CVE-2021-28678

A flaw was found in python-pillow. BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data.

Mitigation

To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.