CVE-2022-22817
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expressio...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
pillow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2022-22817 py3-pillow Corrigé dans: 8.4.0-r3
- Debian DEBIAN-CVE-2022-22817 pillow Corrigé dans: 8.1.2+dfsg-0.3+deb11u1
Références
- advisory lists.debian.org
- advisory pillow.readthedocs.io
- advisory pillow.readthedocs.io
- advisory security.gentoo.org
- advisory debian.org
- web lists.debian.org
- web nvd.nist.gov