CVE-2022-22815

EUVD-2022-0199
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
pythonpillow
𝑥
< 9.0.0
debiandebian_linux
9.0
debiandebian_linux
10.0
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pillow
102
105
102
105
102
105
102
105
102
105
102
105
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pillow
114
101
114
101
114
101
114
101
114
101
114
101
114
101
114
101
114
101
114
101
114
101
pillow-python2
100
110
110
101
100
110
100
110
100
110
100
110
100
110
100
110
100
110
100
110
100
110
python-imaging
100
110
100
110
100
110
100
110
100
110
100
110
100
110
100
110
100
110
100
110
100
110
Common Weakness Enumeration
References
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
https://security.gentoo.org/glsa/202211-10
https://www.debian.org/security/2022/dsa-5053
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
https://security.gentoo.org/glsa/202211-10
https://www.debian.org/security/2022/dsa-5053