Описание
Uncontrolled Resource Consumption in pillow
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2021-23437
- https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
- https://github.com/advisories/GHSA-98vv-pw6r-q6q4
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT
- https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
- https://security.gentoo.org/glsa/202211-10
- https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443
Пакеты
pillow
>= 5.2.0, < 8.3.2
8.3.2
Связанные уязвимости
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Ex ...
Уязвимость функции getrgb библиотеки для работы с растровой графикой Pillow, позволяющая нарушителю вызвать отказ в обслуживании