CVE-2020-35655: 
Python vulnerability analysis and mitigation

CVE-2020-35655 affects Pillow versions before 8.1.0, where a 4-byte buffer over-read vulnerability exists in the SGIRleDecode functionality when decoding crafted SGI RLE image files. This occurs due to mishandling of offsets and length tables (NVD, CVE).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) with a CVSS v3.1 Base Score of 5.4 (Medium). The attack vector is Network-based, requiring low attack complexity and no privileges, though user interaction is required. The vulnerability affects the confidentiality and availability of the system with low impact, while integrity remains unaffected (NVD).

When exploited, this vulnerability could lead to unauthorized information disclosure through buffer over-read and potential application crashes due to improper handling of SGI RLE image files. The impact is limited to low confidentiality and availability breaches, with no impact on system integrity (NVD).

The vulnerability requires network access and user interaction, typically through the processing of a specially crafted SGI RLE image file. The attack complexity is considered low, making it relatively straightforward to exploit if a user can be convinced to process a malicious image (NVD).

The vulnerability has been fixed in Pillow version 8.1.0. Users are advised to upgrade to this version or later to mitigate the risk. Multiple Linux distributions have also released security updates, including Fedora 32 and 33, which have patched their respective packages (Fedora Update).