Read the docs
TI-2020-09257 Aliases CVE-2020-11538GHSA-43fq-w8qq-v88h

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads…

Priority MEDIUM 40CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

Why it matters now

EPSS 0.02415 84th percentileScored 2026-11-08
Fix Fixed pillow (PyPI): 7.1.0Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pillow (PyPI)before 7.1.07.1.0Patch availableGHSA-43fq-w8qq-v88h
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pillow (PyPI) Vendor— Affected before 7.1.0 Fixed in 7.1.0 Patch available GHSA-43fq-w8qq-v88h

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*up to 7.0.0Vulnerablepython-pillow
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
  • cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* Versions up to 7.0.0 Vulnerable ·python-pillow
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-43fq-w8qq-v88h pillow (PyPI) Fixed in 7.1.0 Advisory →

Red Hat 4 advisories

  • RHSA-2021:0420 Released 2021-02-04 · Red Hat rating Moderate
    Red Hat Quay v3.4.0 security update
    • Quay v3 quay/clair-rhel8, quay/quay-bridge-operator-bundle, quay/quay-bridge-operator-rhel8 +8
  • RHSA-2020:3302 Released 2020-08-04 · Red Hat rating Important
    python-pillow security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) python-pillow-5.1.1-11.el8_0, python3-pillow-5.1.1-11.el8_0
  • RHSA-2020:3299 Released 2020-08-04 · Red Hat rating Important
    python-pillow security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) python-pillow-5.1.1-11.el8_1, python3-pillow-5.1.1-11.el8_1
Show 1 more Red Hat advisories
  • RHSA-2020:3185 Released 2020-07-28 · Red Hat rating Important
    python-pillow security update
    • Red Hat Enterprise Linux AppStream (v. 8) python-pillow-5.1.1-12.el8_2, python3-pillow-5.1.1-12.el8_2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Quay v3Fixed RHSA-2021:0420
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:3185
Red Hat Enterprise Linux AppStream E4S (v. 8.0)Fixed RHSA-2020:3302
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2020:3299
Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11538
  2. 2026-10-03 Alias added: GHSA-43fq-w8qq-v88h

References

Patch 2

Advisory 6

Other 10

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences