HIGH 7.5

PYSEC-2026-3452

빠른 조치

PYSEC-2026-3452 — pillow: 아래 명령으로 수정 버전으로 올리세요.

pip install --upgrade 'pillow>=12.3.0'

상세

Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / pillow

최초 영향 버전: 12.0.0 수정 버전: 12.3.0

수정 pip install --upgrade 'pillow>=12.3.0'

참고

https://github.com/python-pillow/Pillow/releases/tag/12.3.0 [ADVISORY]
https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83 [FIX]
https://github.com/python-pillow/Pillow/pull/9708 [FIX]
https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798 [EVIDENCE]