crítica
CVE-2022-24303
python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related actions
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según GHSA (alta), Red Hat (media), Ubuntu (baja).
Descripción
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
Mostrar las 22 entradas de 21 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
| debian 10 | pillow | sin corrección indicada |
| debian 11 | pillow | 8.1.2+dfsg-0.3+deb11u3 |
| debian 12 | pillow | 9.0.1-1 |
| debian 13 | pillow | 9.0.1-1 |
| debian 14 | pillow | 9.0.1-1 |
| echo | pillow | 9.0.1-1 |
| pip::GitHub Security Advisory pip | pillow | 9.0.1 |
| ubuntu 20.04 | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow-python2 | 6.2.1-3ubuntu0.1~esm1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2022-24303
- https://github.com/advisories/GHSA-9j59-75qj-795w
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172
- https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781
- https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a
- https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
Las 21 referencias
- https://github.com/python-pillow/Pillow/pull/3450
- https://github.com/python-pillow/Pillow/pull/6010
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24303
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10
- https://ubuntu.com/security/notices/USN-5777-1
- https://ubuntu.com/security/notices/USN-5777-2
- https://www.cve.org/CVERecord?id=CVE-2022-24303