CVE-2022-22817: Critical severity python imaging library (pillow) vulnerability
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval("exec(exit())").
While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.
Other sources
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used,
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-22817?
CVE-2022-22817 is a vulnerability in PIL.ImageMath.eval in Pillow before 9.0.0 that allows evaluation of arbitrary expressions, including ones that use the Python exec method.
What is the severity of CVE-2022-22817?
The severity of CVE-2022-22817 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2022-22817?
Pillow versions before 9.0.0 and certain versions of Debian Debian Linux (9.0, 10.0, and 11.0) are affected by CVE-2022-22817.
How can I fix CVE-2022-22817?
To fix CVE-2022-22817, update Pillow to version 9.0.1 or later, as well as any affected versions of Debian Debian Linux.
Where can I find more information about CVE-2022-22817?
You can find more information about CVE-2022-22817 on the NIST National Vulnerability Database (NVD) website and the official Pillow documentation.