CVE-2022-22817 Arbitrary expression injection in Pillow
Attackers can execute arbitrary code via unsafe expression evaluation in the Pillow image processing library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22817?
CVE-2022-22817 is a critical code injection vulnerability in Debian Debian Linux, published on 7 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Which versions are affected by CVE-2022-22817?
4 open source packages ship an affected version, including pillow. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
pillow Bitnami | All versions | 9.0.1 |
pillow PyPI | All versions | 9.0.0 |
pillow PyPI | All versions | 9.0.1 |
pillow PyPI | All versions | 9.0.1 |
Products include Debian Debian Linux, Python Pillow.
How do I fix CVE-2022-22817?
Upgrade pillow to a fixed version for your release line: 9.0.1 or 9.0.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-22817 being exploited?
There is no known exploitation of CVE-2022-22817 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-22817, BIT-pillow-2022-22817, DEBIAN-CVE-2022-22817, GHSA-8vj2-vxx3-667w, PYSEC-2022-10, ROOT-APP-PYPI-CVE-2022-22817 and 2 more.