What is GHSA-4fx9-vc88-q2xc?

GHSA-4fx9-vc88-q2xc is a security advisory published by GitHub Security Advisories with Low severity. Infinite loop in Pillow

Why does GHSA-4fx9-vc88-q2xc have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-4fx9-vc88-q2xc?

GHSA-4fx9-vc88-q2xc affects 1 product, including: pip/Pillow:\u003c 9.0.0.

GHSA-4fx9-vc88-q2xcLowDisclosed before NVD

Infinite loop in Pillow

Vendor

GitHub Security Advisories

Published

March 11, 2022

Last Modified

January 11, 2023

📋 Description

JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.

🎯 Affected products1

pip/Pillow:< 9.0.0

🔗 References (3)

https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file
https://github.com/advisories/GHSA-4fx9-vc88-q2xc