Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-35654

CVE-2020-35654: Pillow Out-of-bounds Write

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-35654
GHSA ID
GHSA-vqcj-wrf2-7v73
EPSS Score
0.44239%
CWE
CWE-787
Published
3/18/2021
Updated
10/11/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Pillowpip< 8.1.08.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the original ReadStrip function's handling of PHOTOMETRIC_YCBCR images. The commit diff shows this function was replaced by _decodeStripYCbCr with added buffer validation (INT_MAX checks, proper row_byte_size calculation, and realloc safety). The NVD description specifically mentions conflicts in RGBA mode handling with LibTIFF, which matches the code changes targeting YCbCr decoding paths in ReadStrip. The added crash test file and modified test parameters further confirm this was the vulnerable code path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In Pillow ***or* *.*.*, Ti*****o** **s * ***p-**s** *u***r ov*r*low w**n ***o*in* *r**t** Y***r *il*s ****us* o* **rt*in int*rpr*t*tion *on*li*ts wit* Li*TI** in R*** mo**.

Reasoning

T** vuln*r**ility st*ms *rom t** ori*in*l R***Strip *un*tion's **n*lin* o* P*OTOM*TRI*_Y***R im***s. T** *ommit *i** s*ows t*is *un*tion w*s r*pl**** *y _***o**StripY***r wit* ***** *u***r v*li**tion (INT_M*X ****ks, prop*r row_*yt*_siz* **l*ul*tion,