Regular Expression Denial of Service (ReDoS)

Vulnerability

The getrgb function in Pillow (Python Imaging Library) is vulnerable to Regular Expression Denial of Service (ReDoS) due to a poorly crafted regular expression that can cause catastrophic backtracking when processing certain color strings. Affected versions are Pillow 5.2.0 up to but not including 8.3.2 [1][2].

Exploitation

An attacker can trigger the ReDoS by providing a specially crafted input string to the getrgb function, such as a long string with specific patterns that cause the regular expression engine to exhibit exponential behavior. No special privileges or network position is required beyond the ability to supply input to the vulnerable function [3].

Impact

Successful exploitation leads to denial of service (DoS) by causing the application to become unresponsive or crash due to excessive CPU consumption. The confidentiality and integrity of data are not compromised [3].

Mitigation

Upgrade to Pillow version 8.3.2 or later, which includes a fix in commit 9e08eb8f78fdfd2f476e1b20b7cf38683754866b [1][4]. No workarounds are available for earlier versions.