{"action":"Upgrade pillow to 8.3.2 or later.","affected":[{"fixed":"8.3.2","introduced":"0"}],"component":"pillow","cve_ids":["CVE-2021-23437"],"ecosystem":"PyPI","epss":0.0324,"exploited":false,"fixed_versions":["8.3.2"],"ghsa_id":"GHSA-98vv-pw6r-q6q4","id":"tcs_01M5KGCAR9E4NP0VMZ3G8F5123","modified_at":"2023-12-06T01:00:56.992827Z","published_at":"2021-09-03T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-317","https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html","https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b","https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443","https://github.com/advisories/GHSA-98vv-pw6r-q6q4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-317","url":"https://osv.dev/vulnerability/PYSEC-2021-317"}],"summary":"The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function."}