[Snyk: Critical] pillow Heap-based Buffer Overflow (Due 10/27/2023)

[tmpayton]

1st Issue pillow Heap-based Buffer Overflow
VULNERABILITY
CWE-122
CVE-2023-4863
CVSS 7.3 HIGH
SNYK-PYTHON-PILLOW-5918878
SCORE
865
Introduced through
wagtail@4.2.3
Fixed in
pillow@10.0.1
Exploit maturity
MATURE

Detailed paths and remediation
Introduced through: project@0.0.0 › wagtail@4.2.3 › pillow@9.5.0
Fix: Pin pillow to version 10.0.1
Security information
Factors contributing to the scoring:
Snyk: CVSS 7.3 - High Severity

NVD: CVSS 8.8 - High Severity
Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview
Pillow is a PIL (Python Imaging Library) fork.

2nd Issue SNYK HIGH pillow Uncontrolled Resource Consumption ('Resource Exhaustion')
Introduced through
wagtail@4.2.3
Fixed in
pillow@10.0.0

Exploit maturity
No known exploit

Detailed paths and remediation

Introduced through: project@0.0.0 › wagtail@4.2.3 › pillow@9.5.0
Fix: Pin pillow to version 10.0.0

Security information
Factors contributing to the scoring:

Snyk: [CVSS 7.5](https://security.snyk.io/vuln/SNYK-PYTHON-PILLOW-6043904) - High Severity
NVD: Not available. NVD has not yet published its analysis.

Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') when the ImageFont truetype in an ImageDraw instance operates on a long text argument. An attacker can cause the service to crash by processing a task that uncontrollably allocates memory.

Completion Criteria

• Fix: Pin pillow to version 10.0.1

[pkfec]

ERROR: Cannot install pillow==10.0.1 and wagtail==4.2.3 because these package versions have conflicting dependencies.

[pkfec]

upgrading wagtail to v5.1.2 alone didn't fix the pillow snyk vulnerability:

✗ Heap-based Buffer Overflow (new) [Critical Severity][https://security.snyk.io/vuln/SNYK-PYTHON-PILLOW-5918878] in pillow@9.5.0
   introduced by wagtail@5.1.2 > pillow@9.5.0

[pkfec]

upgrading wagtail to v5.1.2 along pinning pillow to v10.0.1 seems to fix this snyk vulnerability

[pkfec]

Changes merged in pr #6020. Closing this issue