Patchwire CVEs, their patch status, and feeds to follow them

CVE-2023-50447

Fixed in a distro release EPSS 2%CVSS 8.1

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Published 2024-01-19 · CVE record · OSV

Products: python pillow

Fixed upstream

EcosystemPackageFixed in
PyPIpillow10.2.0

Distro releases

ReleasePackageFixed in
AlmaLinux 8python3-pillow5.1.1-18.el8_9.1.alma.1
AlmaLinux 8python3-pillow-devel5.1.1-18.el8_9.1.alma.1
AlmaLinux 8python3-pillow-doc5.1.1-18.el8_9.1.alma.1
AlmaLinux 8python3-pillow-tk5.1.1-18.el8_9.1.alma.1
Amazon Linux 2python-pillow2.0.0-23.gitd1c6db8.amzn2.0.10
Amazon Linux 2python-pillow-devel2.0.0-23.gitd1c6db8.amzn2.0.10
Amazon Linux 2python-pillow-doc2.0.0-23.gitd1c6db8.amzn2.0.10
Amazon Linux 2python-pillow-sane2.0.0-23.gitd1c6db8.amzn2.0.10
Amazon Linux 2python-pillow-tk2.0.0-23.gitd1c6db8.amzn2.0.10
Amazon Linux 2023python3-pillow9.4.0-2.amzn2023.0.4
Amazon Linux 2023python3-pillow-devel9.4.0-2.amzn2023.0.4
Amazon Linux 2023python3-pillow-tk9.4.0-2.amzn2023.0.4
Chainguardkubeflow-pipelines-visualization-server2.4.1-r2
Chainguardpy3-pillow10.2.0-r0
Chainguardpy3-seaborn0.13.2-r0
Chainguardpy3-supported-seaborn0.13.2-r0
Chainguardpy3.10-seaborn0.13.2-r0
Chainguardpy3.11-seaborn0.13.2-r0
Chainguardpy3.12-seaborn0.13.2-r0
Chainguardpy3.13-seaborn0.13.2-r0
Debian 10pillow5.4.1-2+deb10u4
Debian 11pillow8.1.2+dfsg-0.3+deb11u2
Debian 12pillow9.4.0-1.1+deb12u1
Debian 13pillow10.2.0-1
Debian 14pillow10.2.0-1
Red Hat ansible automation platform 2.4automation-controller-venv-tower0:4.5.7-1.el9ap
Red Hat ansible automation platform 2.4automation-controller-venv-tower0:4.5.7-1.el8ap
Red Hat ansible automation platform 2.4automation-hub0:4.9.2-1.el9ap
Red Hat ansible automation platform 2.4automation-hub0:4.9.2-1.el8ap
Red Hat ansible automation platform 2.4python-aiohttp0:3.9.5-1.el9ap
Red Hat ansible automation platform 2.4python-aiohttp-debugsource0:3.9.5-1.el9ap
Red Hat ansible automation platform 2.4python-black0:22.8.0-2.el9ap
Red Hat ansible automation platform 2.4python-cryptography0:42.0.5-1.el9ap
Red Hat ansible automation platform 2.4python-cryptography-debugsource0:42.0.5-1.el9ap
Red Hat ansible automation platform 2.4python-galaxy-ng0:4.9.2-1.el9ap
Red Hat ansible automation platform 2.4python-gunicorn0:22.0.0-1.el9ap
Red Hat ansible automation platform 2.4python-idna0:3.7-1.el9ap
Red Hat ansible automation platform 2.4python-jinja20:3.1.4-1.el9ap
Red Hat ansible automation platform 2.4python-pillow0:10.3.0-1.el9ap
Red Hat ansible automation platform 2.4python-pillow-debugsource0:10.3.0-1.el9ap
Red Hat ansible automation platform 2.4python-pydantic0:1.10.15-1.el9ap
Red Hat ansible automation platform 2.4python-requests0:2.32.2-1.el9ap
Red Hat ansible automation platform 2.4python-social-auth-app-django0:5.4.1-1.el9ap
Red Hat ansible automation platform 2.4python-sqlparse0:0.5.0-1.el9ap
Red Hat ansible automation platform 2.4python3-aiohttp0:3.9.5-1.el9ap
Red Hat ansible automation platform 2.4python3-aiohttp-debuginfo0:3.9.5-1.el9ap
Red Hat ansible automation platform 2.4python3-black0:22.8.0-2.el9ap
Red Hat ansible automation platform 2.4python3-cryptography0:42.0.5-1.el9ap
