CVE-2021-25292: Input Validation
A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.
Other sources
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.
Reference: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID is CVE-2021-25292.
What is the severity level of CVE-2021-25292?
The severity level of CVE-2021-25292 is high (7).
Which software version is affected by this vulnerability?
The affected software versions are Python Pillow versions up to (but not including) 8.1.1.
How can I fix CVE-2021-25292?
You can fix CVE-2021-25292 by updating to Python Pillow version 8.1.1 or later.
What is a regular expression DoS (ReDoS) attack?
A regular expression denial of service (ReDoS) attack is a type of input validation vulnerability that can cause the application to become unresponsive or consume excessive resources when processing certain maliciously crafted input.