Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

[ Description ]Official description

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

[ Fixes ]Fixes and patches

• Pillow 13.0.0Fixed version · GitHub Advisories · pip package Pillow: upgrade to 13.0.0 or later (affected >= 11.0.0, < 13.0.0)

[ Packages ]Affected open-source packages

• Pillow pipAffected >= 11.0.0, < 13.0.0 · fixed in 13.0.0 · GHSA-g4qv-2jxx-769h

[ References ]References

• github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c
• github.com/python-pillow/Pillow/pull/10073
• github.com/python-pillow/Pillow/releases/tag/13.0.0
• github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h