Red Hat ansible automation platform 2.4python3-cryptography-debuginfo0:42.0.5-1.el9ap
Red Hat ansible automation platform 2.4python3-galaxy-ng0:4.9.2-1.el9ap
Red Hat ansible automation platform 2.4python3-gunicorn0:22.0.0-1.el9ap
Red Hat ansible automation platform 2.4python3-idna0:3.7-1.el9ap
Red Hat ansible automation platform 2.4python3-jinja20:3.1.4-1.el9ap
Red Hat ansible automation platform 2.4python3-pillow0:10.3.0-1.el9ap
Red Hat ansible automation platform 2.4python3-pillow-debuginfo0:10.3.0-1.el9ap
Red Hat ansible automation platform 2.4python3-pydantic0:1.10.15-1.el9ap
Red Hat ansible automation platform 2.4python3-requests0:2.32.2-1.el9ap
Red Hat ansible automation platform 2.4python3-social-auth-app-django0:5.4.1-1.el9ap
Red Hat ansible automation platform 2.4python3-sqlparse0:0.5.0-1.el9ap
Red Hat ansible automation platform 2.4python39-aiohttp0:3.9.5-1.el8ap
Red Hat ansible automation platform 2.4python39-aiohttp-debuginfo0:3.9.5-1.el8ap
Red Hat ansible automation platform 2.4python39-black0:22.8.0-2.el8ap
Red Hat ansible automation platform 2.4python39-cryptography0:42.0.5-1.el8ap
Red Hat ansible automation platform 2.4python39-cryptography-debuginfo0:42.0.5-1.el8ap
Red Hat ansible automation platform 2.4python39-galaxy-ng0:4.9.2-1.el8ap
Red Hat ansible automation platform 2.4python39-gunicorn0:22.0.0-1.el8ap
Red Hat ansible automation platform 2.4python39-idna0:3.7-1.el8ap
Red Hat ansible automation platform 2.4python39-jinja20:3.1.4-1.el8ap
Red Hat ansible automation platform 2.4python39-pillow0:10.3.0-1.el8ap
Red Hat ansible automation platform 2.4python39-pillow-debuginfo0:10.3.0-1.el8ap
Red Hat ansible automation platform 2.4python39-pydantic0:1.10.15-1.el8ap
Red Hat ansible automation platform 2.4python39-requests0:2.32.2-1.el8ap
Red Hat ansible automation platform 2.4python39-social-auth-app-django0:5.4.1-1.el8ap
Red Hat ansible automation platform 2.4python39-sqlparse0:0.5.0-1.el8ap
Red Hat ansible automation platform 2.4python3x-aiohttp0:3.9.5-1.el8ap
Red Hat ansible automation platform 2.4python3x-aiohttp-debugsource0:3.9.5-1.el8ap
Red Hat ansible automation platform 2.4python3x-black0:22.8.0-2.el8ap
Red Hat ansible automation platform 2.4python3x-cryptography0:42.0.5-1.el8ap
Red Hat ansible automation platform 2.4python3x-cryptography-debugsource0:42.0.5-1.el8ap
Red Hat ansible automation platform 2.4python3x-galaxy-ng0:4.9.2-1.el8ap
Red Hat ansible automation platform 2.4python3x-gunicorn0:22.0.0-1.el8ap
Red Hat ansible automation platform 2.4python3x-idna0:3.7-1.el8ap
Red Hat ansible automation platform 2.4python3x-jinja20:3.1.4-1.el8ap
Red Hat ansible automation platform 2.4python3x-pillow0:10.3.0-1.el8ap
Red Hat ansible automation platform 2.4python3x-pillow-debugsource0:10.3.0-1.el8ap
Red Hat ansible automation platform 2.4python3x-pydantic0:1.10.15-1.el8ap
Red Hat ansible automation platform 2.4python3x-requests0:2.32.2-1.el8ap
Red Hat ansible automation platform 2.4python3x-social-auth-app-django0:5.4.1-1.el8ap
Red Hat ansible automation platform 2.4python3x-sqlparse0:0.5.0-1.el8ap
Red Hat ansible automation platform 2.4receptor0:1.4.8-1.el9ap
