: "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
            },
            product_reference: "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debugsource-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
            },
            product_reference: "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
            },
            product_reference: "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debugsource-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
            },
            product_reference: "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python-pillow-debugsource-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
            },
            product_reference: "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
            },
            product_reference: "python3-pillow-0:5.1.1-16.el8.aarch64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
            },
            product_reference: "python3-pillow-0:5.1.1-16.el8.ppc64le",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
            },
            product_reference: "python3-pillow-0:5.1.1-16.el8.s390x",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
            },
            product_reference: "python3-pillow-0:5.1.1-16.el8.x86_64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
            },
            product_reference: "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
            },
            product_reference: "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
            },
            product_reference: "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
            },
            product_reference: "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
            },
            product_reference: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
            },
            product_reference: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
            },
            product_reference: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            },
            product_reference: "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            relates_to_product_reference: "AppStream-8.5.0.GA",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-35653",
         cwe: {
            id: "CWE-125",
            name: "Out-of-bounds Read",
         },
         discovery_date: "2021-01-12T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1915420",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. The PcxDecode in Pillow has a buffer over-read when decoding a crafted PCX file due to the user-supplied stride value trusted for buffer calculations. The highest threat from this vulnerability is to system availability.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Buffer over-read in PCX image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2020-35653",
            },
            {
               category: "external",
               summary: "RHBZ#1915420",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1915420",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2020-35653",
               url: "https://www.cve.org/CVERecord?id=CVE-2020-35653",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-35653",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2020-35653",
            },
            {
               category: "external",
               summary: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
            },
         ],
         release_date: "2021-01-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "python-pillow: Buffer over-read in PCX image reader",
      },
      {
         cve: "CVE-2020-35655",
         cwe: {
            id: "CWE-125",
            name: "Out-of-bounds Read",
         },
         discovery_date: "2021-01-12T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1915432",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Buffer over-read in SGI RLE image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2020-35655",
            },
            {
               category: "external",
               summary: "RHBZ#1915432",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1915432",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2020-35655",
               url: "https://www.cve.org/CVERecord?id=CVE-2020-35655",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-35655",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2020-35655",
            },
            {
               category: "external",
               summary: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
            },
         ],
         release_date: "2021-01-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "python-pillow: Buffer over-read in SGI RLE image reader",
      },
      {
         cve: "CVE-2021-25287",
         cwe: {
            id: "CWE-125",
            name: "Out-of-bounds Read",
         },
         discovery_date: "2021-04-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1958226",
            },
         ],
         notes: [
            {
               category: "description",
               text: "There is an out-of-bounds read in J2kDecode in j2ku_graya_la. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Out-of-bounds read in J2K image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-25287",
            },
            {
               category: "external",
               summary: "RHBZ#1958226",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958226",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-25287",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-25287",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-25287",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-25287",
            },
         ],
         release_date: "2021-04-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled as it is by default.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Out-of-bounds read in J2K image reader",
      },
      {
         cve: "CVE-2021-25288",
         cwe: {
            id: "CWE-125",
            name: "Out-of-bounds Read",
         },
         discovery_date: "2021-04-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1958231",
            },
         ],
         notes: [
            {
               category: "description",
               text: "There is an out-of-bounds read in J2kDecode in j2ku_gray_i. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Out-of-bounds read in J2K image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-25288",
            },
            {
               category: "external",
               summary: "RHBZ#1958231",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958231",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-25288",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-25288",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-25288",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-25288",
            },
         ],
         release_date: "2021-04-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Out-of-bounds read in J2K image reader",
      },
      {
         cve: "CVE-2021-25290",
         cwe: {
            id: "CWE-120",
            name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
         },
         discovery_date: "2021-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1934685",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. In TiffDecode.c, there is a negative-offset memcpy with an invalid size which could lead to a system crash.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Negative-offset memcpy in TIFF image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-25290",
            },
            {
               category: "external",
               summary: "RHBZ#1934685",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1934685",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-25290",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-25290",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-25290",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-25290",
            },
         ],
         release_date: "2021-02-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Negative-offset memcpy in TIFF image reader",
      },
      {
         cve: "CVE-2021-25292",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2021-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1934699",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Regular expression DoS in PDF format parser",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-25292",
            },
            {
               category: "external",
               summary: "RHBZ#1934699",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1934699",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-25292",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-25292",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-25292",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-25292",
            },
         ],
         release_date: "2021-02-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Regular expression DoS in PDF format parser",
      },
      {
         cve: "CVE-2021-25293",
         cwe: {
            id: "CWE-125",
            name: "Out-of-bounds Read",
         },
         discovery_date: "2021-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1934705",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. There is an Out of Bounds Read in SGIRleDecode.c.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Out-of-bounds read in SGI RLE image reader",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-25293",
            },
            {
               category: "external",
               summary: "RHBZ#1934705",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1934705",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-25293",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-25293",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-25293",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-25293",
            },
         ],
         release_date: "2021-02-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Out-of-bounds read in SGI RLE image reader",
      },
      {
