PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
Created mingw-python-pillow tracking bugs for this issue: Affects: fedora-all [bug 2042528] Created python-pillow tracking bugs for this issue: Affects: fedora-all [bug 2042530] Created python3-pillow tracking bugs for this issue: Affects: epel-7 [bug 2042531]
Fix: https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11
It's very simple to reproduce and test this vulnerability: ``` from PIL.ImageMath import eval try: eval("round(5.05)") except ValueError: print("FIXED") else: print("VULNERABLE") ```
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:0609 https://access.redhat.com/errata/RHSA-2022:0609
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:0643 https://access.redhat.com/errata/RHSA-2022:0643
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:0669 https://access.redhat.com/errata/RHSA-2022:0669
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:0665 https://access.redhat.com/errata/RHSA-2022:0665
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:0667 https://access.redhat.com/errata/RHSA-2022:0667
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-22817