CVE-2022-24303: Pillow - Mishandling of Spaces in Temporary Pathnames
Summary
CVE-2022-24303: Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. Affects pillow versions < 9.0.1. Fixed in 9.0.1. How to fix ↓
Also tracked for
- py3-pillow · Alpine:v3.15
- pillow · PyPI
- pillow · PyPI
The same CVE-2022-24303 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is an open-source Python library for image processing and manipulation. It provides a wide range of functionality for tasks such as image resizing, cropping, and filtering. The library is widely used in various applications and frameworks for image-related operations. However, a vulnerability has been discovered in Pillow versions prior to 9.0.1, which mishandles spaces in temporary pathnames.
Vulnerability Detail
The vulnerability in Pillow allows attackers to delete files due to the mishandling of spaces in temporary pathnames. When handling temporary files, Pillow does not properly handle spaces in the pathnames, which can be exploited by an attacker to delete arbitrary files on the system. This can lead to data loss, unauthorized access, and potential disruption of the affected application or system.
How To Fix
Minimum fixed version
9.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Pillow version 9.0.1 or later.
Conclusion
In conclusion, the vulnerability in Pillow versions prior to 9.0.1 allows attackers to delete files due to the mishandling of spaces in temporary pathnames. To mitigate this issue, it is crucial to upgrade to Pillow version 9.0.1 or later. Developers should promptly apply the fix to ensure the security and integrity of their applications and systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a popular Python library for image processing and manipulation.
The vulnerability allows attackers to delete files, potentially leading to data loss and unauthorized access.
Versions of Pillow prior to 9.0.1 are affected by this vulnerability.
No, there is no known workaround. It is necessary to upgrade to the fixed version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