         cve: "CVE-2021-27921",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-03-03T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1935384",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Excessive memory allocation in BLP image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-27921",
            },
            {
               category: "external",
               summary: "RHBZ#1935384",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1935384",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-27921",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-27921",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-27921",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-27921",
            },
         ],
         release_date: "2021-03-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Excessive memory allocation in BLP image reader",
      },
      {
         cve: "CVE-2021-27922",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-03-03T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1935396",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Excessive memory allocation in ICNS image reader",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-27922",
            },
            {
               category: "external",
               summary: "RHBZ#1935396",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1935396",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-27922",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-27922",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-27922",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-27922",
            },
         ],
         release_date: "2021-03-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Excessive memory allocation in ICNS image reader",
      },
      {
         cve: "CVE-2021-27923",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2021-03-03T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1935401",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Excessive memory allocation in ICO image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-27923",
            },
            {
               category: "external",
               summary: "RHBZ#1935401",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1935401",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-27923",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-27923",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-27923",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-27923",
            },
         ],
         release_date: "2021-03-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Excessive memory allocation in ICO image reader",
      },
      {
         cve: "CVE-2021-28675",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2021-04-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1958240",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. PsdImagePlugin.PsdImageFile does not sanity check the number of input layers with regard to the size of the data block which could lead to a denial-of-service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Excessive memory allocation in PSD image reader",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-28675",
            },
            {
               category: "external",
               summary: "RHBZ#1958240",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958240",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-28675",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-28675",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-28675",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-28675",
            },
         ],
         release_date: "2021-04-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Excessive memory allocation in PSD image reader",
      },
      {
         cve: "CVE-2021-28676",
         cwe: {
            id: "CWE-835",
            name: "Loop with Unreachable Exit Condition ('Infinite Loop')",
         },
         discovery_date: "2021-04-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1958252",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. FliDecode.c did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. This issue dates to the PIL fork. The highest threat from this vulnerability is to system availability.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Infinite loop in FLI image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-28676",
            },
            {
               category: "external",
               summary: "RHBZ#1958252",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958252",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-28676",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-28676",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-28676",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-28676",
            },
            {
               category: "external",
               summary: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security",
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security",
            },
         ],
         release_date: "2021-04-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "To mitigate this feature on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Infinite loop in FLI image reader",
      },
      {
         cve: "CVE-2021-28677",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2021-04-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1958257",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. The readline used in EPS has to deal with any combination of \\r and \\n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a denial-of-service of Pillow in the open phase, before an image was accepted for opening.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Excessive CPU use in EPS image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-28677",
            },
            {
               category: "external",
               summary: "RHBZ#1958257",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958257",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-28677",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-28677",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-28677",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-28677",
            },
         ],
         release_date: "2021-04-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Excessive CPU use in EPS image reader",
      },
      {
         cve: "CVE-2021-28678",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2021-04-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1958263",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Excessive looping in BLP image reader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-28678",
            },
            {
               category: "external",
               summary: "RHBZ#1958263",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1958263",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-28678",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-28678",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-28678",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-28678",
            },
         ],
         release_date: "2021-04-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Excessive looping in BLP image reader",
      },
      {
         cve: "CVE-2021-34552",
         cwe: {
            id: "CWE-119",
            name: "Improper Restriction of Operations within the Bounds of a Memory Buffer",
         },
         discovery_date: "2021-07-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1982378",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in python-pillow. This flaw allows an attacker to pass controlled parameters directly into a convert function, triggering a buffer overflow in the \"convert()\" or \"ImagingConvertTransparent()\" functions in Convert.c. The highest threat to this vulnerability is to system availability.\r\n\r\nIn Red Hat Quay, a vulnerable version of python-pillow is shipped with quay-registry-container, however the invoice generation feature which uses python-pillow is disabled by default. Therefore impact has been rated Moderate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "python-pillow: Buffer overflow in image convert function",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Due to the compiler options used, the buffer overflow is detected and the impact is lowered to a crash only. Additionally, the \"mode\" parameter has to be attacker controlled, which is considered a rare case.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
               "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-34552",
            },
            {
               category: "external",
               summary: "RHBZ#1982378",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1982378",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-34552",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-34552",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-34552",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-34552",
            },
            {
               category: "external",
               summary: "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow",
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow",
            },
         ],
         release_date: "2021-07-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2021-11-09T17:42:23+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2021:4149",
            },
            {
               category: "workaround",
               details: "To mitigate this flaw on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.\n\nRed Hat Satellite 6.9 customers can apply following hotfix to eliminate the vulnerability warnings.\n* Download python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm from https://bugzilla.redhat.com/attachment.cgi?id=1819471\n* Stop services:\n# satellite-maintain service stop\n* Upgrade python2-daemon and remove affected package\n# rpm -Uvh python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm\n# yum remove python-pillow\n* Restart services:\n# satellite-maintain service start\n\nSatellite 6.10 future release is also fixing this.",
               product_ids: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
                  "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "python-pillow: Buffer overflow in image convert function",
      },
   ],
}

