Find, fix and prevent vulnerabilities in your code.

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the decompression of compressed response data. An attacker can cause excessive CPU and memory consumption by sending responses with a large number of chained compression steps.

Workaround

This vulnerability can be avoided by setting preload_content=False and ensuring that resp.headers["content-encoding"] are limited to a safe quantity before reading.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade urllib3 to version 2.6.0 or higher.

References

• GitHub Commit

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTPResponse._update_chunk_length() in response.py, where the chunk-size line in a chunked transfer-encoded response is read with an unbounded readline() call. A malicious server can send a Transfer-Encoding: chunked response followed by an unterminated chunk-size line of arbitrary length, forcing the client to buffer the entire run in memory before the read can be rejected, causing memory exhaustion.

Note: This is only exploitable when the client connects to a malicious or compromised server, and applies only to the chunk-size line read, not to chunk body data.

Remediation

Upgrade urllib3 to version 2.8.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the Streaming API. The ContentDecoder class can be forced to allocate disproportionate resources when processing a single chunk with very high compression, such as via the stream(), read(amt=256), read1(amt=256), read_chunked(amt=256), and readinto(b) functions.

Note: It is recommended to patch Brotli dependencies (upgrade to at least 1.2.0) if they are installed outside of urllib3 as well, to avoid other instances of the same vulnerability.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade urllib3 to version 2.6.0 or higher.

References

• GitHub Commit

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the streaming API when handling HTTP redirects. An attacker can cause excessive resource consumption by serving a specially crafted compressed response that triggers decompression of large amounts of data before any read limits are enforced.

Note: This is only exploitable if content is streamed from untrusted sources with redirects enabled.

Workaround

This vulnerability can be mitigated by disabling redirects by setting redirect=False for requests to untrusted sources.

Remediation

Upgrade urllib3 to version 2.6.3 or higher.

References

• GitHub Commit

Overview

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type via insufficient validation of TIFF tag values before passing them to TIFFSetField in the libtiff encoder. When saving a TIFF image, tag values supplied by the caller are forwarded to TIFFSetField without verifying that their type, count, or array length matches libtiff's own field definition for that tag. An attacker who can influence the TIFF tags written during a save operation can trigger an out-of-bounds read or a crash, leading to information disclosure or denial of service.

Remediation

Upgrade Pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read via the TIFF image encoder in TiffImagePlugin.py and src/encode.c, where the ColorMap length is not validated against the BitsPerSample tag value. Prior to the fix, the encoder hardcoded a requirement of 768 entries (suitable only for 8-bit images) and did not enforce the correct length of (1 << BitsPerSample) * 3 entries for other bit depths. An attacker can supply a TIFF image with a mismatched ColorMap length relative to BitsPerSample, triggering a crash in the encoder and causing a denial of service. Additionally, the low-confidentiality impact reflects potential out-of-bounds read exposure from the incorrectly sized colormap buffer.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write in the ImageFilter.RankFilter process when a very large odd filter size is provided, leading to unchecked signed integer arithmetic in ImagingExpand. An attacker can cause a heap out-of-bounds write by supplying crafted input to the filter size parameter.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the StaticFiles file on Windows systems when handling UNC paths. An attacker can obtain NTLMv2 credentials of the service account by sending a specially crafted request that causes the server to initiate an outbound SMB connection to an attacker-controlled host, resulting in credential disclosure.

Note: This is only exploitable if the application is running on Windows and serving static files using the default configuration (follow_symlink=False).

Workaround

This vulnerability can be mitigated by serving static files through a dedicated web server (such as nginx or IIS) or by blocking outbound SMB (port 445) from the application host.

Remediation

Upgrade starlette to version 1.1.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

onnxruntime is a performance-focused scoring engine for Open Neural Network Exchange (ONNX) models.

Affected versions of this package are vulnerable to Directory Traversal due to insufficient validation of external TensorProto data paths. The external data loading path validation did not ensure referenced files stayed under the model directory, so a crafted model could point external_data.location at absolute paths or .. escapes.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade onnxruntime to version 1.24.1 or higher.

