[gentoo-announce] [ GLSA 202107-33 ] Pillow: Multiple vulnerabilities - gentoo-announce

From:	John Helmert III <ajak@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202107-33 ] Pillow: Multiple vulnerabilities
Date:	Wed, 14 Jul 2021 03:21:37
Message-Id:	`YO5XU7xz3sv9cG2g@sol.nexus.lan`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202107-33

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: Pillow: Multiple vulnerabilities

9

     Date: July 14, 2021

10

     Bugs: #773559, #774387, #779760

11

       ID: 202107-33

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in Pillow, the worst of which

19

could result in a Denial of Service condition.

20

21

Background

22

==========

23

24

Python Imaging Library (fork)

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  dev-python/pillow            < 8.2.0                    >= 8.2.0 

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in Pillow. Please review

38

the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

Please review the referenced CVE identifiers for details.

44

45

Workaround

46

==========

47

48

There is no known workaround at this time.

49

50

Resolution

51

==========

52

53

All Pillow users should upgrade to the latest version:

54

55

  # emerge --sync

56

  # emerge --ask --oneshot --verbose ">=dev-python/pillow-8.2.0"

57

58

References

59

==========

60

61

[  1 ] CVE-2021-25287

62

       https://nvd.nist.gov/vuln/detail/CVE-2021-25287

63

[  2 ] CVE-2021-25288

64

       https://nvd.nist.gov/vuln/detail/CVE-2021-25288

65

[  3 ] CVE-2021-25289

66

       https://nvd.nist.gov/vuln/detail/CVE-2021-25289

67

[  4 ] CVE-2021-25290

68

       https://nvd.nist.gov/vuln/detail/CVE-2021-25290

69

[  5 ] CVE-2021-25291

70

       https://nvd.nist.gov/vuln/detail/CVE-2021-25291

71

[  6 ] CVE-2021-25292

72

       https://nvd.nist.gov/vuln/detail/CVE-2021-25292

73

[  7 ] CVE-2021-25293

74

       https://nvd.nist.gov/vuln/detail/CVE-2021-25293

75

[  8 ] CVE-2021-27921

76

       https://nvd.nist.gov/vuln/detail/CVE-2021-27921

77

[  9 ] CVE-2021-27922

78

       https://nvd.nist.gov/vuln/detail/CVE-2021-27922

79

[ 10 ] CVE-2021-27923

80

       https://nvd.nist.gov/vuln/detail/CVE-2021-27923

81

[ 11 ] CVE-2021-28675

82

       https://nvd.nist.gov/vuln/detail/CVE-2021-28675

83

[ 12 ] CVE-2021-28676

84

       https://nvd.nist.gov/vuln/detail/CVE-2021-28676

85

[ 13 ] CVE-2021-28677

86

       https://nvd.nist.gov/vuln/detail/CVE-2021-28677

87

[ 14 ] CVE-2021-28678

88

       https://nvd.nist.gov/vuln/detail/CVE-2021-28678

89

90

Availability

91

============

92

93

This GLSA and any updates to it are available for viewing at

94

the Gentoo Security Website:

95

96

 https://security.gentoo.org/glsa/202107-33

97

98

Concerns?

99

=========

100

101

Security is a primary focus of Gentoo Linux and ensuring the

102

confidentiality and security of our users' machines is of utmost

103

importance to us. Any security concerns should be addressed to

104

security@g.o or alternatively, you may file a bug at

105

https://bugs.gentoo.org.

106

107

License

108

=======

109

110

Copyright 2021 Gentoo Foundation, Inc; referenced text

111

belongs to its owner(s).

112

113

The contents of this document are licensed under the

114

Creative Commons - Attribution / Share Alike license.

115

116

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202107-33
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: Pillow: Multiple vulnerabilities
9	Date: July 14, 2021
10	Bugs: #773559, #774387, #779760
11	ID: 202107-33
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in Pillow, the worst of which
19	could result in a Denial of Service condition.
20
21	Background
22	==========
23
24	Python Imaging Library (fork)
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 dev-python/pillow < 8.2.0 >= 8.2.0
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in Pillow. Please review
38	the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	Please review the referenced CVE identifiers for details.
44
45	Workaround
46	==========
47
48	There is no known workaround at this time.
49
50	Resolution
51	==========
52
53	All Pillow users should upgrade to the latest version:
54
55	# emerge --sync
56	# emerge --ask --oneshot --verbose ">=dev-python/pillow-8.2.0"
57
58	References
59	==========
60
61	[ 1 ] CVE-2021-25287
62	https://nvd.nist.gov/vuln/detail/CVE-2021-25287
63	[ 2 ] CVE-2021-25288
64	https://nvd.nist.gov/vuln/detail/CVE-2021-25288
65	[ 3 ] CVE-2021-25289
66	https://nvd.nist.gov/vuln/detail/CVE-2021-25289
67	[ 4 ] CVE-2021-25290
68	https://nvd.nist.gov/vuln/detail/CVE-2021-25290
69	[ 5 ] CVE-2021-25291
70	https://nvd.nist.gov/vuln/detail/CVE-2021-25291
71	[ 6 ] CVE-2021-25292
72	https://nvd.nist.gov/vuln/detail/CVE-2021-25292
73	[ 7 ] CVE-2021-25293
74	https://nvd.nist.gov/vuln/detail/CVE-2021-25293
75	[ 8 ] CVE-2021-27921
76	https://nvd.nist.gov/vuln/detail/CVE-2021-27921
77	[ 9 ] CVE-2021-27922
78	https://nvd.nist.gov/vuln/detail/CVE-2021-27922
79	[ 10 ] CVE-2021-27923
80	https://nvd.nist.gov/vuln/detail/CVE-2021-27923
81	[ 11 ] CVE-2021-28675
82	https://nvd.nist.gov/vuln/detail/CVE-2021-28675
83	[ 12 ] CVE-2021-28676
84	https://nvd.nist.gov/vuln/detail/CVE-2021-28676
85	[ 13 ] CVE-2021-28677
86	https://nvd.nist.gov/vuln/detail/CVE-2021-28677
87	[ 14 ] CVE-2021-28678
88	https://nvd.nist.gov/vuln/detail/CVE-2021-28678
89
90	Availability
91	============
92
93	This GLSA and any updates to it are available for viewing at
94	the Gentoo Security Website:
95
96	https://security.gentoo.org/glsa/202107-33
97
98	Concerns?
99	=========
100
101	Security is a primary focus of Gentoo Linux and ensuring the
102	confidentiality and security of our users' machines is of utmost
103	importance to us. Any security concerns should be addressed to
104	security@g.o or alternatively, you may file a bug at
105	https://bugs.gentoo.org.
106
107	License
108	=======
109
110	Copyright 2021 Gentoo Foundation, Inc; referenced text
111	belongs to its owner(s).
112
113	The contents of this document are licensed under the
114	Creative Commons - Attribution / Share Alike license.
115
116	https://creativecommons.org/licenses/by-sa/2.5