Vulnerabilities > CVE-2021-25292 - Unspecified vulnerability in Python Pillow

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

python

NVD

Published: 2021-03-19

Updated: 2023-08-08

Summary

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

Vulnerable Configurations

Part	Description	Count
Application	Python Python Pillow - Python Pillow 1.0 Python Pillow 1.1 Python Pillow 1.2 Python Pillow 1.3 Python Pillow 1.4 Python Pillow 1.5 Python Pillow 1.6 Python Pillow 1.7.0 Python Pillow 1.7.1 Python Pillow 1.7.2 Python Pillow 1.7.3 Python Pillow 1.7.4 Python Pillow 1.7.5 Python Pillow 1.7.6 Python Pillow 1.7.7 Python Pillow 1.7.8 Python Pillow 2.0.0 Python Pillow 2.1.0 Python Pillow 2.2.0 Python Pillow 2.2.1 Python Pillow 2.2.2 Python Pillow 2.3.0 Python Pillow 2.3.1 Python Pillow 2.4.0 Python Pillow 2.5.0 Python Pillow 2.5.1 Python Pillow 2.5.2 Python Pillow 2.5.3 Python Pillow 2.6.0 Python Pillow 2.6.1 Python Pillow 2.6.2 Python Pillow 2.7.0 Python Pillow 2.8.0 Python Pillow 2.8.1 Python Pillow 2.8.2 Python Pillow 2.9.0 Python Pillow 3.0.0 Python Pillow 3.1.0 Python Pillow 3.3.1 Python Pillow 3.3.2 Python Pillow 3.4.0 Python Pillow 4.0.0 Python Pillow 4.1.0 Python Pillow 4.1.1 Python Pillow 4.2.0 Python Pillow 4.2.1 Python Pillow 4.3.0 Python Pillow 5.0.0 Python Pillow 5.1.0 Python Pillow 5.2.0 Python Pillow 5.3.0 Python Pillow 5.4.0 Python Pillow 5.4.1 Python Pillow 6.0.0 Python Pillow 6.2.0 Python Pillow 6.2.2 Python Pillow 6.2.3 Python Pillow 7.0.0 Python Pillow 7.1.0 Python Pillow 7.1.1 Python Pillow 7.1.2 Python Pillow 7.2.0 Python Pillow 8.0.0 Python Pillow 8.0.1 Python Pillow 8.1.0	71

Summary

Vulnerable Configurations

References