References

• GitHub Commit
• Safety CLI Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decode function of PdfStream in PdfParser, where zlib decompression is performed without limiting the output size. An attacker can cause excessive memory consumption by submitting a specially crafted PDF file with a maliciously large Length field.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in GifImagePlugin._seek when processing a multi-frame GIF image. The decompression bomb check calls Image._decompression_bomb_check but, prior to the fix, assigns the oversized dimensions to self._size before the check raises an exception. This means a failed decompression bomb check still permanently updates the image size, allowing an attacker to bypass the decompression bomb protection and cause a crash via a GIF image whose frame dimensions exceed the configured pixel limit.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the MSP image decoder in src/PIL/MspImagePlugin.py, where a malicious MSP file with run-length encoded rows can cause the decoder to expand more data than the image width requires. An attacker who supplies a crafted MSP image can trigger excessive memory allocation, crashing the process.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the next_object_id function in src/PIL/PdfParser.py when saving a multi-frame image as a multi-page PDF using im.save(fp, "PDF", save_all=True). The function computes the next PDF object ID by calling max() over the full set of all previously reserved object IDs on every reservation, causing CPU time to grow proportional to the square of the frame count. An attacker can trigger this quadratic behavior by supplying an image with a large declared frame count, such as an APNG whose acTL chunk declares a high num_frames value, without requiring any actual frame pixel data to be present.

Note: This is only exploitable when the caller saves with save_all=True targeting PDF output; for APNG inputs, the num_frames value from the acTL chunk is used directly and frames need not exist, subject only to the constraint that num_frames is non-zero and below 0x80000000.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Infinite loop via PdfParser.rewrite_pages() in src/PIL/PdfParser.py when processing a PDF file whose /Parent chain contains a cycle. The function walks the /Parent chain of every pre-existing page upward, stopping only when it reaches a node with no /Parent entry, so a cyclic reference causes the loop to run indefinitely. An attacker who controls the bytes of a PDF passed to the append path can trigger this condition, crashing the process.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the PcfFontFile._load_bitmaps process. An attacker can cause excessive memory allocation by supplying crafted PCF font data that bypasses decompression bomb checks.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• Release Notes

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the FontFile.compile process. An attacker can cause excessive memory allocation by providing a specially crafted font file that triggers uncontrolled resource consumption during image conversion or saving.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• Release Notes

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the bdf_char process when attacker-controlled dimensions from a BDF font file are passed to Image.new() without invoking the _decompression_bomb_check function. An attacker can cause excessive memory allocation by supplying specially crafted font files.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• Release Notes

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the GdImageFile._open process. An attacker can cause excessive memory allocation by supplying a crafted .gd file that bypasses decompression bomb checks.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• Release Notes

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via missing decompression bomb checks in the seek() methods of DcxImagePlugin, MicImagePlugin, and MpoImagePlugin. When a multi-frame image file (DCX, MIC, or MPO format) is opened and seeked to a subsequent frame, the image dimensions are not validated against the decompression bomb threshold, allowing an attacker to trigger excessive memory allocation by supplying an image with an oversized frame. This can crash the process handling the image.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write via the apply function. An attacker can cause memory corruption and potentially crash the application by providing an output image with a mode that does not match the transform's declared output mode.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write via the apply function in src/_imagingmorph.c when a MorphOp operation is applied to an image with zero width or zero height. The missing bounds check allows an attacker to trigger a crash by supplying an empty image to the ImageMorph morphological operation.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via linearize_page_tree in src/PIL/PdfParser.py, where a PDF file containing a deeply nested page tree causes unbounded recursion that exhausts the call stack. An attacker can supply a malicious PDF with an arbitrarily deep /Pages tree hierarchy to crash the process.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Use After Free via ImagingScaleAffine() in src/libImaging/Geometry.c, which deletes a caller-owned output image when its lookup-table allocation fails. When _resize() calls ImagingTransform() and the internal affine transform encounters a memory allocation failure, the output image is freed both inside ImagingScaleAffine() and again by the caller, resulting in a double free that crashes the process. A remote attacker can trigger this condition by supplying an image that causes a memory allocation failure during resize operations, crashing the application.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Use of Uninitialized Resource via the TIFF strip and tile decoder in src/libImaging/TiffDecode.c, when decoding TIFF images using codecs (such as JPEG or Group 4) that successfully decode fewer rows than the declared strip or tile length. The buffer allocated for the strip or tile is not zeroed beyond the actually decoded data, so the remaining portion retains uninitialized heap memory. When Pillow copies this buffer into the output image, the uninitialized memory is exposed as pixel data in the resulting image object, potentially leaking process memory contents to an attacker who can read the decoded image.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

