PyPI/pillow CVE-2023-44271: high 7.5, EPSS 1.35%

Pillow Denial of Service vulnerability

Action: Upgrade pillow to 10.0.0 or later.

pip install pillow==10.0.0

Affected

Fixed versions

Sources

• osv: GHSA-8ghj-p4vj-mr35
• https://nvd.nist.gov/vuln/detail/CVE-2023-44271
• https://github.com/python-pillow/Pillow/pull/7244
• https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
• https://devhub.checkmarx.com/cve-details/CVE-2023-44271
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml
• https://github.com/python-pillow/Pillow
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4

CVE-2023-44271 · published 2023-11-03T06:36:30Z · modified 2024-10-14T21:23:45.339098Z · JSON