The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.
python-pillow: Buffer overflow in image convert function (CVE-2021-34552)
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file. (CVE-2016-2533)
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the crafted image file approach, related to an Integer Overflow issue affecting the Image.core.map_buffer in map.c component. (CVE-2016-9189)
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the crafted image file approach, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c component. (CVE-2016-9190)
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. (CVE-2020-35653)
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled. (CVE-2020-35655)
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. (CVE-2021-25287)
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. (CVE-2021-25288)
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. (CVE-2021-25290)
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)
An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
(CVE-2021-25293)
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large. (CVE-2021-27921)
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large. (CVE-2021-27922)
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large. (CVE-2021-27923)
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load. (CVE-2021-28675)
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. (CVE-2021-28676)
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
(CVE-2021-28677)
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. (CVE-2021-28678)
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815)
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. (CVE-2024-28219)
Note that Nessus has not tested for these issues but has instead relied on the package manager’s report that the package is installed.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory python-pillow. The text
# itself is copyright (C) Red Hat, Inc.
##
include('compat.inc');
if (description)
{
script_id(195830);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");
script_cve_id(
"CVE-2016-2533",
"CVE-2016-9189",
"CVE-2016-9190",
"CVE-2020-35653",
"CVE-2020-35655",
"CVE-2021-25287",
"CVE-2021-25288",
"CVE-2021-25290",
"CVE-2021-25291",
"CVE-2021-25292",
"CVE-2021-25293",
"CVE-2021-27921",
"CVE-2021-27922",
"CVE-2021-27923",
"CVE-2021-28675",
"CVE-2021-28676",
"CVE-2021-28677",
"CVE-2021-28678",
"CVE-2021-34552",
"CVE-2022-22815",
"CVE-2024-28219"
);
script_name(english:"RHEL 7 : python-pillow (Unpatched Vulnerability)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 7 host is affected by multiple vulnerabilities that will not be patched.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.
- python-pillow: Buffer overflow in image convert function (CVE-2021-34552)
- Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging
Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted
PhotoCD file. (CVE-2016-2533)
- Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the
crafted image file approach, related to an Integer Overflow issue affecting the Image.core.map_buffer
in map.c component. (CVE-2016-9189)
- Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the crafted
image file approach, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c
component. (CVE-2016-9190)
- In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the
user-supplied stride value is trusted for buffer calculations. (CVE-2020-35653)
- In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image
files because offsets and length tables are mishandled. (CVE-2020-35655)
- An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in
j2ku_graya_la. (CVE-2021-25287)
- An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in
j2ku_gray_i. (CVE-2021-25288)
- An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an
invalid size. (CVE-2021-25290)
- An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in
TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)
- An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)
attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)
- An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
(CVE-2021-25293)
- Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the
reported size of a contained image is not properly checked for a BLP container, and thus an attempted
memory allocation can be very large. (CVE-2021-27921)
- Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the
reported size of a contained image is not properly checked for an ICNS container, and thus an attempted
memory allocation can be very large. (CVE-2021-27922)
- Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the
reported size of a contained image is not properly checked for an ICO container, and thus an attempted
memory allocation can be very large. (CVE-2021-27923)
- An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the
number of input layers relative to the size of the data block. This could lead to a DoS on Image.open
prior to Image.load. (CVE-2021-28675)
- An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the
block advance was non-zero, potentially leading to an infinite loop on load. (CVE-2021-28676)
- An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in
EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally
quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use
this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
(CVE-2021-28677)
- An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that
reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be
run a large number of times on empty data. (CVE-2021-28678)
- path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815)
- In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of
strncpy. (CVE-2024-28219)
Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-34552");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vendor_unpatched", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/02");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-imaging");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pillow");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var constraints = [
{
'pkgs': [
{'reference':'python-pillow', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'python-pillow'}
]
}
];
var flag = 0;
foreach var constraint_array ( constraints ) {
var repo_relative_urls = NULL;
var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
foreach var pkg ( constraint_array['pkgs'] ) {
var unpatched_pkg = NULL;
var _release = NULL;
var sp = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var exists_check = NULL;
var cves = NULL;
if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
if (unpatched_pkg &&
_release &&
(!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
}
}
if (flag)
{
var extra = NULL;
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : unpatched_packages_report()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-pillow');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9189
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9190
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35653
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35655
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25287
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25288
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25290
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25291
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25292
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25293
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27921
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27922
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27923
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28675
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28676
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28677
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28678
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34552
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219