protobuf is a Google’s data interchange format

Affected versions of this package are vulnerable to Uncontrolled Recursion when parsing untrusted Protocol Buffers data containing an excessive number of recursive groups, recursive messages, or a series of SGROUP tags. An attacker can provide crafted input that will corrupt the backend by exceeding the Python recursion limit and result in denial of service by crashing the application with a RecursionError.

Note: This problem impacts only the pure-Python implementation of the protobuf-python backend and does not influence the CPython PyPi wheels, which, by default, do not utilize pure Python.

Remediation

Upgrade protobuf to version 4.25.8, 5.29.5, 6.31.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• PoC Code

Overview

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the request.form. An attacker can exhaust system resources and disrupt service availability by submitting a specially crafted application/x-www-form-urlencoded request containing either an excessive number of fields or a very large field value, leading to event loop blocking or unbounded memory allocation.

Remediation

Upgrade starlette to version 1.3.1 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart/form-data requests, due to treating parts without a filename as text form fields and buffering those in byte strings with no size limit.

An attacker could cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields.

Note:

This vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.

PoC

from starlette.applications import Starlette
from starlette.routing import Route

async def poc(request):
    async with request.form():
        pass

app = Starlette(routes=[
    Route('/', poc, methods=["POST"]),
])

curl http://localhost:8000 -F 'big=</dev/urandom'

Remediation

Upgrade starlette to version 0.40.0 or higher.

References

• GitHub Commit
• GitHub Release

Overview

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the FileResponse._parse_range_header method. An attacker can exhaust server CPU resources by sending a specially crafted HTTP Range header containing numerous small, non-overlapping ranges, which triggers quadratic-time processing during range parsing and merging.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

• A The string must start with the letter 'A'
• (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
• D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

1. CCC
2. CC+C
3. C+CC
4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade starlette to version 0.49.1 or higher.

References

• GitHub Commit
• GitHub Release
• Red Hat Bugzilla Bug

Overview

chromadb is a Chroma.

Affected versions of this package are vulnerable to Incorrect Authorization due to improper evaluation of permissions in the SimpleRBACAuthorizationProvider function. An attacker can gain unauthorized access to resources across different tenants by exploiting the lack of tenant, database, or collection checks when permissions are validated.

Remediation

There is no fixed version for chromadb.

References

• HiddenLayer Report
• Vulnerable Code
• Vulnerable Code
• Vulnerable Code

Overview

anyio is a High level compatibility layer for multiple asynchronous event loop implementations

Affected versions of this package are vulnerable to Race Condition in _eventloop.get_asynclib() that cause crashes when multiple event loops of the same backend are running in separate threads and simultaneously attempting to use AnyIO for the first time.

Remediation

Upgrade anyio to version 4.4.0 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

fonttools is a Tools to manipulate font files

Affected versions of this package are vulnerable to Arbitrary Code Execution due to the parseBlendList() function's usage of built-in Python's eval() function when parsing TTX font data. An attacker can execute arbitrary scripts by supplying a specially crafted numeric value strings to TTX XML attributes.

Remediation

Upgrade fonttools to version 4.62.0 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read in the TGA RLE encoder process. An attacker can access sensitive heap data and potentially cause limited denial of service by crafting a specially designed image file.

Remediation

Upgrade pillow to version 12.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference in the reconstruction of request.url when the HTTP request path does not begin with /. An attacker can mislead the application into trusting an attacker-controlled hostname by sending a specially crafted request path that manipulates the authority component of the URL.

Note: This is only exploitable if the ASGI server forwards a request-target lacking a leading / into scope["path"], and the application uses request.url, request.url.netloc, or request.url.hostname for security-sensitive decisions before routing or in 404/exception handlers.

Remediation

Upgrade starlette to version 1.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via linearize_page_tree in src/PIL/PdfParser.py when parsing a PDF file containing a cyclic or duplicate page tree reference. An attacker can supply a PDF with a looping page node structure, causing the parser to recurse or iterate indefinitely and crash the process.

