Red Hat Security Advisory

RHSA-2022:0609

python-pillow security update

Released 2022-02-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9
Red Hat Enterprise Linux Client Optional (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9, python-pillow-devel-2.0.0-23.gitd1c6db8.el7_9, python-pillow-doc-2.0.0-23.gitd1c6db8.el7_9 +3
Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9, python-pillow-devel-2.0.0-23.gitd1c6db8.el7_9, python-pillow-doc-2.0.0-23.gitd1c6db8.el7_9 +3
Red Hat Enterprise Linux Server (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9
Red Hat Enterprise Linux Server Optional (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9, python-pillow-2.0.0-23.gitd1c6db8.el7_9.ppc, python-pillow-devel-2.0.0-23.gitd1c6db8.el7_9 +5
Red Hat Enterprise Linux Workstation (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9
Red Hat Enterprise Linux Workstation Optional (v. 7) python-pillow-2.0.0-23.gitd1c6db8.el7_9, python-pillow-devel-2.0.0-23.gitd1c6db8.el7_9, python-pillow-doc-2.0.0-23.gitd1c6db8.el7_9 +3

TI-2022-07061 CVE-2022-22817 · GHSA-8vj2-vxx3-667w

MEDIUM 55

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03584 Published 2022-01-07 Partial fix · 9.0.1 CWE-74

TI-2022-07060 CVE-2022-22816 · GHSA-xrcv-f9gm-v42c

LOW 33

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02064 Published 2022-01-07 Partial fix · 9.0.0 CWE-125