Input validation error in Pillow - CVE-2022-24303

Vulnerability identifier: #VU69497

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24303

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to delete arbitrary files on the system.

The vulnerability exists due to input validation error when processing spaces in path to the temporary directory on Linux or macOS. A remote attacker can pass a specially crafted file to the application and delete arbitrary files on the system.

Pillow
Gentoo Linux
openEuler
Ubuntu
Fedora
python3-pil (Ubuntu package)
python3-pillow-help
python3-pillow
python3-pillow-tk
python-pillow
python-pillow-debugsource
python3-pillow-devel
python3-pillow-qt
python-pillow-debuginfo
mingw-python-pillow
dev-python/pillow
IBM Cloud Pak for Business Automation

Install updates from vendor's website.

Pillow - update to 9.0.1
python3-pil (Ubuntu package) - addressed in versions 7.0.0-4ubuntu0.7, 9.0.1-1ubuntu0.1
python3-pillow-help - addressed in versions 8.1.1-9, 9.0.1-2
python3-pillow - addressed in versions 8.1.1-9, 9.0.1-2
python3-pillow-tk - addressed in versions 8.1.1-9, 9.0.1-2
python-pillow - addressed in versions 8.1.1-9, 9.0.1-2
python-pillow-debugsource - addressed in versions 8.1.1-9, 9.0.1-2
python3-pillow-devel - addressed in versions 8.1.1-9, 9.0.1-2
python3-pillow-qt - addressed in versions 8.1.1-9, 9.0.1-2
python-pillow-debuginfo - addressed in versions 8.1.1-9, 9.0.1-2
mingw-python-pillow - addressed in versions 8.1.2-6.fc34, 8.3.2-3.fc35
python-pillow - addressed in versions 8.1.2-7.fc34, 8.3.2-3.fc35, 9.0.1-6.fc36
dev-python/pillow - update to 9.3.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.15, 22.0.1.5

• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
• https://github.com/python-pillow/Pillow/pull/3450
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/

• Multiple vulnerabilities in Pillow
• Gentoo update for Pillow
• Ubuntu update for pillow
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• openEuler update for python-pillow
• openEuler 22.03 LTS update for python-pillow
• Fedora 36 update for python-pillow
• Fedora 35 update for mingw-python-pillow, python-pillow
• Fedora 34 update for mingw-python-pillow, python-pillow