Remediation

Upgrade Pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Infinite loop via incorrect initialization of _n_frames and is_animated in TiffImagePlugin.TiffImageFile, where _n_frames was set inside _open() rather than __init__(), allowing it to be overwritten by a MicImageFile subclass. An attacker can supply a multi-frame TIFF (or MIC) image that causes _n_frames and is_animated to be set to incorrect values, leading to a crash when iterating frames.

Note: This is only exploitable if the optional olefile package is installed.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference via ImagingExpand in src/libImaging/Filter.c when processing a zero-dimension image through RankFilter or related filters. An attacker can supply an image with a width or height of zero, triggering undefined behavior or a crash in the C-level filter pipeline due to the absence of a zero-dimension guard before memory allocation and pixel processing.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

protobuf is a Google’s data interchange format

Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict() function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass max_recursion_depth to exhaust the recursion stack and trigger a RecursionError.

Remediation

Upgrade protobuf to version 5.29.6, 6.33.5 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in urlopen() when using ProxyManager.connection_from_url() with assert_same_host=False, directly rather than via the high-level APIs including urllib3.request(), PoolManager.request(), and ProxyManager.request(). An attacker can expose headers such as Authorization, Cookie, and Proxy-Authorization by triggering cross-origin redirects, which does not properly invoke remove_headers_on_redirect.

Remediation

Upgrade urllib3 to version 2.7.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Eval Injection via the PIL.ImageMath.eval function when an attacker has control over the keys passed to the environment argument.

PoC

from PIL import Image, ImageMath

image1 = Image.open('__class__')
image2 = Image.open('__bases__')
image3 = Image.open('__subclasses__')
image4 = Image.open('load_module')
image5 = Image.open('system')

expression = "().__class__.__bases__[0].__subclasses__()[104].load_module('os').system('whoami')"

environment = {
    image1.filename: image1,
    image2.filename: image2,
    image3.filename: image3,
    image4.filename: image4,
    image5.filename: image5
}

ImageMath.eval(expression, **environment)

Remediation

Upgrade pillow to version 10.2.0 or higher.

References

• GitHub Commit
• GitHub Release
• Security Advisory

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write via the JPEG COM marker encoding path in JpegEncode.c, when a JPEG image carrying an oversized comment in its im.info metadata is re-encoded. The comment length is not validated before being written as a COM marker, allowing a comment that exceeds the maximum marker size to overflow the output buffer. An attacker who can supply a JPEG file with an excessively long embedded comment can trigger this condition, leading to memory corruption with potential for arbitrary code execution.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Certificate Validation in the connect method of src/urllib3/connection.py when an HTTPS proxy is configured with proxy_ssl_context while the target server uses a different certificate-verification policy. Due to the proxy's TLS settings not being isolated from the target's TLS settings, the proxy's ssl_context is incorrectly applied to the target connection (or vice versa), allowing an attacker to bypass certificate validation for either the proxy or the target server and perform a MitM attack.

Note: This is only exploitable when an HTTPS proxy is configured with proxy_ssl_context and the target server uses a different certificate-verification policy.

Remediation

Upgrade urllib3 to version 2.8.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

fastapi is a web framework for building APIs with Python 3.6+ based on standard Python type hints.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parsing of the HTTP Content-Type header when reading form data with python-multipart. An attacker can cause a denial of service by sending a specially crafted Content-Type header that leads to excessive CPU consumption and indefinite stalling of the main event loop, preventing the processing of further requests.

PoC

Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

• A The string must start with the letter 'A'
• (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
• D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

1. CCC
2. CC+C
3. C+CC
4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade fastapi to version 0.109.1 or higher.

References

• GitHub Commit
• GitHub Release

Overview

fonttools is a Tools to manipulate font files

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the OT-SVG parser in the svg.py file.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade fonttools to version 4.43.0 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Argument Injection in the Ghostscript function in src/PIL/EpsImagePlugin.py, which assigns infile = fp.name and places it after -f in the argument list without normalizing the path or rejecting the prefixes Ghostscript parses specially, namely -, --, and the @ argument-file token. An attacker can pass arbitrary options to the spawned Ghostscript process, and reach command execution by combining the @ token with a text file whose contents they also control, by arranging for a file whose name begins with one of those characters to be opened as an EPS image. This requires control of the file name reached by Image.open rather than only the file contents, along with an EPS load path that invokes Ghostscript, and the default -dSAFER sandbox does not constrain it, since the injection happens in Ghostscript's own command line parsing.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) when using arbitrary strings as text input and the number of characters passed into PIL.ImageFont.ImageFont.getmask() is over a certain limit. This can lead to a system crash.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade pillow to version 10.2.0 or higher.

