CVE-2023-50447: Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which…

high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	pillow	< pillow 9.4.0-1.1+deb12u1 (bookworm)	pillow 9.4.0-1.1+deb12u1 (bookworm)
paloalto	pan-os	—	—
python	pillow	<= 10.1.0	—
python	pillow	>= 0 < 8.1.2+dfsg-0.3+deb11u2	8.1.2+dfsg-0.3+deb11u2
python	pillow	>= 0 < 9.4.0-1.1+deb12u1	9.4.0-1.1+deb12u1
python	pillow	>= 0 < 10.2.0-1	10.2.0-1
python	pillow	>= 0 < 10.2.0-1	10.2.0-1
python	pillow	>= 0 < 10.2.0	10.2.0
python	pillow	>= 0 < 7.0.0-4ubuntu0.8	7.0.0-4ubuntu0.8
python	pillow	>= 0 < 9.0.1-1ubuntu0.2	9.0.1-1ubuntu0.2
python	pillow	>= 0 < 2.3.0-1ubuntu3.4+esm5	2.3.0-1ubuntu3.4+esm5
python	pillow	>= 0 < 3.1.2-0ubuntu1.6+esm3	3.1.2-0ubuntu1.6+esm3
python	pillow	>= 0 < 5.1.0-1ubuntu0.8+esm2	5.1.0-1ubuntu0.8+esm2

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

ghsa9.8CRITICAL

osv9.8CRITICAL