cve-2021-27921

Vulnerability from cvelistv5

Published

2021-03-03 08:41

Modified

2024-08-03 21:33

Severity ?

Summary

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:33:16.796Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
               },
               {
                  name: "FEDORA-2021-0ece308612",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
               },
               {
                  name: "FEDORA-2021-15845d3abe",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
               },
               {
                  name: "FEDORA-2021-9016a9b7bd",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:07:09",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
            },
            {
               name: "FEDORA-2021-0ece308612",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
            },
            {
               name: "FEDORA-2021-15845d3abe",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
            },
            {
               name: "FEDORA-2021-9016a9b7bd",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-27921",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                  },
                  {
                     name: "FEDORA-2021-0ece308612",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
                  },
                  {
                     name: "FEDORA-2021-15845d3abe",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
                  },
                  {
                     name: "FEDORA-2021-9016a9b7bd",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-27921",
      datePublished: "2021-03-03T08:41:57",
      dateReserved: "2021-03-03T00:00:00",
      dateUpdated: "2024-08-03T21:33:16.796Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-28676

Vulnerability from cvelistv5

Published

2021-06-02 00:00

Modified

2024-08-03 21:47

Severity ?

Summary

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos
	https://github.com/python-pillow/Pillow/pull/5377
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/	vendor-advisory
	https://security.gentoo.org/glsa/202107-33	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html	mailing-list
	https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:47:33.080Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/python-pillow/Pillow/pull/5377",
               },
               {
                  name: "FEDORA-2021-77756994ba",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
               {
                  name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-16T22:21:57.599702",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos",
            },
            {
               url: "https://github.com/python-pillow/Pillow/pull/5377",
            },
            {
               name: "FEDORA-2021-77756994ba",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
            {
               name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
            },
            {
               url: "https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-28676",
      datePublished: "2021-06-02T00:00:00",
      dateReserved: "2021-03-18T00:00:00",
      dateUpdated: "2024-08-03T21:47:33.080Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-25287

Vulnerability from cvelistv5

Published

2021-06-02 15:13

Modified

2024-08-03 19:56

Severity ?

Summary

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode	x_refsource_MISC
	https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.099Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
               },
               {
                  name: "FEDORA-2021-77756994ba",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:07:07",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
            },
            {
               name: "FEDORA-2021-77756994ba",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-25287",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
                  },
                  {
                     name: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
                     refsource: "MISC",
                     url: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
                  },
                  {
                     name: "FEDORA-2021-77756994ba",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-25287",
      datePublished: "2021-06-02T15:13:14",
      dateReserved: "2021-01-17T00:00:00",
      dateUpdated: "2024-08-03T19:56:11.099Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-27923

Vulnerability from cvelistv5

Published

2021-03-03 08:41

Modified

2024-08-03 21:33

Severity ?

Summary

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:33:16.870Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
               },
               {
                  name: "FEDORA-2021-0ece308612",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
               },
               {
                  name: "FEDORA-2021-15845d3abe",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
               },
               {
                  name: "FEDORA-2021-9016a9b7bd",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:06:56",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
            },
            {
               name: "FEDORA-2021-0ece308612",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
            },
            {
               name: "FEDORA-2021-15845d3abe",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
            },
            {
               name: "FEDORA-2021-9016a9b7bd",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-27923",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                  },
                  {
                     name: "FEDORA-2021-0ece308612",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
                  },
                  {
                     name: "FEDORA-2021-15845d3abe",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
                  },
                  {
                     name: "FEDORA-2021-9016a9b7bd",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-27923",
      datePublished: "2021-03-03T08:41:40",
      dateReserved: "2021-03-03T00:00:00",
      dateUpdated: "2024-08-03T21:33:16.870Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-25292

Vulnerability from cvelistv5

Published

2021-03-19 03:30

Modified

2024-08-03 19:56

Severity ?