Red Hat ansible automation platform 2.4receptor0:1.4.8-1.el8ap
Red Hat ansible automation platform 2.4receptorctl0:1.4.8-1.el9ap
Red Hat ansible automation platform 2.4receptorctl0:1.4.8-1.el8ap
Red Hat ansible automation platform developer 2.4python-black0:22.8.0-2.el9ap
Red Hat ansible automation platform developer 2.4python-cryptography0:42.0.5-1.el9ap
Red Hat ansible automation platform developer 2.4python-cryptography-debugsource0:42.0.5-1.el9ap
Red Hat ansible automation platform developer 2.4python-idna0:3.7-1.el9ap
Red Hat ansible automation platform developer 2.4python-jinja20:3.1.4-1.el9ap
Red Hat ansible automation platform developer 2.4python-requests0:2.32.2-1.el9ap
Red Hat ansible automation platform developer 2.4python3-black0:22.8.0-2.el9ap
Red Hat ansible automation platform developer 2.4python3-cryptography0:42.0.5-1.el9ap
Red Hat ansible automation platform developer 2.4python3-cryptography-debuginfo0:42.0.5-1.el9ap
Red Hat ansible automation platform developer 2.4python3-idna0:3.7-1.el9ap
Red Hat ansible automation platform developer 2.4python3-jinja20:3.1.4-1.el9ap
Red Hat ansible automation platform developer 2.4python3-requests0:2.32.2-1.el9ap
Red Hat ansible automation platform developer 2.4python39-black0:22.8.0-2.el8ap
Red Hat ansible automation platform developer 2.4python39-cryptography0:42.0.5-1.el8ap
Red Hat ansible automation platform developer 2.4python39-cryptography-debuginfo0:42.0.5-1.el8ap
Red Hat ansible automation platform developer 2.4python39-idna0:3.7-1.el8ap
Red Hat ansible automation platform developer 2.4python39-jinja20:3.1.4-1.el8ap
Red Hat ansible automation platform developer 2.4python39-requests0:2.32.2-1.el8ap
Red Hat ansible automation platform developer 2.4python3x-black0:22.8.0-2.el8ap
Red Hat ansible automation platform developer 2.4python3x-cryptography0:42.0.5-1.el8ap
Red Hat ansible automation platform developer 2.4python3x-cryptography-debugsource0:42.0.5-1.el8ap
Red Hat ansible automation platform developer 2.4python3x-idna0:3.7-1.el8ap
Red Hat ansible automation platform developer 2.4python3x-jinja20:3.1.4-1.el8ap
Red Hat ansible automation platform developer 2.4python3x-requests0:2.32.2-1.el8ap
Red Hat ansible automation platform developer 2.4receptor0:1.4.8-1.el8ap
Red Hat ansible automation platform developer 2.4receptor0:1.4.8-1.el9ap
Red Hat ansible automation platform developer 2.4receptorctl0:1.4.8-1.el9ap
Red Hat ansible automation platform developer 2.4receptorctl0:1.4.8-1.el8ap
Red Hat ansible automation platform inside 2.4python-black0:22.8.0-2.el9ap
Red Hat ansible automation platform inside 2.4python-cryptography0:42.0.5-1.el9ap
Red Hat ansible automation platform inside 2.4python-cryptography-debugsource0:42.0.5-1.el9ap
Red Hat ansible automation platform inside 2.4python-jinja20:3.1.4-1.el9ap
Red Hat ansible automation platform inside 2.4python3-black0:22.8.0-2.el9ap
Red Hat ansible automation platform inside 2.4python3-cryptography0:42.0.5-1.el9ap
Red Hat ansible automation platform inside 2.4python3-cryptography-debuginfo0:42.0.5-1.el9ap
Red Hat ansible automation platform inside 2.4python3-jinja20:3.1.4-1.el9ap
