CVE-2021-28677: fedoraproject fedora
Vulnerability summary
CVE-2021-28677 is a high (CVSS 7.5) vulnerability in fedoraproject fedora. EPSS estimates a 2.34% chance of exploitation in the next 30 days, higher than 83.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 02-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.34%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.34% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu2 products
- pillow< 2.3.0-1ubuntu3.4+esm5 | < 3.1.2-0ubuntu1.6+esm3 | < 5.1.0-1ubuntu0.6 | < 7.0.0-4ubuntu0.4
- pillow-python2All versions (No fix recorded)
Alpine1 product
- py3-pillow< 8.2.0-r0
Debian1 product
- pillow< 8.1.2+dfsg-0.2
Fedoraproject1 product
- fedoraEOL33
PyPI1 product
- pillow< 8.2.0
Python1 product
- pillow< 8.2.0
6 vendors · 7 products
References
18 links- pillow.readthedocs.io/en/stable/releasenotes/8.2.0.htmlX Refsource MISCWEBREPORTThird Party Advisory
lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlMailing ListX Refsource MLISTWEBThird Party Advisory