Regular Expression Denial of Service (ReDoS) in Pillow

보통 6.5CVE-2021-25292 · BIT-pillow-2021-25292 · GHSA-9hx2-hgq2-2g4f · Published 19/03/2021 · updated 17/06/2026

요약

CVE-2021-25292은(는) pillow, pillow (python)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.7%, 전체 취약점의 77.6%보다 높음.
조치: 8.1.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pillow PyPI	`≥ 5.1.0, < 8.1.1< 8.1.1`	`8.1.1`
pillow python	`< 8.1.1`	`8.1.1`

Description

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

NVD description

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

References

nvd.nist.gov/vuln/detail/CVE-2021-25292 · ADVISORY
python-pillow/Pillow commit 3bce145 · WEB
python-pillow/Pillow commit 521dab9 · WEB
python-pillow/Pillow commit 6207b44 · WEB
GitHub Advisory GHSA-9hx2-hgq2-2g4f · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · WEB
pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html · WEB
security.gentoo.org/glsa/202107-33 · WEB

pillow의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pillow

PyPI

≥ 5.1.0, < 8.1.1< 8.1.1

8.1.1

pillow

python

< 8.1.1

8.1.1

Description

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

NVD description

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

pillow의 다른 취약점

모두 보기 →