Red Hat ansible automation platform inside 2.4python39-black0:22.8.0-2.el8ap
Red Hat ansible automation platform inside 2.4python39-cryptography0:42.0.5-1.el8ap
Red Hat ansible automation platform inside 2.4python39-cryptography-debuginfo0:42.0.5-1.el8ap
Red Hat ansible automation platform inside 2.4python39-jinja20:3.1.4-1.el8ap
Red Hat ansible automation platform inside 2.4python3x-black0:22.8.0-2.el8ap
Red Hat ansible automation platform inside 2.4python3x-cryptography0:42.0.5-1.el8ap
Red Hat ansible automation platform inside 2.4python3x-cryptography-debugsource0:42.0.5-1.el8ap
Red Hat ansible automation platform inside 2.4python3x-jinja20:3.1.4-1.el8ap
Red Hat ansible automation platform inside 2.4receptor0:1.4.8-1.el9ap
Red Hat ansible automation platform inside 2.4receptor0:1.4.8-1.el8ap
Red Hat ansible automation platform inside 2.4receptorctl0:1.4.8-1.el9ap
Red Hat ansible automation platform inside 2.4receptorctl0:1.4.8-1.el8ap
Red Hat Enterprise Linux 7python-pillow0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 7python-pillow-debuginfo0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 7python-pillow-devel0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 7python-pillow-doc0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 7python-pillow-qt0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 7python-pillow-sane0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 7python-pillow-tk0:2.0.0-25.gitd1c6db8.el7_9
Red Hat Enterprise Linux 8python-pillow0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python-pillow-debuginfo0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python-pillow-debugsource0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python3-pillow0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python3-pillow-debuginfo0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python3-pillow-devel0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python3-pillow-doc0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python3-pillow-tk0:5.1.1-18.el8_9.1
Red Hat Enterprise Linux 8python3-pillow-tk-debuginfo0:5.1.1-18.el8_9.1
Red Hat rhel aus 8.2python-pillow0:5.1.1-15.el8_2
Red Hat rhel aus 8.2python-pillow-debuginfo0:5.1.1-15.el8_2
Red Hat rhel aus 8.2python-pillow-debugsource0:5.1.1-15.el8_2
Red Hat rhel aus 8.2python3-pillow0:5.1.1-15.el8_2
Red Hat rhel aus 8.2python3-pillow-debuginfo0:5.1.1-15.el8_2
Red Hat rhel aus 8.2python3-pillow-tk-debuginfo0:5.1.1-15.el8_2
Red Hat rhel aus 8.4python-pillow0:5.1.1-15.el8_4
Red Hat rhel aus 8.4python-pillow-debuginfo0:5.1.1-15.el8_4
Red Hat rhel aus 8.4python-pillow-debugsource0:5.1.1-15.el8_4
Red Hat rhel aus 8.4python3-pillow0:5.1.1-15.el8_4
Red Hat rhel aus 8.4python3-pillow-debuginfo0:5.1.1-15.el8_4
Red Hat rhel aus 8.4python3-pillow-tk-debuginfo0:5.1.1-15.el8_4
Red Hat rhel e4s 8.4python-pillow0:5.1.1-15.el8_4
Red Hat rhel e4s 8.4python-pillow-debuginfo0:5.1.1-15.el8_4
Red Hat rhel e4s 8.4python-pillow-debugsource0:5.1.1-15.el8_4
Red Hat rhel e4s 8.4python3-pillow0:5.1.1-15.el8_4
Red Hat rhel e4s 8.4python3-pillow-debuginfo0:5.1.1-15.el8_4
Red Hat rhel e4s 8.4python3-pillow-tk-debuginfo0:5.1.1-15.el8_4
