PT-2022-1453 · Pillow+10 · Pillow+10

Published 2022-01-07 · Updated 2024-06-13 · CVE-2022-22815

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 9.0.0

Description The issue is related to the path getbbox function in path.c in Pillow, which improperly initializes ImagePath.Path. This can be exploited by a remote attacker to access arbitrary files in the system by sending a specially crafted HTTP request. The vulnerability is associated with incorrect path restriction to the directory.

Recommendations For versions prior to 9.0.0, update to version 9.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the path getbbox function in path.c until a patch is available.

Fix

Improper Initialization

Path traversal

Weakness Enumeration

CWE-665

CWE-22

Related Identifiers

ALSA-2022:0643

ALT-PU-2022-1236

ALT-PU-2023-7942

ALT-PU-2023-8182

BDU:2022-00581

BIT-PILLOW-2022-22815

CESA-2022_0643

CVE-2022-22815

DLA-2893-1

DSA-5053-1

GHSA-PW3C-H7WP-CVHX

MGASA-2022-0166

OESA-2022-1526

OPENSUSE-SU-2024_1673-1

PYSEC-2022-8

RHSA-2022:0643

RHSA-2022_0643

RLSA-2022:0643

SUSE-SU-2022:1729-1

SUSE-SU-2024:1673-1

SUSE-SU-2024:1673-2

USN-5227-1

USN-5227-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Pillow

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 127

• https://osv.dev/vulnerability/RLSA-2022:0643 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22815 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5227-2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-8 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-22815 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2893-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5227-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22815 · Security Note
• https://debian.org/security/2022/dsa-5053 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CK3IGXU77EQTXZAYI2PTIAI4XLFS7AFP · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:0643 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:0643 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5227-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pw3c-h7wp-cvhx · Vendor Advisory