Red Hat Product Errata RHSA-2024:3005 - Security Advisory
Issued:
2024-05-22
Updated:
2024-05-22

RHSA-2024:3005 - Security Advisory

Synopsis

Moderate: python-pillow security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python-pillow is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

  • python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (CVE-2023-44271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 2247820 - CVE-2023-44271 python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument

Red Hat Enterprise Linux for x86_64 8

SRPM
python-pillow-5.1.1-20.el8.src.rpm SHA-256: ca618a8e01e6bc5301477157a9b242fbb2d75df47c04bd3aa32915b685e22bc5
x86_64
python-pillow-debuginfo-5.1.1-20.el8.x86_64.rpm SHA-256: dd204b84bbdc535f29004460f1f5a7e694538efad3166395b1aebbf4909f0e0d
python-pillow-debugsource-5.1.1-20.el8.x86_64.rpm SHA-256: c4f648848a4e6af871f183a9b7c7dd3c2b6d39a49f0e83869bc06c1df35cb9df
python3-pillow-5.1.1-20.el8.x86_64.rpm SHA-256: 077906c47a77502e2e80262069c8a9ca88c27b3e3f672e8bd70d1394ceccd1aa
python3-pillow-debuginfo-5.1.1-20.el8.x86_64.rpm SHA-256: 2c16e310b42df29596637528bf8f9e00ad3131bfb3fe2ffffbbf9f6d470bd6d1
python3-pillow-tk-debuginfo-5.1.1-20.el8.x86_64.rpm SHA-256: 11adc87c8ad07754e9c268bac2d4f3635111f093fda91f1be3f55ff69077ac1f

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
python-pillow-5.1.1-20.el8.src.rpm SHA-256: ca618a8e01e6bc5301477157a9b242fbb2d75df47c04bd3aa32915b685e22bc5
s390x
python-pillow-debuginfo-5.1.1-20.el8.s390x.rpm SHA-256: 371b2692f701a1ccc3907b282e00e18153c60d483ebf3e0ed660eeca5951b474
python-pillow-debugsource-5.1.1-20.el8.s390x.rpm SHA-256: 936ac1ab4c76ee0ee9e8dbf7fa592db6e89c4445945646302f09ce548f321e0b
python3-pillow-5.1.1-20.el8.s390x.rpm SHA-256: ab9ab99f30f99067a5f147f46c5b7361918e8677339a1afaa44d46e09fe5e2c4
python3-pillow-debuginfo-5.1.1-20.el8.s390x.rpm SHA-256: 6f9470a4c477b5a50fe434f10dab841d30e8c6bccbbb0503708988661de38bdc
python3-pillow-tk-debuginfo-5.1.1-20.el8.s390x.rpm SHA-256: ea7119b54a23427bbd5d1f0442377362c6ce61b66a71c9996ef5f3aa71e1eebf

Red Hat Enterprise Linux for Power, little endian 8

SRPM
python-pillow-5.1.1-20.el8.src.rpm SHA-256: ca618a8e01e6bc5301477157a9b242fbb2d75df47c04bd3aa32915b685e22bc5
ppc64le
python-pillow-debuginfo-5.1.1-20.el8.ppc64le.rpm SHA-256: 881ffe8bb3d2883446c0f6a658f89367e58a04e9f44f042c96cc690b6423be4f
python-pillow-debugsource-5.1.1-20.el8.ppc64le.rpm SHA-256: 19529d1b603e196da4123896fded531d520ef967e913b553a1c4f6ab62f18ba8
python3-pillow-5.1.1-20.el8.ppc64le.rpm SHA-256: af07b9aa74856115c2fa1313c7cb32827c513bd14de503172e82203dd9dd2399
python3-pillow-debuginfo-5.1.1-20.el8.ppc64le.rpm SHA-256: ff9bec575d531937ac18ae74154a2b14de60c6a23f1c7d6240c5dac38d54b0c9
python3-pillow-tk-debuginfo-5.1.1-20.el8.ppc64le.rpm SHA-256: 3f06bee16a4a006535e006a4da0dd8383d67f93febdc8b6cacdf62ac2ac412af

