Red Hat Security AdvisoryRHSA-2024:0754
python-pillow security update
Released 2024-02-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.8.8) python3-pillow-5.1.1-19.el8_8, python3-pillow-devel-5.1.1-19.el8_8, python3-pillow-doc-5.1.1-19.el8_8 +1
- Red Hat Enterprise Linux AppStream EUS (v.8.8) python-pillow-5.1.1-19.el8_8, python3-pillow-5.1.1-19.el8_8
Fixes 1 record
Priority MEDIUM 41
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01703 · Published 2024-01-19 · Fixed in 10.2.0 CWE-95
