CVE-2022-22815 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 26%

Affected Products (NVD)

Vendor	Product	Version
python	pillow	𝑥 < 9.0.0
debian	debian_linux	9.0
debian	debian_linux	10.0
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

pillow

bookworm	9.4.0-1.1+deb12u1 fixed
bookworm (security)	9.4.0-1.1+deb12u1 fixed
bullseye	8.1.2+dfsg-0.3+deb11u2 fixed
bullseye (security)	8.1.2+dfsg-0.3+deb11u2 fixed
sid	10.4.0-1 fixed
trixie	10.4.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

pillow

bionic	Fixed 5.1.0-1ubuntu0.7 released
focal	Fixed 7.0.0-4ubuntu0.5 released
hirsute	Fixed 8.1.2-1ubuntu0.2 released
impish	Fixed 8.1.2+dfsg-0.3ubuntu0.1 released
jammy	Fixed 9.0.0-1 released
kinetic	Fixed 9.0.0-1 released
lunar	Fixed 9.0.0-1 released
mantic	Fixed 9.0.0-1 released
noble	Fixed 9.0.0-1 released
trusty	Fixed 2.3.0-1ubuntu3.4+esm3 released
xenial	Fixed 3.1.2-0ubuntu1.6+esm1 released

pillow-python2

bionic	dne
focal	needs-triage
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

python-imaging

bionic	dne
focal	dne
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

Red Hat Enterprise Linux Releases

Red Hat Product

Release

python3-pillow

RHEL 8

0:5.1.1-18.el8_5

fixed

python3-pillow-devel

RHEL 8

0:5.1.1-18.el8_5

fixed

python3-pillow-doc

RHEL 8

0:5.1.1-18.el8_5

fixed

python3-pillow-tk

RHEL 8

0:5.1.1-18.el8_5

fixed

Common Weakness Enumeration

CWE-665 - Improper Initialization
The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

References

https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331

https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html

https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling

https://security.gentoo.org/glsa/202211-10

https://www.debian.org/security/2022/dsa-5053

https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331

https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html

https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling

https://security.gentoo.org/glsa/202211-10

https://www.debian.org/security/2022/dsa-5053