CVE-2023-44271 json
Pillow Denial of Service vulnerability
published 2023-11-03 3 y ago modified 2026-09-08 2 mo ago also BIT-pillow-2023-44271 , EUVD-2023-0199 , GHSA-8ghj-p4vj-mr35 , PYSEC-2023-227
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
Patch / fix
- pypi pillow 10.0.0
- bitnami pillow 10.0.0
- python pillow 10.0.0
- pillow Debian 12 9.4.0-1.1+deb12u1
- pillow Debian 14, Debian 13 10.0.0-1
debian advisories DEBIAN-CVE-2023-44271
- pillow Ubuntu 20.04 LTS 7.0.0-4ubuntu0.8
- pillow Ubuntu 22.04 LTS 9.0.1-1ubuntu0.2
- pillow Ubuntu Pro 14.04 LTS 2.3.0-1ubuntu3.4+esm5
- pillow Ubuntu Pro 16.04 LTS 3.1.2-0ubuntu1.6+esm3
- pillow Ubuntu Pro 18.04 LTS 5.1.0-1ubuntu0.8+esm2
ubuntu advisories UBUNTU-CVE-2023-44271
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-django ansible automation platform 2.4 4.2.10-1.el9ap
- python-jinja2 ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 3.1.3-1.el9ap
- python-pillow ansible automation platform 2.4 10.0.1-1.el9ap
- python-aiohttp ansible automation platform 2.4 3.9.1-1.el9ap
- python3-django ansible automation platform 2.4 4.2.10-1.el9ap
- python3-jinja2 ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 3.1.3-1.el9ap
- python3-pillow ansible automation platform 2.4 10.0.1-1.el9ap
- python-pygments ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 2.17.2-1.el9ap
red hat advisories RHSA-2024:1057RHSA-2024:3005RHSA-2024:0345
- python-Pillow OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.2.1-3.23.2
- python-Pillow OpenStack Cloud Crowbar 9, OpenStack Cloud 9 5.2.0-3.20.1
- python-Pillow SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 9.5.0-150400.5.6.1
- python-Pillow openSUSE Leap 15.5, openSUSE Leap 15.4 7.2.0-150300.3.3.1
suse advisories SUSE-SU-2023:4631-1SUSE-SU-2023:4630-1SUSE-SU-2023:4528-1SUSE-SU-2023:4465-1
- python-Pillow openSUSE Tumbleweed 12.3.0-1.1
- python-Pillow openSUSE Tumbleweed 10.0.1-2.1
opensuse advisories openSUSE-SU-2026:11261-1openSUSE-SU-2024:13439-1
- python3-pillow AlmaLinux 8 5.1.1-20.el8
- python3-pillow-tk AlmaLinux 8 5.1.1-20.el8
almalinux advisories ALSA-2024:3005
- python-pillow Rocky Linux 8 5.1.1-20.el8
rocky linux advisories RLSA-2024:3005
- github.com/python-pillow/Pillow@1fe1bb4 commit
- github.com/python-pillow/Pillow#7244 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-44271 updated cvss 7.5
python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-pillow 10.0.1-1.el8ap, python3x-pillow 10.0.1-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-pillow 10.0.1-1.el9ap, python3-pillow 10.0.1-1.el9apfixed: vendor fix RHSA-2024:1057
-
Red Hat Enterprise Linux AppStream (v. 8) python-pillow 5.1.1-20.el8, python3-pillow 5.1.1-20.el8, python3-pillow-tk 5.1.1-20.el8fixed: vendor fix RHSA-2024:3005
-
Red Hat Enterprise Linux Client (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9fixed: vendor fix RHSA-2024:0345
-
Red Hat Enterprise Linux CRB (v. 8) python-pillow 5.1.1-20.el8, python3-pillow 5.1.1-20.el8, python3-pillow-tk 5.1.1-20.el8fixed: vendor fix RHSA-2024:3005
-
Red Hat Enterprise Linux Server (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9 Red Hat Enterprise Linux Workstation (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) python-pillow 2.0.0-24.gitd1c6db8.el7_9, python-pillow-qt 2.0.0-24.gitd1c6db8.el7_9, python-pillow-tk 2.0.0-24.gitd1c6db8.el7_9, python-pillow-sane 2.0.0-24.gitd1c6db8.el7_9fixed: vendor fix RHSA-2024:0345
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-runner 2.3.5-1.el8ap, automation-hub 4.9.1-1.el8ap, ansible-builder 3.0.1-1.el8ap, ansible-dev-tools 2.4-1.el8ap, python39-jinja2 3.1.3-1.el8ap, python3x-jinja2 3.1.3-1.el8ap, +103 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-jinja2 3.1.3-1.el9ap, ansible-runner 2.3.5-1.el9ap, automation-hub 4.9.1-1.el9ap, python-aiohttp 3.9.1-1.el9ap, python-boto3 1.18.35-4.el9ap, python-django 4.2.10-1.el9ap, +103 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.36% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pillow | <10.0.0 |
10.0.0 |
| bitnami | pillow | <10.0.0 |
10.0.0 |
Classification
References
-
github.com
/python-pillow/Pillow/pull/7244
web, patch
-
github.com
/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
web, patch
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4/
vendor-advisory, mailing-list, third-party-advisory, advisory
-
devhub.checkmarx.com
/cve-details/CVE-2023-44271/
third-party-advisory, advisory, web
-
lists.debian.org
/debian-lts-announce/2024/03/msg00021.html
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2023-44271
advisory, web
-
devhub.checkmarx.com
/cve-details/CVE-2023-44271
web
-
github.com
/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml
web
-
github.com
/python-pillow/Pillow
package
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4
web
-
github.com
/advisories/GHSA-8ghj-p4vj-mr35
advisory
Sources
- CVE List CVE-2023-44271
- GitHub Advisory GHSA-8ghj-p4vj-mr35
- NVD CVE-2023-44271
- OSV BIT-pillow-2023-44271
- OSV PYSEC-2023-227
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.