CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28667
https://notcve.org/view.php?id=CVE-2021-28667
StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data (from an action or rule name). StackStorm versiones anteriores a 3.4.1, en algunas situaciones, presenta un bucle infinito que consume toda la memoria disponible y el espacio en disco. Esto puede ocurrir si se usa Python versión 3.x, la configuración regional no es utf-8 y se intenta registrar datos Unicode (a partir de un nombre de acción o regla) • https://stackstorm.com/2021/03/10/stackstorm-v3-4-1-security-fix • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-28363
https://notcve.org/view.php?id=CVE-2021-28363
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted. La biblioteca urllib3 versiones 1.26.x anteriores a 1.26.4 para Python, omite una comprobación del certificado SSL en algunos casos que involucran HTTPS a proxies HTTPS. La conexión inicial al proxy HTTPS (si no se proporciona un SSLContext por medio de proxy_config) no verifica el nombre de host del certificado. • https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 https://github.com/urllib3/urllib3/commits/main https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL https://pypi.org/project/urllib3/1.26.4 https://security.gentoo.org/glsa/202107-36 https://security.gentoo.org/glsa/202305-02 https://security.netapp.com/advisory/ntap-20240621-0007 htt • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25292 – python-pillow: Regular expression DoS in PDF format parser
https://notcve.org/view.php?id=CVE-2021-25292
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. Se detectó un problema en Pillow versiones anteriores a 8.1.1. El analizador de PDF permite un ataque DoS (ReDoS) de expresión regular por medio de un archivo PDF diseñado debido a una regex de retroceso catastrófica A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack. • https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html https://security.gentoo.org/glsa/202107-33 https://access.redhat.com/security/cve/CVE-2021-25292 https://bugzilla.redhat.com/show_bug.cgi?id=1934699 • CWE-20: Improper Input Validation CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25289 – python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c
https://notcve.org/view.php?id=CVE-2021-25289
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654. Se detectó un problema en Pillow versiones anteriores a 8.1.1. La función TiffDecode presenta un desbordamiento de búfer en la región heap de la memoria cuando se decodifican archivos YCbCr diseñados debido a determinados conflictos de interpretación con LibTIFF en el modo RGBA. • https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html https://security.gentoo.org/glsa/202107-33 https://access.redhat.com/security/cve/CVE-2021-25289 https://bugzilla.redhat.com/show_bug.cgi?id=1934680 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25291 – python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c
https://notcve.org/view.php?id=CVE-2021-25291
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. Se detectó un problema en Pillow versiones anteriores a 8.1.1. En el archivo TiffDecode.c, se presenta una lectura fuera de límites en la función TiffreadRGBATile por medio de límites de mosaico no válidos A flaw was found in python-pillow. Invalid tile boundaries could lead to an OOB Read in TiffReadRGBATile in TiffDecode.c. • https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html https://security.gentoo.org/glsa/202107-33 https://access.redhat.com/security/cve/CVE-2021-25291 https://bugzilla.redhat.com/show_bug.cgi?id=1934692 • CWE-125: Out-of-bounds Read •