High ELSA-2024-0893 1 CVE

Important: python-pillow security update (Oracle Linux 8)

Published Feb 20, 2024 · Updated Feb 20, 2024

Ecosystem: Oracle Linux

Summary

[5.1.1-18.1]
- Security fix for CVE-2023-50447
Resolves: RHEL-22240

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	python3-pillow	0:5.1.1-18.el8_9.1
Oracle Linux · 8	python3-pillow-devel	0:5.1.1-18.el8_9.1
Oracle Linux · 8	python3-pillow-doc	0:5.1.1-18.el8_9.1
Oracle Linux · 8	python3-pillow-tk	0:5.1.1-18.el8_9.1

Vulnerabilities 1

High 8.1

CVE-2023-50447

Arbitrary Code Execution in Pillow

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI

Jan 19, 2024