PublicDateAtUSN: 2021-03-03
Candidate: CVE-2021-25292
PublicDate: 2021-03-19 04:15:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25292
 https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
 https://ubuntu.com/security/notices/USN-4763-1
Description:
 An issue was discovered in Pillow before 8.1.1. The PDF parser allows a
 regular expression DoS (ReDoS) attack via a crafted PDF file because of a
 catastrophic backtracking regex.
Ubuntu-Description: 
Notes: 
Mitigation: 
Bugs: 
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [6.5 MEDIUM]

Patches_pillow:
 upstream: https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c
upstream_pillow: released (8.1.1)
precise/esm_pillow: DNE
trusty_pillow: ignored (out of standard support)
trusty/esm_pillow: not-affected (code not present)
xenial_pillow: not-affected (code not present)
esm-infra/xenial_pillow: not-affected (code not present)
bionic_pillow: released (5.1.0-1ubuntu0.5)
focal_pillow: released (7.0.0-4ubuntu0.3)
groovy_pillow: released (7.2.0-1ubuntu0.2)
hirsute_pillow: not-affected (8.1.2-1)
impish_pillow: not-affected (8.1.2-1)
jammy_pillow: not-affected (8.1.2-1)
devel_pillow: not-affected (8.1.2-1)

Patches_pillow-python2:
upstream_pillow-python2: needs-triage
precise/esm_pillow-python2: DNE
trusty_pillow-python2: DNE
trusty/esm_pillow-python2: DNE
xenial_pillow-python2: DNE
bionic_pillow-python2: DNE
focal_pillow-python2: needs-triage
groovy_pillow-python2: ignored (reached end-of-life)
hirsute_pillow-python2: DNE
impish_pillow-python2: DNE
jammy_pillow-python2: DNE
devel_pillow-python2: DNE

Patches_python-imaging:
upstream_python-imaging:  needs-triage
precise/esm_python-imaging: ignored (end of ESM support, was needs-triage)
trusty_python-imaging: DNE
trusty/esm_python-imaging: DNE
xenial_python-imaging: DNE
bionic_python-imaging: DNE
focal_python-imaging: DNE
groovy_python-imaging: DNE
hirsute_python-imaging: DNE
impish_python-imaging: DNE
jammy_python-imaging: DNE
devel_python-imaging: DNE