CVE-2023-50447

Опубликовано: 19 янв. 2024

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Ссылки

http://www.openwall.com/lists/oss-security/2024/01/20/1
Mailing List
Third Party Advisory
https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
Third Party Advisory
https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
https://github.com/python-pillow/Pillow/releases
Release Notes
https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/01/20/1
Mailing List
Third Party Advisory
https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
Third Party Advisory
https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
https://github.com/python-pillow/Pillow/releases
Release Notes
https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

Версия до 10.1.0 (включая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00554

Низкий

8.1 High

CVSS3

Дефекты

CWE-94

CWE-95

Связанные уязвимости

CVE-2023-50447

CVSS3: 8.1

ubuntu

больше 1 года назад

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

CVE-2023-50447

CVSS3: 8.1

redhat

больше 1 года назад

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

CVE-2023-50447

CVSS3: 8.1

debian

больше 1 года назад

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Executi ...

openSUSE-SU-2024:0125-1

suse-cvrf

около 1 года назад

Security update for python-Pillow

SUSE-SU-2024:0205-1

suse-cvrf

больше 1 года назад

Security update for python-Pillow

EPSS

Процентиль: 67%

0.00554

Низкий

8.1 High

CVSS3

Дефекты

CWE-94

CWE-95