Red Hat Enterprise Linux for ARM 64 8

SRPM
python-pillow-5.1.1-20.el8.src.rpm SHA-256: ca618a8e01e6bc5301477157a9b242fbb2d75df47c04bd3aa32915b685e22bc5
aarch64
python-pillow-debuginfo-5.1.1-20.el8.aarch64.rpm SHA-256: f9e14e326c636ec7c76b2aed6d7b3378d05ff4ae0ab50b3115871e93fa356de6
python-pillow-debugsource-5.1.1-20.el8.aarch64.rpm SHA-256: dc76e1d3d15c8bb73a381a7c5c43f326e84179aa43807471704cb7fac4d7ca17
python3-pillow-5.1.1-20.el8.aarch64.rpm SHA-256: 2d3987cc716b3427d1cc478dd663336fcc8af04204ed834a033db1ee9f3ce7bd
python3-pillow-debuginfo-5.1.1-20.el8.aarch64.rpm SHA-256: 6b23c2c4ae2b02e68e98d3ff5d2138a6b7749e23b7cbfbe72e9dc864ee42a8a5
python3-pillow-tk-debuginfo-5.1.1-20.el8.aarch64.rpm SHA-256: 703da476b1cca0247d28f34e30e23d3ff0cd03ff0374d107c57aaf3a076e994e

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
python-pillow-debuginfo-5.1.1-20.el8.i686.rpm SHA-256: ac880db98f3ac7390d217371949c04e32c600fc4ea4a243230c14f842e3d00f8
python-pillow-debuginfo-5.1.1-20.el8.x86_64.rpm SHA-256: dd204b84bbdc535f29004460f1f5a7e694538efad3166395b1aebbf4909f0e0d
python-pillow-debugsource-5.1.1-20.el8.i686.rpm SHA-256: d0a1f0dd7eb7871a6c9f3fa66539a1615823ef66368ee7eed6212a3a2e03e23d
python-pillow-debugsource-5.1.1-20.el8.x86_64.rpm SHA-256: c4f648848a4e6af871f183a9b7c7dd3c2b6d39a49f0e83869bc06c1df35cb9df
python3-pillow-5.1.1-20.el8.i686.rpm SHA-256: 2cde6a88d659190ea86a274d29a03fa8e6b55e34a5b14ae2ee8dfc002313b84f
python3-pillow-debuginfo-5.1.1-20.el8.i686.rpm SHA-256: dd865d84d778d6e69a4d62abaf29d2bd591d734d6d3eb30045d5e336f822db4c
python3-pillow-debuginfo-5.1.1-20.el8.x86_64.rpm SHA-256: 2c16e310b42df29596637528bf8f9e00ad3131bfb3fe2ffffbbf9f6d470bd6d1
python3-pillow-devel-5.1.1-20.el8.i686.rpm SHA-256: 5bd5ea3d9abaab8d24cf8859597ce661a9b22d2b0fc2b3d32efa6f34ecce8844
python3-pillow-devel-5.1.1-20.el8.x86_64.rpm SHA-256: fc39f3f87656b32a451afb8429e0fc14952fb8680f1648b7cfc9bff672ce3f20
python3-pillow-doc-5.1.1-20.el8.noarch.rpm SHA-256: 4bb90432edf3effe1467d3bd0c0c8f010dd8f53190bd825d062e7c7eee595f6c
python3-pillow-tk-5.1.1-20.el8.x86_64.rpm SHA-256: 3d90c46e4f05fc0badaf6fb5429e46c492c4d246e8d46d5668a9f9e2289449db
python3-pillow-tk-debuginfo-5.1.1-20.el8.i686.rpm SHA-256: 8da60271b8397b45eee160576aab821b97d06792067d974f53b203ceeeba25cc
python3-pillow-tk-debuginfo-5.1.1-20.el8.x86_64.rpm SHA-256: 11adc87c8ad07754e9c268bac2d4f3635111f093fda91f1be3f55ff69077ac1f

