critique
CVE-2022-24303
python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related actions
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami. Plus basse selon GHSA (élevée), Red Hat (moyenne), Ubuntu (faible).
Description
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
Afficher les 22 entrées de 21 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
| debian 10 | pillow | pas de correctif indiqué |
| debian 11 | pillow | 8.1.2+dfsg-0.3+deb11u3 |
| debian 12 | pillow | 9.0.1-1 |
| debian 13 | pillow | 9.0.1-1 |
| debian 14 | pillow | 9.0.1-1 |
| echo | pillow | 9.0.1-1 |
| pip::GitHub Security Advisory pip | pillow | 9.0.1 |
| ubuntu 20.04 | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow-python2 | 6.2.1-3ubuntu0.1~esm1 |
Références
- https://access.redhat.com/security/cve/CVE-2022-24303
- https://github.com/advisories/GHSA-9j59-75qj-795w
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172
- https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781
- https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a
- https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
Les 21 références
- https://github.com/python-pillow/Pillow/pull/3450
- https://github.com/python-pillow/Pillow/pull/6010
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24303
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10
- https://ubuntu.com/security/notices/USN-5777-1
- https://ubuntu.com/security/notices/USN-5777-2
- https://www.cve.org/CVERecord?id=CVE-2022-24303