Logo
vulnerabilityCVE-2023-50447
Name
CVE-2023-50447
Source
NVD ( link)Debian ( link)
Description
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
Published Date
Updated Date
Workaround
-

Analysis#


Affected Component
Analysis
python3-pillow
Patched

Vulnerability Ratings#


8.1
CVSSv31
8.1
CVSSv31
NaN
other

Others affected components#


Name
Project
Project Version
Version
Status
buildroot
2025.02.x
11.1.0
Not Affected
buildroot
master
12.0.0
Not Affected
openwrt
master
12.2.0-r1
Not Affected
openwrt
openwrt-25.12
12.1.1-r1
Not Affected
yocto
master
12.2.0
Not Affected
yocto
scarthgap
10.3.0
Not Affected

Resolved with patches#


python3-pillow (yocto:kirkstone)

#
Title
Author
Resolve
1
python3-pillow: Don't allow __ or builtins in env dictionarys
Eric Soroos <eric-github@soroos.net>
CVE-2023-50447
2
python3-pillow: Include further builtins
Andrew Murray <radarhere@users.noreply.github.com>
CVE-2023-50447
3
python3-pillow: Simplified code
Andrew Murray <radarhere@users.noreply.github.com>
CVE-2023-50447
4
python3-pillow: Allow ops
Andrew Murray <radarhere@users.noreply.github.com>
CVE-2023-50447