kritik
CVE-2022-24303
python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related actions
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami. Daha düşük diyenler: GHSA (yüksek), Red Hat (orta), Ubuntu (düşük).
Açıklama
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
21 kaynaktaki 22 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | pillow | 9.0.1 |
| alpine 3.15 | py3-pillow | 8.4.0-r3 |
| alpine 3.16 | py3-pillow | 9.0.1-r0 |
| alpine 3.17 | py3-pillow | 9.0.1-r0 |
| alpine 3.18 | py3-pillow | 9.0.1-r0 |
| alpine 3.19 | py3-pillow | 9.0.1-r0 |
| alpine 3.20 | py3-pillow | 9.0.1-r0 |
| alpine 3.21 | py3-pillow | 9.0.1-r0 |
| alpine 3.22 | py3-pillow | 9.0.1-r0 |
| alpine 3.23 | py3-pillow | 9.0.1-r0 |
| alpine 3.24 | py3-pillow | 9.0.1-r0 |
| alpine edge | py3-pillow | 9.0.1-r0 |
| debian 10 | pillow | düzeltme belirtilmemiş |
| debian 11 | pillow | 8.1.2+dfsg-0.3+deb11u3 |
| debian 12 | pillow | 9.0.1-1 |
| debian 13 | pillow | 9.0.1-1 |
| debian 14 | pillow | 9.0.1-1 |
| echo | pillow | 9.0.1-1 |
| pip::GitHub Security Advisory pip | pillow | 9.0.1 |
| ubuntu 20.04 | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow | 7.0.0-4ubuntu0.7 |
| ubuntu 20.04-ESM | pillow-python2 | 6.2.1-3ubuntu0.1~esm1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2022-24303
- https://github.com/advisories/GHSA-9j59-75qj-795w
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172
- https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781
- https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a
- https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
21 referansın hepsi
- https://github.com/python-pillow/Pillow/pull/3450
- https://github.com/python-pillow/Pillow/pull/6010
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24303
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10
- https://ubuntu.com/security/notices/USN-5777-1
- https://ubuntu.com/security/notices/USN-5777-2
- https://www.cve.org/CVERecord?id=CVE-2022-24303