Summary

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html	x_refsource_MISC
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.180Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:06:49",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-25292",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-25292",
      datePublished: "2021-03-19T03:30:39",
      dateReserved: "2021-01-17T00:00:00",
      dateUpdated: "2024-08-03T19:56:11.180Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-35653

Vulnerability from cvelistv5

Published

2021-01-12 08:02

Modified

2024-08-04 17:09

Severity ?

Summary

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/index.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T17:09:14.596Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
               },
               {
                  name: "FEDORA-2021-a8ddc1ce70",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/",
               },
               {
                  name: "FEDORA-2021-880aa7bd27",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/",
               },
               {
                  name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-22T12:06:13",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
            },
            {
               name: "FEDORA-2021-a8ddc1ce70",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/",
            },
            {
               name: "FEDORA-2021-880aa7bd27",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/",
            },
            {
               name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2020-35653",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
                  },
                  {
                     name: "FEDORA-2021-a8ddc1ce70",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/",
                  },
                  {
                     name: "FEDORA-2021-880aa7bd27",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/",
                  },
                  {
                     name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2020-35653",
      datePublished: "2021-01-12T08:02:35",
      dateReserved: "2020-12-23T00:00:00",
      dateUpdated: "2024-08-04T17:09:14.596Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-27922

Vulnerability from cvelistv5

Published

2021-03-03 08:41

Modified

2024-08-03 21:33

Severity ?

Summary

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:33:17.231Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
               },
               {
                  name: "FEDORA-2021-0ece308612",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
               },
               {
                  name: "FEDORA-2021-15845d3abe",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
               },
               {
                  name: "FEDORA-2021-9016a9b7bd",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:07:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
            },
            {
               name: "FEDORA-2021-0ece308612",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
            },
            {
               name: "FEDORA-2021-15845d3abe",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
            },
            {
               name: "FEDORA-2021-9016a9b7bd",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-27922",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                  },
                  {
                     name: "FEDORA-2021-0ece308612",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/",
                  },
                  {
                     name: "FEDORA-2021-15845d3abe",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/",
                  },
                  {
                     name: "FEDORA-2021-9016a9b7bd",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-27922",
      datePublished: "2021-03-03T08:41:50",
      dateReserved: "2021-03-03T00:00:00",
      dateUpdated: "2024-08-03T21:33:17.231Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-35655

Vulnerability from cvelistv5

Published

2021-01-12 08:08

Modified

2024-08-04 17:09

Severity ?

Summary

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/index.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T17:09:14.831Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
               },
               {
                  name: "FEDORA-2021-a8ddc1ce70",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/",
               },
               {
                  name: "FEDORA-2021-880aa7bd27",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-24T02:06:07",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
            },
            {
               name: "FEDORA-2021-a8ddc1ce70",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/",
            },
            {
               name: "FEDORA-2021-880aa7bd27",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2020-35655",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
                  },
                  {
                     name: "FEDORA-2021-a8ddc1ce70",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/",
                  },
                  {
                     name: "FEDORA-2021-880aa7bd27",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2020-35655",
      datePublished: "2021-01-12T08:08:47",
      dateReserved: "2020-12-23T00:00:00",
      dateUpdated: "2024-08-04T17:09:14.831Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-34552

Vulnerability from cvelistv5

Published

2021-07-13 00:00

Modified

2024-08-04 00:12

Severity ?

Summary

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/index.html
	https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow
	https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/	vendor-advisory
	https://security.gentoo.org/glsa/202211-10	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T00:12:50.456Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow",
               },
               {
                  name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
               },
               {
                  name: "FEDORA-2021-bf01a738f3",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/",
               },
               {
                  name: "FEDORA-2021-3ec845dc0c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/",
               },
               {
                  name: "GLSA-202211-10",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202211-10",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-22T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
            },
            {
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow",
            },
            {
               name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
            },
            {
               name: "FEDORA-2021-bf01a738f3",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/",
            },
            {
               name: "FEDORA-2021-3ec845dc0c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/",
            },
            {
               name: "GLSA-202211-10",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202211-10",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-34552",
      datePublished: "2021-07-13T00:00:00",
      dateReserved: "2021-06-10T00:00:00",
      dateUpdated: "2024-08-04T00:12:50.456Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-28677

Vulnerability from cvelistv5

Published

2021-06-02 15:18

Modified

2024-08-03 21:47

Severity ?

