Incorrect Regular Expression in Pillow - CVE-2021-23437

Vulnerability identifier: #VU68608

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23437

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Pillow
Gentoo Linux
Fedora
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Ubuntu
openEuler
python3-pil (Ubuntu package)
python-pil (Ubuntu package)
python-Pillow
python-Pillow-debuginfo
python-Pillow-debugsource
python3-pillow
python2-pillow
python-pillow
mingw-python-pillow
python3-pillow-devel
python-pillow-debuginfo
python-pillow-debugsource
python3-pillow-qt
python3-pillow-tk
python3-pillow-help
dev-python/pillow

Install update from vendor's website.

Pillow - update to 8.3.2
python3-pil (Ubuntu package) - addressed in versions 3.1.20ubuntu1.6+esm1, 5.1.0-1ubuntu0.7, 5.1.0-1ubuntu0.8, 7.0.0-4ubuntu0.5, 7.0.0-4ubuntu0.6, 8.1.2+dfsg-0.3ubuntu0.1, 8.1.2-1ubuntu0.2
python-pil (Ubuntu package) - addressed in versions 3.1.20ubuntu1.6+esm1, 5.1.0-1ubuntu0.7, 5.1.0-1ubuntu0.8
python-Pillow - addressed in versions 4.2.1-3.20.2, 5.2.0-3.14.1
python-Pillow-debuginfo - addressed in versions 4.2.1-3.20.2, 5.2.0-3.14.1
python-Pillow-debugsource - addressed in versions 4.2.1-3.20.2, 5.2.0-3.14.1
python3-pillow - update to 6.2.2-3.el7
python2-pillow - update to 6.2.2-7.fc33
python-pillow - addressed in versions 7.2.0-8.fc33, 8.1.2-5.fc34
mingw-python-pillow - addressed in versions 7.2.0-8.fc33, 8.1.2-4.fc34
python-pillow - update to 8.1.1-7
python3-pillow-devel - update to 8.1.1-7
python-pillow-debuginfo - update to 8.1.1-7
python-pillow-debugsource - update to 8.1.1-7
python3-pillow-qt - update to 8.1.1-7
python3-pillow - update to 8.1.1-7
python3-pillow-tk - update to 8.1.1-7
python3-pillow-help - update to 8.1.1-7
dev-python/pillow - update to 9.3.0

• https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
• https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/

• Denial of service in Pillow
• Ubuntu update for pillow
• Gentoo update for Pillow
• SUSE update for python-Pillow
• SUSE update for python-Pillow
• Ubuntu update for pillow
• Ubuntu update for pillow
• openEuler update for python-pillow
• Fedora 34 update for mingw-python-pillow, python-pillow
• Fedora 33 update for mingw-python-pillow, python-pillow, python2-pillow
• Fedora EPEL 7 update for python3-pillow