CVE-2023-44271

Denial of Service in Pillow before 10.0.0 via ImageFont in ImageDraw with long text argument

• CVSS 7.5
• CWE-770
• Resource Management
• Remote

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

CVE

CVE-2023-44271

CWE

CWE-770

CVSS base score

7.5

Published

2023-11-03

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Extraneous Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Upgrade Pillow to version 10.0.0 or later

from PIL import Image, ImageDraw, ImageFont

def draw_text(image, text, position, font):
    draw = ImageDraw.Draw(image)
    draw.text(position, text, font=font)

image = Image.new('RGB', (200, 100), color='white')
font = ImageFont.load_default()

draw_text(image, "A" * 10000, (10, 10), font)

from PIL import Image, ImageDraw, ImageFont

def draw_text(image, text, position, font, max_length=100):
    if len(text) > max_length:
        raise ValueError("Text length exceeds maximum allowed length.")
    
    draw = ImageDraw.Draw(image)
    draw.text(position, text, font=font)

image = Image.new('RGB', (200, 100), color='white')
font = ImageFont.load_default()

try:
    draw_text(image, "A" * 10000, (10, 10), font)
except ValueError as e:
    print(e)

@misc{vaitp:cve202344271,
  title        = {{Denial of Service in Pillow before 10.0.0 via ImageFont in ImageDraw with long text argument}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-44271},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-44271/}}
}