Summary

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open	x_refsource_MISC
	https://github.com/python-pillow/Pillow/pull/5377	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:47:33.133Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/python-pillow/Pillow/pull/5377",
               },
               {
                  name: "FEDORA-2021-77756994ba",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
               {
                  name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-22T12:06:18",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/python-pillow/Pillow/pull/5377",
            },
            {
               name: "FEDORA-2021-77756994ba",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
            {
               name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-28677",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open",
                  },
                  {
                     name: "https://github.com/python-pillow/Pillow/pull/5377",
                     refsource: "MISC",
                     url: "https://github.com/python-pillow/Pillow/pull/5377",
                  },
                  {
                     name: "FEDORA-2021-77756994ba",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
                  {
                     name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-28677",
      datePublished: "2021-06-02T15:18:49",
      dateReserved: "2021-03-18T00:00:00",
      dateUpdated: "2024-08-03T21:47:33.133Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-28675

Vulnerability from cvelistv5

Published

2021-06-02 14:29

Modified

2024-08-03 21:47

Severity ?

Summary

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:47:33.112Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin",
               },
               {
                  name: "FEDORA-2021-77756994ba",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:07:14",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin",
            },
            {
               name: "FEDORA-2021-77756994ba",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-28675",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin",
                  },
                  {
                     name: "FEDORA-2021-77756994ba",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-28675",
      datePublished: "2021-06-02T14:29:12",
      dateReserved: "2021-03-18T00:00:00",
      dateUpdated: "2024-08-03T21:47:33.112Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-25290

Vulnerability from cvelistv5

Published

2021-03-19 03:29

Modified

2024-08-03 19:56

Severity ?

Summary

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html	x_refsource_MISC
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.089Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
               {
                  name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-22T12:06:15",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
            {
               name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-25290",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
                  {
                     name: "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-25290",
      datePublished: "2021-03-19T03:29:57",
      dateReserved: "2021-01-17T00:00:00",
      dateUpdated: "2024-08-03T19:56:11.089Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-28678

Vulnerability from cvelistv5

Published

2021-06-02 15:16

Modified

2024-08-03 21:47

Severity ?

Summary

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos	x_refsource_MISC
	https://github.com/python-pillow/Pillow/pull/5377	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:47:33.136Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/python-pillow/Pillow/pull/5377",
               },
               {
                  name: "FEDORA-2021-77756994ba",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:06:54",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/python-pillow/Pillow/pull/5377",
            },
            {
               name: "FEDORA-2021-77756994ba",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-28678",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos",
                  },
                  {
                     name: "https://github.com/python-pillow/Pillow/pull/5377",
                     refsource: "MISC",
                     url: "https://github.com/python-pillow/Pillow/pull/5377",
                  },
                  {
                     name: "FEDORA-2021-77756994ba",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-28678",
      datePublished: "2021-06-02T15:16:23",
      dateReserved: "2021-03-18T00:00:00",
      dateUpdated: "2024-08-03T21:47:33.136Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-25288

Vulnerability from cvelistv5

Published

2021-06-02 15:13

Modified

2024-08-03 19:56

Severity ?

Summary

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode	x_refsource_MISC
	https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.084Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
               },
               {
                  name: "FEDORA-2021-77756994ba",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:06:47",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
            },
            {
               name: "FEDORA-2021-77756994ba",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-25288",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
                  },
                  {
                     name: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
                     refsource: "MISC",
                     url: "https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470",
                  },
                  {
                     name: "FEDORA-2021-77756994ba",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-25288",
      datePublished: "2021-06-02T15:13:28",
      dateReserved: "2021-01-17T00:00:00",
      dateUpdated: "2024-08-03T19:56:11.084Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-25293

Vulnerability from cvelistv5

Published

2021-03-19 03:30

Modified

2024-08-03 19:56

Severity ?

Summary

An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.

References

▼	URL	Tags
	https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html	x_refsource_MISC
	https://security.gentoo.org/glsa/202107-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.179Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
               },
               {
                  name: "GLSA-202107-33",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202107-33",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-15T06:07:12",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
            },
            {
               name: "GLSA-202107-33",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202107-33",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-25293",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                     refsource: "MISC",
                     url: "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
                  },
                  {
                     name: "GLSA-202107-33",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202107-33",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-25293",
      datePublished: "2021-03-19T03:30:46",
      dateReserved: "2021-01-17T00:00:00",
      dateUpdated: "2024-08-03T19:56:11.179Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature