CVE-2022-22817

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval("exec(exit())").

While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.

Python image processing library.

Security Fix(es):

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.(CVE-2022-22816)

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.(CVE-2022-22817)

path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.(CVE-2022-22815)

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions (CVE-2022-22817)

• python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c (CVE-2022-22816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions (CVE-2022-22817)

• python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c (CVE-2022-22816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 8.4.0.post1+tuxcare.

path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815) path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. (CVE-2022-22816) PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions (CVE-2022-22817) Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. (CVE-2022-24303)

These are all security issues fixed in the python310-Pillow-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-Pillow-11.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

Root has patched CVE-2022-22817 in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:

Security fixes included on the update:

ardana-barbican:

• Update policies to protect container secret access (SOC-11621)
• Update policies to protect secret metadata access (SOC-11620)

openstack-neutron:

• CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).

rubygem-sinatra:

• CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).

python-XStatic-jquery-ui:

• CVE-2021-41182: Fixed XSS in the altField option of the Datepicker widget (bsc#1192070)
• CVE-2021-41183: Fixed XSS in the of option of the .position() util (bsc#1192073)
• CVE-2021-41184: Fixed XSS in *Text options of the Datepicker widget (bsc#1192075)

python-lxml:

• CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).
• CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).
• CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).
• CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).

openstack-barbican:

• CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).
• CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).

grafana:

• CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).

openstack-keystone:

• CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).

Non-security fixes included on the update:

Changes in ardana-barbican:

• Update to version 9.0+git.1644879908.8a641c1:

  • Update policies to protect container secret access (SOC-11621)

• Update to version 9.0+git.1643052417.9a3348e:

  • update policies to protect secret metadata access (SOC-11620)

Changes in grafana:

• Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)

  • directory traversal vulnerability for .md files

• Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)

  • Fix Go net/http: limit growth of header canonicalization cache

Changes in openstack-barbican:

• Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix the legacy policy rules for adding a secret to a container and removing a secret from a container. bsc#1194954,CVE-2022-23452

• Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the legacy policy rules for accessing secret metadata by checking that the user making the request is authenticated for the project that owns the secret. bsc#1194952,CVE-2022-23451

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-14.0.1.dev4:

  • Add support for yoga

• Update to version group-based-policy-automation-14.0.1.dev3:

  • Python2/3 compatibility fixes

• Update to version group-based-policy-automation-14.0.1.dev2:

  • Add support for xena

• Update to version group-based-policy-automation-14.0.1.dev1:

  • Remove py27 from gate jobs 14.0.0

Changes in openstack-horizon-plugin-gbp-ui:

• Update to version group-based-policy-ui-14.0.1.dev3:

  • Add support for yoga

• Update to version group-based-policy-ui-14.0.1.dev2:

  • Python2/3 compatibility changes

• Update to version group-based-policy-ui-14.0.1.dev1:

  • Add support for xena …

This update for python-Pillow fixes the following issues:

• CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048)
• CVE-2022-22817: Fixes evaluation of arbitrary expressions via PIL.ImageMath.eval. (bsc#1194521)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)

USN-5227-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)

USN-5227-1 fixed vulnerabilities in Pillow. It was discovered that the fix for CVE-2022-22817 was incomplete. This update fixes the problem.

Original advisory details:

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)