Red Hat Security AdvisoryRHSA-2024:1060
python-pillow security update
Released 2024-02-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) python-pillow-5.1.1-15.el8_4, python3-pillow-5.1.1-15.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) python-pillow-5.1.1-15.el8_4, python3-pillow-5.1.1-15.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) python-pillow-5.1.1-15.el8_4, python3-pillow-5.1.1-15.el8_4
Fixes 1 record
Priority MEDIUM 41
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01703 · Published 2024-01-19 · Fixed in 10.2.0 CWE-95
