CVE-2023-44271

High

Description

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Python Pillow

PublishedNov 3, 2023

First seenNov 3, 2023

How to fix

Update

python pillow10.0.0 or later
pillow10.0.0 or later

Vendor advisories

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4/

Affected products

Product	Affected versions	Fixed in
python pillow	v < 10.0.0	10.0.0
fedoraproject fedora	38	—
pillowPyPI	v < 10.0.0	10.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.