PyPI/pillow CVE-2022-24303: unknown, EPSS 2.69%

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

Action: Upgrade pillow to 9.0.1 or later.

pip install pillow==9.0.1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-168
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
• https://github.com/python-pillow/Pillow/pull/3450
• https://github.com/advisories/GHSA-9j59-75qj-795w

CVE-2022-24303 · published 2022-03-28T02:15:00Z · modified 2023-12-06T01:02:03.848876Z · JSON