Exposed dangerous method or function in Pillow - CVE-2022-22817

Vulnerability identifier: #VU60003

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22817

CWE-ID: CWE-749

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of PIL.ImageMath.eval() function on arbitrary expressions. A remote attacker can pass specially crafted file to the library and execute arbitrary code on the system.

Pillow
EcoStruxure Power Operation
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Red Hat Enterprise Linux Workstation
CentOS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Anolis OS
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Ubuntu
openEuler
Fedora
python-pillow (Red Hat package)
pillow (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python-pillow-qt
python-pillow-sane
python-pillow
python-pillow-tk
python-pillow-devel
python-pillow-doc
python-pil (Ubuntu package)
python3-pil (Ubuntu package)
python-Pillow-debuginfo
python-Pillow-debugsource
python-Pillow
python3-pillow-devel
python3-pillow-tk
python3-pillow-doc
python3-pillow
python-pillow-debuginfo
python3-pillow-qt
python-pillow-debugsource
python3-pillow-help
mingw-python-pillow
dev-python/pillow
PowerVC
IBM Cloud Pak for Business Automation
Migration Toolkit for Containers
XtremIO X2

Install updates from vendor's website.

Pillow - addressed in versions 9.0.0, 9.0.1
EcoStruxure Power Operation - update to 2024 CU2
python-pillow (Red Hat package) - addressed in versions 2.0.0-23.gitd1c6db8.el7_9, 5.1.1-13.el8_1, 5.1.1-14.el8_2, 5.1.1-14.el8_4, 5.1.1-18.el8_5
pillow (Debian package) - addressed in versions 5.4.1-2+deb10u3, 8.1.2+dfsg-0.3+deb11u1
Migration Toolkit for Containers - update to 1.5.4
python-pillow-qt - addressed in versions 2.0.0-23.gitd1c6db8, 2.0.0-25.gitd1c6db8
python-pillow-sane - addressed in versions 2.0.0-23.gitd1c6db8, 2.0.0-25.gitd1c6db8
python-pillow - addressed in versions 2.0.0-23.gitd1c6db8, 2.0.0-25.gitd1c6db8
python-pillow-tk - addressed in versions 2.0.0-23.gitd1c6db8, 2.0.0-25.gitd1c6db8
python-pillow-devel - addressed in versions 2.0.0-23.gitd1c6db8, 2.0.0-25.gitd1c6db8
python-pillow-doc - addressed in versions 2.0.0-23.gitd1c6db8, 2.0.0-25.gitd1c6db8
python-pil (Ubuntu package) - addressed in versions 3.1.20ubuntu1.6+esm1, 5.1.0-1ubuntu0.7, 5.1.0-1ubuntu0.8
python3-pil (Ubuntu package) - addressed in versions 3.1.20ubuntu1.6+esm1, 5.1.0-1ubuntu0.7, 5.1.0-1ubuntu0.8, 7.0.0-4ubuntu0.5, 7.0.0-4ubuntu0.6, 8.1.2+dfsg-0.3ubuntu0.1, 8.1.2-1ubuntu0.2
python-Pillow-debuginfo - update to 4.2.1-3.26.1
python-Pillow-debugsource - update to 4.2.1-3.26.1
python-Pillow - update to 4.2.1-3.26.1
python3-pillow-devel - update to 5.1.1-19
python3-pillow-tk - addressed in versions 5.1.1-19, 10.2.0-1
python3-pillow-doc - update to 5.1.1-19
python3-pillow - addressed in versions 5.1.1-19, 10.2.0-1
XtremIO X2 - update to 6.4.2-13
python3-pillow - addressed in versions 8.1.1-8, 9.0.1-6
python3-pillow-tk - addressed in versions 8.1.1-8, 9.0.1-6
python-pillow-debuginfo - addressed in versions 8.1.1-8, 9.0.1-6
python3-pillow-qt - addressed in versions 8.1.1-8, 9.0.1-6
python3-pillow-devel - addressed in versions 8.1.1-8, 9.0.1-6
python-pillow-debugsource - addressed in versions 8.1.1-8, 9.0.1-6
python-pillow - addressed in versions 8.1.1-8, 9.0.1-6
python3-pillow-help - addressed in versions 8.1.1-8, 9.0.1-6
mingw-python-pillow - addressed in versions 8.1.2-5.fc34, 8.3.2-2.fc35
python-pillow - addressed in versions 8.1.2-6.fc34, 8.3.2-2.fc35
python-pillow - addressed in versions 9.0.1-6, 9.4.0-2
dev-python/pillow - update to 9.3.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.15, 22.0.1.5

• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053

• Multiple vulnerabilities in Pillow
• Debian update for pillow
• Red Hat Enterprise Linux 7 update for python-pillow
• Red Hat Enterprise Linux 8 update for python-pillow
• Red Hat Enterprise Linux 8.2 update for python-pillow
• Red Hat Enterprise Linux 8.1 update for python-pillow
• Red Hat Enterprise Linux 8.4 update for python-pillow
• CentOS 7 update for python-pillow
• Ubuntu update for pillow
• Multiple vulnerabilities in Pillow
• Gentoo update for Pillow
• Ubuntu update for pillow
• Ubuntu update for pillow
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• SUSE update for python-Pillow
• openEuler update for python-pillow
• openEuler update for python-pillow
• Amazon Linux AMI update for python-pillow
• Amazon Linux AMI update for python-pillow
• Multiple vulnerabilities in IBM PowerVC
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Fedora 34 update for mingw-python-pillow, python-pillow
• Fedora 35 update for mingw-python-pillow, python-pillow
• Multiple vulnerabilities in Dell XtremIO X2
• Anolis OS update for python-pillow
• Anolis OS update for python-pillow
• Anolis OS update for python-pillow
• Anolis OS update for python-pillow
• Multiple vulnerabilities in Schneider Electric EcoStruxure Power Operation