High ALAS2-2023-2118 1 CVE

Important: python-pillow security update (Amazon Linux 2)

Published Jul 5, 2023 · Updated Jul 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23437: The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Fixed packages 6

Release	Package	Fixed in
Amazon Linux · 2	python-pillow	0:2.0.0-23.gitd1c6db8.amzn2.0.7
Amazon Linux · 2	python-pillow-debuginfo	0:2.0.0-23.gitd1c6db8.amzn2.0.7
Amazon Linux · 2	python-pillow-devel	0:2.0.0-23.gitd1c6db8.amzn2.0.7
Amazon Linux · 2	python-pillow-doc	0:2.0.0-23.gitd1c6db8.amzn2.0.7
Amazon Linux · 2	python-pillow-sane	0:2.0.0-23.gitd1c6db8.amzn2.0.7
Amazon Linux · 2	python-pillow-tk	0:2.0.0-23.gitd1c6db8.amzn2.0.7

Vulnerabilities 1

High 7.5

CVE-2021-23437

Regular Expression Denial of Service (ReDoS)

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

pillow pillow pillow pillow-python2 Debian Ubuntu Alpine PyPI

Sep 3, 2021

References

web
https://alas.aws.amazon.com/cve/html/CVE-2021-23437.html