kritisch
CVE-2022-24303
python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related actions
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut GHSA (hoch), Red Hat (mittel), Ubuntu (niedrig).
Beschreibung
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
Alle 22 Einträge aus 21 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
| debian 10 | pillow | kein Fix angegeben |
| debian 11 | pillow | 8.1.2+dfsg-0.3+deb11u3 |
| debian 12 | pillow | 9.0.1-1 |
| debian 13 | pillow | 9.0.1-1 |
| debian 14 | pillow | 9.0.1-1 |
| echo | pillow | 9.0.1-1 |
| pip::GitHub Security Advisory pip | pillow | 9.0.1 |
| ubuntu 20.04 | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow-python2 | 6.2.1-3ubuntu0.1~esm1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2022-24303
- https://github.com/advisories/GHSA-9j59-75qj-795w
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172
- https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781
- https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a
- https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
Alle 21 Referenzen
- https://github.com/python-pillow/Pillow/pull/3450
- https://github.com/python-pillow/Pillow/pull/6010
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24303
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10
- https://ubuntu.com/security/notices/USN-5777-1
- https://ubuntu.com/security/notices/USN-5777-2
- https://www.cve.org/CVERecord?id=CVE-2022-24303