Important: python-pillow security update
Summary
ALSA-2022:0643: Important: python-pillow security update. Affects python3-pillow versions < 5.1.1-18.el8_5. Fixed in 5.1.1-18.el8_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. It is widely used in various applications for image manipulation and processing.
Vulnerability Detail
The vulnerability (CVE-2022-22817) in python-pillow is related to the PIL.ImageMath.eval function, which allows the evaluation of arbitrary expressions. This can lead to potential code execution vulnerabilities if untrusted input is passed to the function. Another vulnerability (CVE-2022-22816) involves a buffer over-read during the initialization of ImagePath.Path in path_getbbox() in path.c. An attacker could exploit this to read uninitialized or out-of-bounds memory, potentially leading to information disclosure or crashes.
How To Fix
Minimum fixed version
5.1.1-18.el8_5
This is the first release that contains the fix.
sudo dnf update python3-pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the python-pillow package to the latest version (5.1.1-18.el8_5 or later) to address the identified security vulnerabilities. Failure to do so may expose your application to potential code execution or information disclosure risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python3-pillow →
FAQ
Python-pillow is a Python image processing library that provides extensive file format support and powerful image-processing capabilities.
The vulnerabilities can potentially allow attackers to execute arbitrary code or read uninitialized/out-of-bounds memory, leading to information disclosure or crashes.
No, only versions prior to 5.1.1-18.el8_5 are affected. It is recommended to update to the latest version to mitigate the vulnerabilities.
No specific workaround has been provided. It is recommended to update to the patched version of python-pillow.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
