CVE-2020-10177: Pillow Out-of-bounds Reads Vulnerability

Q: What is CVE-2020-10177?

CVE-2020-10177 is a security vulnerability in Pillow involving Out-of-bounds reads in Pillow under CWE-125: Out-of-bounds Read.

Q: Which Pillow versions are affected?

Affected versions include releases prior to 7.1.0 across affected packages: pillow.

Q: What version fixes CVE-2020-10177?

Upgrading to 7.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is pillow affected?

Yes, pillow is affected in releases prior to 7.1.0. Upgrade your dependency to 7.1.0 or later.

Q: What is the CVSS score of CVE-2020-10177?

CVE-2020-10177 has a CVSS v3.1 base score of 5.5 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Q: What CWE is associated with CVE-2020-10177?

CVE-2020-10177 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).

Q: How can I check PyPI dependencies for CVE-2020-10177?

Run the dependency tree command: 'pip show pillow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-cqhg-xjhh-p8hf

CVSS 5.5

CWE-125

Published 2020-07-27

Advisory Summary

CVE-2020-10177 is a HIGH (CVSS 5.5) out-of-bounds reads vulnerability (CWE-125: Out-of-bounds Read) affecting Pillow libraries in the PyPI ecosystem. The issue involves out-of-bounds reads in pillow. Remediation is available by upgrading affected packages to version 7.1.0.

CVE-2020-10177 at a Glance

CVE Identifier CVE-2020-10177

GHSA Identifier GHSA-cqhg-xjhh-p8hf

Severity HIGH

CVSS v3.1 Base Score 5.5

CWE Classification CWE-125: Out-of-bounds Read

Affected Product Pillow

Package Ecosystem PyPI

Published Date 2020-07-27

Last Updated 2024-10-09

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction Required (UI:R)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2020-10177

To remediate this vulnerability, upgrade all affected Pillow dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pillow fixed: 7.1.0

pip install pillow>=7.1.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show pillow

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2020-10177, inspect your installed packages using pip:

pip show pillow

Analyze the terminal output to locate any version of Pillow in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 7.1.0), your application is affected.

Note: The pip show pillow command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Pillow, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Pillow before 7.1.0 has multiple out-of-bounds reads in `libImaging/FliDecode.c`.

CVE-2020-10177 Affected Pillow Versions

1 component(s)

Fixed Versions:

7.1.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
pillow pypi/pillow	PyPI	< 7.1.0	7.1.0

References

NVD — CVE-2020-10177 NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-10177

Pillow Source Repository REPOSITORY

https://github.com/python-pillow/Pillow/issues/4750

Pillow Source Repository REPOSITORY

https://github.com/python-pillow/Pillow/pull/4503

Pillow Source Repository REPOSITORY

https://github.com/python-pillow/Pillow/pull/4538

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/f6926a041b4b544fd2ced3752542afb6c8c19405

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/c88b0204d7c930e3bd72626ae6ea078571cc0ea7

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/c66d8aa75436f334f686fe32bca8e414bcdd18e6

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/c5edc361fd6450f805a6a444723b0f68190b1d0c

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/b4e439d6d7fd986cd6b4c7f9ca18830d79dacd44

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/8d4f3c0c5f2fecf175aeb895e9c2d6d06d85bdc9

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/5b490fc413dfab2d52de46a58905c25d9badb650

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/19ff42bd683486a8a308743c76972ef6a6482e9b

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/11ef7ca53a7d0af4bc52666c29199deffa5fc1bd

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/088ce4df981b70fbec140ee54417bcb49a7dffca

Security Fix Commit FIX COMMIT

https://github.com/python-pillow/Pillow/commit/00c6dd72d9ed0124cec81040b4bab0979a200fe2

Pillow Release RELEASE

https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427

Pillow Release RELEASE

https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html

snyk.io/vuln/snyk-python-pi... WEB

https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573

usn.ubuntu.com/4430-1 WEB

https://usn.ubuntu.com/4430-1

usn.ubuntu.com/4430-2 WEB

https://usn.ubuntu.com/4430-2

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html

Pillow Source Repository REPOSITORY

https://github.com/python-pillow/Pillow/commits/master/src/libImaging

Pillow Source Repository REPOSITORY

https://github.com/python-pillow/Pillow

Pillow Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-76.yaml

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-cqhg-xjhh-p8hf

Frequently Asked Questions

What is CVE-2020-10177?

CVE-2020-10177 is a security vulnerability in Pillow involving Out-of-bounds reads in Pillow under CWE-125: Out-of-bounds Read.

Which Pillow versions are affected?

Affected versions include releases prior to 7.1.0 across affected packages: pillow.

What version fixes CVE-2020-10177?

Upgrading to 7.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is pillow affected?

Yes, pillow is affected in releases prior to 7.1.0. Upgrade your dependency to 7.1.0 or later.

What is the CVSS score of CVE-2020-10177?

CVE-2020-10177 has a CVSS v3.1 base score of 5.5 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

What CWE is associated with CVE-2020-10177?

CVE-2020-10177 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).

How can I check PyPI dependencies for CVE-2020-10177?

Run the dependency tree command: 'pip show pillow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cqhg-xjhh-p8hf",
  "modified" : "2024-10-09T20:50:08Z",
  "published" : "2020-07-27T21:52:43Z",
  "aliases" : [ "CVE-2020-10177" ],
  "summary" : "Out-of-bounds reads in Pillow",
  "details" : "Pillow before 7.1.0 has multiple out-of-bounds reads in `libImaging/FliDecode.c`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pillow"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-10177"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/issues/4750"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/pull/4503"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/pull/4538"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/f6926a041b4b544fd2ced3752542afb6c8c19405"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/c88b0204d7c930e3bd72626ae6ea078571cc0ea7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/c66d8aa75436f334f686fe32bca8e414bcdd18e6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/c5edc361fd6450f805a6a444723b0f68190b1d0c"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/b4e439d6d7fd986cd6b4c7f9ca18830d79dacd44"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/8d4f3c0c5f2fecf175aeb895e9c2d6d06d85bdc9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/5b490fc413dfab2d52de46a58905c25d9badb650"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/19ff42bd683486a8a308743c76972ef6a6482e9b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/11ef7ca53a7d0af4bc52666c29199deffa5fc1bd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/088ce4df981b70fbec140ee54417bcb49a7dffca"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/00c6dd72d9ed0124cec81040b4bab0979a200fe2"
  }, {
    "type" : "WEB",
    "url" : "https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"
  }, {
    "type" : "WEB",
    "url" : "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
  }, {
    "type" : "WEB",
    "url" : "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573"
  }, {
    "type" : "WEB",
    "url" : "https://usn.ubuntu.com/4430-1"
  }, {
    "type" : "WEB",
    "url" : "https://usn.ubuntu.com/4430-2"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commits/master/src/libImaging"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/python-pillow/Pillow"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-76.yaml"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-cqhg-xjhh-p8hf"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-07-27T21:52:00Z",
    "nvd_published_at" : "2020-06-25T19:15:00Z"
  }
}

CVSS V3

5.5 HIGH

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction Required (UI:R)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Advisory Metadata

Source ID: GHSA-cqhg-xjhh-p8hf
Schema Version: 1.4.0
Published: 2020-07-27 21:52
Last Modified: 2024-10-09 20:50
Database Record File: advisories/github-reviewed/2020/07/GHSA-cqhg-xjhh-p8hf/GHSA-cqhg-xjhh-p8hf.json