CVE-2021-28677

Vulnerability

The vulnerability resides in Pillow's EPSImageFile readline implementation, which must handle any combination of \r and \n as line endings. The code accidentally used a quadratic method of accumulating lines while searching for a line ending, leading to excessive CPU consumption. This issue affects all Pillow versions before 8.2.0 and dates back to the PIL fork [1][4].

Exploitation

An attacker can exploit this by providing a specially crafted EPS file containing many lines that trigger the quadratic accumulation behavior. No authentication or special privileges are required; the file is processed during the open() phase of Pillow, before the image is accepted for opening. The denial of service occurs immediately upon opening the malicious file [1][2].

Impact

Successful exploitation results in a denial of service (DoS) condition. The open() call consumes an excessive amount of CPU time, potentially causing the application to hang or crash. There is no impact on confidentiality or integrity of data [1][2].

Mitigation

The vulnerability is fixed in Pillow version 8.2.0, released on 2021-04-01. Users should upgrade to 8.2.0 or later. No workaround is available for earlier versions [1][4].