References

• GitHub Commit
• Pillow Release Notes

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) if the size of individual glyphs extends beyond the bitmap image, when using PIL.ImageFont.ImageFont function. Exploiting this vulnerability could lead to a system crash.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade pillow to version 10.2.0 or higher.

References

• GitHub Commit
• Pillow Release Notes

Overview

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') when the ImageFont truetype in an ImageDraw instance operates on a long text argument. An attacker can cause the service to crash by processing a task that uncontrollably allocates memory.

Remediation

Upgrade pillow to version 10.0.0 or higher.

References

• GitHub Commit
• GitHub PR

Overview

sympy is a Computer algebra system (CAS) in Python

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the sympy/utilities/mathml/__init__.py file. An attacker could gain unauthorized access to sensitive information by exploiting entities within XML documents.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade sympy to version 1.12 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Buffer Over-read via the _decodeStrip and _decodeTile functions in src/libImaging/TiffDecode.c, where the TIFF strip and tile decode buffers are reallocated without zeroing the region beyond previously decoded data. When a codec such as JPEG or Group 4 successfully decodes fewer rows than the declared strip height or tile length, the remainder of the reallocated buffer retains uninitialized heap memory, which is then copied directly into the output image. An attacker who can supply a malformed TIFF file can thereby cause uninitialized memory contents to appear in the decoded image data.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the seek method in src/PIL/SpiderImagePlugin.py, which lacks a decompression bomb check after seeking to a new frame in a SPIDER format image. An attacker can supply a SPIDER image with an excessively large frame size, causing unbounded memory allocation when a user opens and seeks through the file.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in BmpImagePlugin.py via the RLE-compressed BMP decoder, where the decode method appends null bytes to an output buffer without bounding the amount against the expected destination length. An attacker can supply a BMP image with malformed RLE delta escape codes that cause unbounded memory allocation, crashing the process.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via missing decompression bomb checks in the seek methods of DcxImagePlugin, MicImagePlugin, and MpoImagePlugin. When a multi-frame image file (DCX, MIC, or MPO format) is opened and frames are seeked, the per-frame image dimensions are never validated against the decompression bomb threshold, allowing an attacker to supply an image whose frames expand to an enormous size in memory and crash the process.

Remediation

Upgrade Pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Infinite loop via TarIO.__init__ in src/PIL/TarIO.py, where a maliciously constructed TAR archive can supply a file entry with a size value that causes the computed block offset to be zero or negative. When iterating over TAR entries to locate a target file, the seek position does not advance, resulting in an infinite loop that crashes the process.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the textwidth function in src/_imaging.c, where accumulating negative glyph advance widths can cause the integer accumulator xsize to wrap below INT_MIN. An attacker can trigger this by supplying text whose cumulative rendered width underflows a signed 32-bit integer, causing an OverflowError that crashes the calling process.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Out-of-bounds Read via the PyImaging_DrawWmf function in src/display.c when processing a WMF image with dimensions exceeding 65535. The bcWidth and bcHeight fields in BITMAPCOREHEADER are 16-bit unsigned integers, so values larger than 65535 silently truncate on assignment while the subsequent PyBytes_FromStringAndSize call still uses the untruncated values, causing a heap buffer over-read that crashes the process. An attacker can trigger this by supplying a WMF file with oversized width or height values.

Remediation

Upgrade Pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the load method in src/PIL/Image.py, where a loop consuming repeated Exif\x00\x00 headers in Exif data has no upper bound on iterations. An attacker can supply image data with an arbitrarily long sequence of repeated Exif headers, causing the process to spin indefinitely and crash the application.

Remediation

Upgrade pillow to version 13.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• Red Hat Bugzilla Bug