CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-23437
High (7.5). EPSS 3.2% chance of exploitation in the next 30 days. Fixed in pillow 8.3.2.
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Severity
- EPSS
- 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- python:pillow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-98vv-pw6r-q6q4 | PyPI | pillow | >=5.2.0 <8.3.2 | 8.3.2 |
| PYSEC-2021-317 | PyPI | pillow | <8.3.2 | 8.3.2 |
References
- https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/
- https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html