CVE-2021-23437

Katalog CVE

CVSS 7.5 · High EPSS 3,2%

Kerentanan Out-of-bounds Read pada python pillow, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Rincian

Terbit di NVD

3 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html release notes · advisory vendor
• https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443 exploit · patch · release notes · advisory pihak ketiga
• https://security.gentoo.org/glsa/202211-10 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROG...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXC...