CVE-2022-22817: Critical severity Python Pillow vulnerability
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval("exec(exit())").
While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.
Other sources
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used,
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pillowto a version that resolves this vulnerability.Fixed in 5.4.1-2+deb10u3Fixed in 8.1.2+dfsg-0.3+deb11u1Fixed in 9.4.0-1.1Fixed in 10.1.0-1 - Upgrade
Upgrade
pip/Pillowto a version that resolves this vulnerability.Fixed in 9.0.1 - Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 9.0.1
Event History
Frequently Asked Questions
What is CVE-2022-22817?
CVE-2022-22817 is a vulnerability in PIL.ImageMath.eval in Pillow before 9.0.0 that allows evaluation of arbitrary expressions, including ones that use the Python exec method.
What is the severity of CVE-2022-22817?
The severity of CVE-2022-22817 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2022-22817?
Pillow versions before 9.0.0 and certain versions of Debian Debian Linux (9.0, 10.0, and 11.0) are affected by CVE-2022-22817.
How can I fix CVE-2022-22817?
To fix CVE-2022-22817, update Pillow to version 9.0.1 or later, as well as any affected versions of Debian Debian Linux.
Where can I find more information about CVE-2022-22817?
You can find more information about CVE-2022-22817 on the NIST National Vulnerability Database (NVD) website and the official Pillow documentation.