Alpine/py3-pillow: high 7.5

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Action: Upgrade py3-pillow to 8.4.0-r0 or later.

Affected

Fixed versions

Sources

• osv: ALPINE-CVE-2021-23437#Alpine:v3.16/py3-pillow
• https://security.alpinelinux.org/vuln/CVE-2021-23437

published 2021-09-03T16:15:08.317Z · modified 2026-11-03T06:32:31.981876468Z · JSON