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
python-pillow-debuginfo-5.1.1-20.el8.ppc64le.rpm SHA-256: 881ffe8bb3d2883446c0f6a658f89367e58a04e9f44f042c96cc690b6423be4f
python-pillow-debugsource-5.1.1-20.el8.ppc64le.rpm SHA-256: 19529d1b603e196da4123896fded531d520ef967e913b553a1c4f6ab62f18ba8
python3-pillow-debuginfo-5.1.1-20.el8.ppc64le.rpm SHA-256: ff9bec575d531937ac18ae74154a2b14de60c6a23f1c7d6240c5dac38d54b0c9
python3-pillow-devel-5.1.1-20.el8.ppc64le.rpm SHA-256: 49538b3d3cd8d599e10e68da44851255773eeb20c7f2f030fa862ab0217b8ac6
python3-pillow-doc-5.1.1-20.el8.noarch.rpm SHA-256: 4bb90432edf3effe1467d3bd0c0c8f010dd8f53190bd825d062e7c7eee595f6c
python3-pillow-tk-5.1.1-20.el8.ppc64le.rpm SHA-256: 4e4dcd108088488e4c3cc4f97ddc3178adbaf95ad63b512505e197425c00219f
python3-pillow-tk-debuginfo-5.1.1-20.el8.ppc64le.rpm SHA-256: 3f06bee16a4a006535e006a4da0dd8383d67f93febdc8b6cacdf62ac2ac412af

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
python-pillow-debuginfo-5.1.1-20.el8.aarch64.rpm SHA-256: f9e14e326c636ec7c76b2aed6d7b3378d05ff4ae0ab50b3115871e93fa356de6
python-pillow-debugsource-5.1.1-20.el8.aarch64.rpm SHA-256: dc76e1d3d15c8bb73a381a7c5c43f326e84179aa43807471704cb7fac4d7ca17
python3-pillow-debuginfo-5.1.1-20.el8.aarch64.rpm SHA-256: 6b23c2c4ae2b02e68e98d3ff5d2138a6b7749e23b7cbfbe72e9dc864ee42a8a5
python3-pillow-devel-5.1.1-20.el8.aarch64.rpm SHA-256: 7ba85f609b7255fa31da1f5e642ad124405220f1658a9619b96a1d2ff6a2c01b
python3-pillow-doc-5.1.1-20.el8.noarch.rpm SHA-256: 4bb90432edf3effe1467d3bd0c0c8f010dd8f53190bd825d062e7c7eee595f6c
python3-pillow-tk-5.1.1-20.el8.aarch64.rpm SHA-256: 52e5c0bdba4f9a1e98d7814d48c6550f0bd89ea3b2bb66e01434e91570539458
python3-pillow-tk-debuginfo-5.1.1-20.el8.aarch64.rpm SHA-256: 703da476b1cca0247d28f34e30e23d3ff0cd03ff0374d107c57aaf3a076e994e

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
python-pillow-debuginfo-5.1.1-20.el8.s390x.rpm SHA-256: 371b2692f701a1ccc3907b282e00e18153c60d483ebf3e0ed660eeca5951b474
python-pillow-debugsource-5.1.1-20.el8.s390x.rpm SHA-256: 936ac1ab4c76ee0ee9e8dbf7fa592db6e89c4445945646302f09ce548f321e0b
python3-pillow-debuginfo-5.1.1-20.el8.s390x.rpm SHA-256: 6f9470a4c477b5a50fe434f10dab841d30e8c6bccbbb0503708988661de38bdc
python3-pillow-devel-5.1.1-20.el8.s390x.rpm SHA-256: 3f31f261b1512ab47a882abf9476e0ece96c1f9fd939862f44b2a6b594a4355b
python3-pillow-doc-5.1.1-20.el8.noarch.rpm SHA-256: 4bb90432edf3effe1467d3bd0c0c8f010dd8f53190bd825d062e7c7eee595f6c
python3-pillow-tk-5.1.1-20.el8.s390x.rpm SHA-256: 46c28159c9dccb8bb0c963b29d1d09feea3bab44012aa083be1ddd6af99e14c2
python3-pillow-tk-debuginfo-5.1.1-20.el8.s390x.rpm SHA-256: ea7119b54a23427bbd5d1f0442377362c6ce61b66a71c9996ef5f3aa71e1eebf

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.