Alpine/py3-pillow: high 7.5

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Action: Upgrade py3-pillow to 7.2.0-r2 or later.

Affected

Fixed versions

Sources

• osv: ALPINE-CVE-2021-23437#Alpine:v3.13/py3-pillow
• https://security.alpinelinux.org/vuln/CVE-2021-23437

published 2021-09-03T16:15:08.317Z · modified 2026-10-23T17:17:56.156993446Z · JSON