Red Hat Security Advisory

RHSA-2022:0669

python-pillow security update

Released 2022-02-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v. 8.1) python-pillow-5.1.1-13.el8_1, python3-pillow-5.1.1-13.el8_1

TI-2022-07061 CVE-2022-22817 · GHSA-8vj2-vxx3-667w

MEDIUM 55

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03584 Published 2022-01-07 Partial fix · 9.0.1 CWE-74

TI-2022-07060 CVE-2022-22816 · GHSA-xrcv-f9gm-v42c

LOW 33

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02064 Published 2022-01-07 Partial fix · 9.0.0 CWE-125