Red Hat rhel eus 8.6python-pillow0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python-pillow-debuginfo0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python-pillow-debugsource0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python3-pillow0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python3-pillow-debuginfo0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python3-pillow-devel0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python3-pillow-doc0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python3-pillow-tk0:5.1.1-19.el8_6
Red Hat rhel eus 8.6python3-pillow-tk-debuginfo0:5.1.1-19.el8_6
Red Hat rhel eus 8.8python-pillow0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python-pillow-debuginfo0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python-pillow-debugsource0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python3-pillow0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python3-pillow-debuginfo0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python3-pillow-devel0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python3-pillow-doc0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python3-pillow-tk0:5.1.1-19.el8_8
Red Hat rhel eus 8.8python3-pillow-tk-debuginfo0:5.1.1-19.el8_8
Red Hat rhel tus 8.4python-pillow0:5.1.1-15.el8_4
Red Hat rhel tus 8.4python-pillow-debuginfo0:5.1.1-15.el8_4
Red Hat rhel tus 8.4python-pillow-debugsource0:5.1.1-15.el8_4
Red Hat rhel tus 8.4python3-pillow0:5.1.1-15.el8_4
Red Hat rhel tus 8.4python3-pillow-debuginfo0:5.1.1-15.el8_4
Red Hat rhel tus 8.4python3-pillow-tk-debuginfo0:5.1.1-15.el8_4
SUSE HPE Helion OpenStack 8python-Pillow4.2.1-3.26.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSpython-Pillow9.5.0-150400.5.9.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSpython-Pillow9.5.0-150400.5.9.1
SUSE Linux Enterprise Module for Python 3 15 SP5python-Pillow9.5.0-150400.5.9.1
SUSE Linux Enterprise Server 15 SP4-LTSSpython-Pillow9.5.0-150400.5.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4python-Pillow9.5.0-150400.5.9.1
SUSE OpenStack Cloud 8python-Pillow4.2.1-3.26.1
SUSE OpenStack Cloud 9python-Pillow5.2.0-3.23.1
SUSE OpenStack Cloud Crowbar 8python-Pillow4.2.1-3.26.1
SUSE OpenStack Cloud Crowbar 9python-Pillow5.2.0-3.23.1
SUSE Package Hub 15 SP5python-Pillow8.4.0-bp155.3.3.1
Ubuntu 20.04 LTSpillow7.0.0-4ubuntu0.8
Ubuntu 22.04 LTSpillow9.0.1-1ubuntu0.2
Ubuntu 24.04 LTSpillow10.2.0-1
Ubuntu Pro 14.04 LTSpillow2.3.0-1ubuntu3.4+esm5
Ubuntu Pro 16.04 LTSpillow3.1.2-0ubuntu1.6+esm3
Ubuntu Pro 18.04 LTSpillow5.1.0-1ubuntu0.8+esm2
Ubuntu Pro 20.04 LTSpillow-python2no fix
Wolfikubeflow-pipelines-visualization-server2.4.1-r2
Wolfipy3-pillow10.2.0-r0
Wolfipy3-seaborn0.13.2-r0
Wolfipy3-supported-seaborn0.13.2-r0
Wolfipy3.10-seaborn0.13.2-r0
Wolfipy3.11-seaborn0.13.2-r0
Wolfipy3.12-seaborn0.13.2-r0
Wolfipy3.13-seaborn0.13.2-r0
openSUSE Leap 15.5python-Pillow9.5.0-150400.5.9.1
openSUSE Leap 15.5python-Pillow7.2.0-150300.3.6.1
openSUSE Leap 15.5python-Pillow8.4.0-bp155.3.3.1
openSUSE Tumbleweedpython-Pillow12.3.0-1.1
openSUSE Tumbleweedpython-Pillow10.2.0-1.1