An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3005 advisory.

    * python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a     long text argument (CVE-2023-44271)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5704 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5704-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 05, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : pillow     CVE ID         : CVE-2023-44271 CVE-2023-50447 CVE-2024-28219

    Multiple security issues were discovered in Pillow, a Python imaging     library, which could result in denial of service or the execution of     arbitrary code if malformed images are processed.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 8.1.2+dfsg-0.3+deb11u2.

    For the stable distribution (bookworm), these problems have been fixed in     version 9.4.0-1.1+deb12u1.

    We recommend that you upgrade your pillow packages.

    For the detailed security status of pillow please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pillow

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3005 advisory.

    - Security fix for CVE-2023-50447     Resolves: RHEL-22240

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3005 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a     long text argument (CVE-2023-44271)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3005 advisory.

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202405-12 (Pillow: Multiple Vulnerabilities)

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2508 advisory.

    An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

    Affected versions of this package are vulnerable to Denial of Service (DoS) when using arbitrary strings     as text input and the number of characters passed into PIL.ImageFont.ImageFont.getmask() is over a certain     limit. This can lead to a system crash.

    Affected versions of this package are vulnerable to Denial of Service (DoS) if the size of individual     glyphs extends beyond the bitmap image, when using PIL.ImageFont.ImageFont function. Exploiting this     vulnerability could lead to a system crash.

    Affected versions of this package are vulnerable to Command Injection in filenames that contain single     quotes via load_djpeg.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3768 advisory.

  - The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the getrgb function. (CVE-2021-23437)

  - PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that     use the Python exec method. A lambda expression could also be used. (CVE-2022-22817)

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1057 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-eda-controller / ansible-rulebook / ansible-automation-platform-installer: Insecure websocket     used when interacting with EDA server (CVE-2024-1657)

    * python3-django/python39-django: denial-of-service in 'intcomma' template filter (CVE-2024-24680)

    * python3-jinja2/python39-jinja2: HTML attribute injection when passing user input as keys to xmlattr     filter (CVE-2024-22195)

    * python3-aiohttp/python39-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client     (CVE-2023-49082)

    * python3-aiohttp/python39-aiohttp: HTTP request modification (CVE-2023-49081)

    * python3-aiohttp/python39-aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)

    * python3-pycryptodomex/python39-pycryptodomex: side-channel leakage for OAEP decryption in PyCryptodome     and pycryptodomex (CVE-2023-52323)

    * python3-pillow/python39-pillow: uncontrolled resource consumption when textlength in an ImageDraw     instance operates on a long text argument (CVE-2023-44271)

    * python3-pygments/python39-pygments: ReDoS in pygments (CVE-2022-40896)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * automation-controller has been updated to 4.5.2
    * Enabled HashiCorp Vault LDAP and Userpass authentication (AAP-19842)

    Updates and fixes for automation hub:
    * automation-hub and python3-galaxy-ng/python39-galaxy-ng have been updated to 4.9.1
    * various dependencies have been updated

    Updates and fixes for Event-Driven Ansible:
    * automation-eda-controller has been updated to 1.0.5
    * various dependencies have been updated
    * Fixed a vulnerability that allowed command line injections in user and url fields for projects     (AAP-17778)
    * The communication between the activations and eda-server is now authenticated. Once EDA Controller is     upgraded, all the existing running activations must be restarted with upgraded Decision Environment images     (AAP-17619)
    * Removed 409 conflict error when enabling an activation (AAP-16305)
    * An activation status did not change to failed when an internal error occurred (AAP-16014)
    * Restarting the EDA server can cause activation states to become stale (AAP-13064)
    * RHEL 9.2 activations can not connect to the host (AAP-12929)
    * Added podman_containers_conf_logs_max_size variable to control max log size for podman installations     with a default value of 10 MiB (AAP-12295)

    Note: The 2.4-6 installer/setup should be used to update Event-Driven Ansible to 1.0.5

    Updates and fixes for installer and setup:
    * Added podman_containers_conf_logs_max_size variable for containers.conf to control max log size for     podman installations with a default value of 10 MiB (AAP-19775)
    * EDA debug flag of false will now correctly disable django debug mode (AAP-19577)
    * installer and setup have been updated to 2.4-6

    Additional changes:
    * ansible-builder has been updated to 3.0.1
    * ansible-runner has been updated to 2.3.5
    * ansible-dev-tools has been added

    For more details about the updates and fixes included in this release, refer to the Release Notes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6618-1 advisory.

