Red Hat Security Advisory

RHSA-2022:0643

python-pillow security update

Released 2022-02-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 8) python3-pillow-5.1.1-18.el8_5, python3-pillow-devel-5.1.1-18.el8_5, python3-pillow-doc-5.1.1-18.el8_5 +1
Red Hat Enterprise Linux AppStream (v. 8) python-pillow-5.1.1-18.el8_5, python3-pillow-5.1.1-18.el8_5

TI-2022-07061 CVE-2022-22817 · GHSA-8vj2-vxx3-667w

MEDIUM 55

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03584 Published 2022-01-07 Partial fix · 9.0.1 CWE-74

TI-2022-07059 CVE-2022-22815 · GHSA-pw3c-h7wp-cvhx

LOW 34

path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02771 Published 2022-01-07 Partial fix · 9.0.0 CWE-665

TI-2022-07060 CVE-2022-22816 · GHSA-xrcv-f9gm-v42c

LOW 33

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02064 Published 2022-01-07 Partial fix · 9.0.0 CWE-125