PT-2022-1455 · Pypi+9 · Pillow+9

Published 2022-01-02 · Updated 2025-01-14 · CVE-2022-22817

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 9.0.1

Description The issue allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used, potentially enabling a remote attacker to execute arbitrary code in the system by passing a specially crafted file to the vulnerable library.

Recommendations For Pillow versions prior to 9.0.0, update to version 9.0.1 to resolve the issue. For Pillow version 9.0.0, update to version 9.0.1 to fully restrict builtins available to lambda expressions and prevent exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-749

Related Identifiers

ALSA-2022:0643

ALT-PU-2022-1236

ALT-PU-2023-7942

ALT-PU-2023-8182

BDU:2022-00583

BIT-PILLOW-2022-22817

CESA-2022_0609

CESA-2022_0643

CVE-2022-22817

DLA-2893-1

DLA-3768-1

DSA-5053-1

GHSA-8VJ2-VXX3-667W

MGASA-2022-0166

OESA-2022-1526

OPENSUSE-SU-2024:11814-1

OPENSUSE-SU-2025:14645-1

PYSEC-2022-10

RHSA-2022:0609

RHSA-2022:0643

RHSA-2022:0665

RHSA-2022:0667

RHSA-2022:0669

RHSA-2022_0609

RHSA-2022_0643

RLSA-2022:0643

SUSE-SU-2022:1729-1

SUSE-SU-2024:0290-1

USN-5227-1

USN-5227-2

USN-5227-3

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Pillow

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 127

• https://linux.oracle.com/errata/ELSA-2022-0643.html · Vendor Advisory
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/674542 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22817 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22817 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0609.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2893-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00583 · Security Note
• https://osv.dev/vulnerability/DLA-3768-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22815 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/723275 · Security Note
• https://debian.org/security/2022/dsa-5053 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-22817 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory