Summary
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.
Security Fix(es):
* pillow: Arbitrary Code Execution via the environment parameter (CVE-2023-50447)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | python3-pillow | 5.1.1-18.el8_9.1.alma.1 |
| AlmaLinux · 8 | python3-pillow-devel | 5.1.1-18.el8_9.1.alma.1 |
| AlmaLinux · 8 | python3-pillow-doc | 5.1.1-18.el8_9.1.alma.1 |
| AlmaLinux · 8 | python3-pillow-tk | 5.1.1-18.el8_9.1.alma.1 |
Vulnerabilities 1
-
High 8.1
Arbitrary Code Execution in Pillow
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).