CVE-2022-24303
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Original description
The description as published by the source.
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
pillow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-24303 py3-pillow Fixed in: 8.4.0-r3
- Debian DEBIAN-CVE-2022-24303 pillow Fixed in: 8.1.2+dfsg-0.3+deb11u3
References
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web pillow.readthedocs.io