Python developers using Pillow should review version 13.0.0, released to address multiple security issues including an EPS handling flaw involving Ghostscript, a TIFF memory overflow present since 2013, and a JPEG thumbnail crash.
Note that version 13.0.0 also requires Python 3.11 or newer.
Administrators released an update on October 16 that fixes the problems, urging those using older versions to upgrade immediately.
How problems arise
The main issue concerns the way Pillow handles a certain type of image, sending the filenames to another program, Ghostscript, without prior checking. The issue is triggered by the filename itself, not by any content within the image. It affects Pillow versions 2.6.0 through 12.3.0, on computers and systems where Ghostscript is installed.
Additionally, another issue in a different file type could allow commands to be executed from a single call to the open image function if an optional add-on package is installed. Memory management failures were also identified that could cause systems to crash when generating thumbnails for special JPEG files, as well as when caching images.
READ ALSO
Security flaw in Node.js allowed execution of foreign code
Who is affected and what applies to attacks
Security analysts have not yet identified any real attacks exploiting the Ghostscript issue, but there is public proof of concept for the TIFF file issue. It is worth noting that some of the issues were discovered with the help of artificial intelligence.
The new version 13.0.0, which fixes the issues, now requires the use of Python 11 or later, discontinuing support for the older version 3.10.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)