Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.

[ Fixes ]Fixes and patches

• Pillow 13.0.0Fixed version · GitHub Advisories · pip package Pillow: upgrade to 13.0.0 or later (affected >= 5.1.0, < 13.0.0)

[ Packages ]Affected open-source packages

• Pillow pipAffected >= 5.1.0, < 13.0.0 · fixed in 13.0.0 · GHSA-jg86-v3jv-hrpm

[ References ]References

• github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb
• github.com/python-pillow/Pillow/releases/tag/13.0.0
• github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm