Security Advisories

CGA-h6j8-g59c-55w9

Published

Last updated

https://images.chainguard.dev/security/CGA-h6j8-g59c-55w9

Package

py3-pillow

Latest Update

Fixed

Fixed Version

10.2.0-r0

Aliases

Severity

8.1

High

CVSS V3

Summary

Arbitrary Code Execution in Pillow

Description

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

References

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CGA-h6j8-g59c-55w9

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources