CVE-2021-28678: Insufficient Verification of Data Authenticity

June 2, 2021 (updated November 9, 2023)

An issue was discovered in Pillow For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

References

nvd.nist.gov/vuln/detail/CVE-2021-28678
pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html

Detect and mitigate CVE-2021-28678 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →