CVE-2022-22816: Medium severity Python Pillow vulnerability
pathgetbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pillowto a version that resolves this vulnerability.Fixed in 5.4.1-2+deb10u3Fixed in 8.1.2+dfsg-0.3+deb11u1Fixed in 9.4.0-1.1Fixed in 10.1.0-1 - Upgrade
Upgrade
pip/Pillowto a version that resolves this vulnerability.Fixed in 9.0.0
Event History
Frequently Asked Questions
What is CVE-2022-22816?
CVE-2022-22816 is a vulnerability in the Pillow library, specifically in the path_getbbox function in path.c, which could result in a buffer over-read during the initialization of ImagePath.Path.
How does CVE-2022-22816 affect software?
CVE-2022-22816 affects the Pillow library versions before 9.0.0, as well as specific versions of the Debian Linux operating system.
What is the severity of CVE-2022-22816?
The severity of CVE-2022-22816 is medium, with a severity value of 6.5.
How can I fix CVE-2022-22816?
To fix CVE-2022-22816, update the Pillow library to version 9.0.0 or higher.
Where can I find more information about CVE-2022-22816?
You can find more information about CVE-2022-22816 on the NVD website and the official Pillow release notes for version 9.0.0.