CVE-2023-50447

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = -

Security Fix(es):

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).(CVE-2023-50447)

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• pillow: Arbitrary Code Execution via the environment parameter (CVE-2023-50447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 8.4.0.post1+tuxcare.

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 9.4.0.post2+tuxcare.

TuxCare rebuilt pillow to address 2 CVEs. Fixed in 9.5.0.post1+tuxcare.

• SECURITY UPDATE: arbitrary code execution via the ImageMath.eval environment parameter (ELSCVE-187962)
  • debian/patches/CVE-2023-50447.patch: reject environment keys that contain "__" or shadow a builtin before they are merged into the execution namespace in src/PIL/ImageMath.py, so an injected name can no longer satisfy the expression allowlist. Adds a regression test in Tests/test_imagemath.py.
  • CVE-2023-50447
• SECURITY UPDATE: denial of service via unbounded allocation when measuring or rendering very long strings
  • debian/patches/CVE-2023-44271.patch: add ImageFont.MAX_STRING_LENGTH and check it at each text entry point in src/PIL/ImageFont.py before the C layer allocates. Adds a regression test in Tests/test_imagefont.py.
  • CVE-2023-44271

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-56pw-mpj4-fxww. This link is maintained to preserve external references.

Original Description

Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

This update fixes the following security issue: Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter This is a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

This update for python-Pillow fixes the following issues:

• CVE-2023-50447: Fixed arbitrary code execution via the environment parameter (boo#1219048)

These are all security issues fixed in the python310-Pillow-10.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2023-50447 in the pillow package for Root:PyPI. Multiple fixed versions available.

Root has patched GHSA-56pw-mpj4-fxww in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for python-Pillow fixes the following issues:

• CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048)

This update for python-Pillow fixes the following issues:

• CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048)

This update for python-Pillow fixes the following issues:

• CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048)
• CVE-2022-22817: Fixes evaluation of arbitrary expressions via PIL.ImageMath.eval. (bsc#1194521)

This update for python-Pillow fixes the following issues:

• CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048)

It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)

Duarte Santos discovered that Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-50447)