    It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly     use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only     affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)

    Duarte Santos discovered that Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval.
    An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-50447)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0345 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a     long text argument (CVE-2023-44271)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0345 advisory.

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0345 advisory.

    [2.0.0-24gitd1c6db8]
    - Security fix for CVE-2023-44271     Resolves: RHEL-15459

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-453 advisory.

    An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4528-1 advisory.

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:4465-1 advisory.

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1a120657f9 advisory.

    Update to 9.5.0, backport fix for CVE-2023-44271.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200615	Rocky Linux 8 : python-pillow (RLSA-2024:3005)	Nessus	Rocky Linux Local Security Checks	high
200124	Debian dsa-5704 : python-pil-doc - security update	Nessus	Debian Local Security Checks	high
198006	Oracle Linux 8 : python-pillow (ELSA-2024-3005)	Nessus	Oracle Linux Local Security Checks	high
197743	RHEL 8 : python-pillow (RHSA-2024:3005)	Nessus	Red Hat Local Security Checks	high
197673	CentOS 8 : python-pillow (CESA-2024:3005)	Nessus	CentOS Local Security Checks	high
194998	GLSA-202405-12 : Pillow: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
192747	Amazon Linux 2 : python-pillow (ALAS-2024-2508)	Nessus	Amazon Linux Local Security Checks	high
192475	Debian dla-3768 : python-pil - security update	Nessus	Debian Local Security Checks	critical
192360	EulerOS Virtualization 2.11.0 : python-pillow (EulerOS-SA-2024-1448)	Nessus	Huawei Local Security Checks	high
192344	EulerOS Virtualization 2.11.1 : python-pillow (EulerOS-SA-2024-1420)	Nessus	Huawei Local Security Checks	high
192068	EulerOS Virtualization 2.10.1 : python-pillow (EulerOS-SA-2024-1368)	Nessus	Huawei Local Security Checks	high
192058	EulerOS Virtualization 2.10.0 : python-pillow (EulerOS-SA-2024-1389)	Nessus	Huawei Local Security Checks	high
191748	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Important) (RHSA-2024:1057)	Nessus	Red Hat Local Security Checks	high
189830	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Pillow vulnerabilities (USN-6618-1)	Nessus	Ubuntu Local Security Checks	high
189703	EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2024-1112)	Nessus	Huawei Local Security Checks	high
189678	EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2024-1128)	Nessus	Huawei Local Security Checks	high
189522	RHEL 7 : python-pillow (RHSA-2024:0345)	Nessus	Red Hat Local Security Checks	high
189512	CentOS 7 : python-pillow (RHSA-2024:0345)	Nessus	CentOS Local Security Checks	high
189380	Oracle Linux 7 : python-pillow (ELSA-2024-0345)	Nessus	Oracle Linux Local Security Checks	high
188339	EulerOS 2.0 SP10 : python-pillow (EulerOS-SA-2024-1071)	Nessus	Huawei Local Security Checks	high
188104	EulerOS 2.0 SP10 : python-pillow (EulerOS-SA-2024-1095)	Nessus	Huawei Local Security Checks	high
186917	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-453)	Nessus	Amazon Linux Local Security Checks	high
186233	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Pillow (SUSE-SU-2023:4528-1)	Nessus	SuSE Local Security Checks	high
185947	openSUSE 15 Security Update : python-Pillow (SUSE-SU-2023:4465-1)	Nessus	SuSE Local Security Checks	high
185464	Fedora 38 : python-pillow (2023-1a120657f9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-44271

high

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high