Catalogo CVE

CVE-2022-22817

pillow affected and fixed versions

[Catalogo CVE]

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

Gravità
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.33% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securitypillow11.1.0-5+deb13u3Fixed[CVE-2022-22817]
Debiantrixiepillow11.1.0-5+deb13u4Fixed[CVE-2022-22817]
Debiantrixiepillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debiansidpillow13.0.0-1Fixed[CVE-2022-22817]
Debiansidpillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debianforkypillow12.3.0-1Fixed[CVE-2022-22817]
Debianforkypillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debianbookworm-securitypillow9.4.0-1.1+deb12u1Fixed[CVE-2022-22817]
Debianbookwormpillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debianbookwormpillow9.4.0-1.1+deb12u1Fixed[CVE-2022-22817]

Showing 10 fix observations. All 43 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
PyPIRelease not reportedpillow9.0.0UnknownSource applicability is not establishedProvider not reported
PyPIRelease not reportedpillow9.0.1UnknownSource applicability is not establishedProvider not reported
Debianbookwormpillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debianbookwormpillow9.4.0-1.1+deb12u1Fixed[CVE-2022-22817]
Debianbookworm-securitypillow9.4.0-1.1+deb12u1Fixed[CVE-2022-22817]
Debianforkypillow12.3.0-1Fixed[CVE-2022-22817]
Debianforkypillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debiansidpillow13.0.0-1Fixed[CVE-2022-22817]
Debiansidpillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debiantrixiepillow11.1.0-5+deb13u4Fixed[CVE-2022-22817]
Debiantrixiepillow9.0.0-1FixedDistribution-reported fixed boundary[CVE-2022-22817]
Debiantrixie-securitypillow11.1.0-5+deb13u3Fixed[CVE-2022-22817]
Opensusetumbleweedpython-Pillow11.1.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2025:14645-1]
Opensusetumbleweedpython-Pillow9.0.1-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:11814-1]
Susehpe helion openstack 8python-Pillow4.2.1-3.26.1UnknownSource applicability is not established[SUSE-SU-2024:0290-1]
Suseopenstack cloud 8python-Pillow4.2.1-3.26.1UnknownSource applicability is not established[SUSE-SU-2024:0290-1]
Suseopenstack cloud crowbar 8python-Pillow4.2.1-3.26.1UnknownSource applicability is not established[SUSE-SU-2024:0290-1]
Ubuntu18.04pillow4.1.1-3build2UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow4.3.0-2ubuntu1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.0.0-1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.2UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.3UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.4UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.5UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.6UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.7UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu18.04pillow5.1.0-1ubuntu0.8UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow6.1.0-1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow6.1.0-1build1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow6.2.1-2UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4build1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4ubuntu0.1UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4ubuntu0.2UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4ubuntu0.3UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4ubuntu0.4UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4ubuntu0.5UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntu20.04pillow7.0.0-4ubuntu0.6UnknownSource applicability is not established[USN-5227-3][UBUNTU-CVE-2022-22817]
Ubuntupropillow-python26.2.1-3UnknownSource applicability is not established[UBUNTU-CVE-2022-22817]
Ubuntupropillow-python26.2.1-3ubuntu0.1~esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-22817]
Ubuntupropillow-python26.2.1-3ubuntu0.1~esm2UnknownSource applicability is not established[UBUNTU-CVE-2022-22817]
Ubuntupropillow-python26.2.1-3~build1UnknownSource applicability is not established[UBUNTU-CVE-2022-22817]
Original provider fields
{
  "package_releases": [
    {
      "name": "pillow",
      "status": "fixed",
      "release": "sid",
      "version": "13.0.0-1"
    },
    {
      "name": "pillow",
      "status": "fixed",
      "release": "forky",
      "version": "12.3.0-1"
    },
    {
      "name": "pillow",
      "status": "fixed",
      "release": "trixie",
      "version": "11.1.0-5+deb13u4"
    },
    {
      "name": "pillow",
      "status": "fixed",
      "release": "trixie-security",
      "version": "11.1.0-5+deb13u3"
    },
    {
      "name": "pillow",
      "status": "fixed",
      "release": "bookworm",
      "version": "9.4.0-1.1+deb12u1"
    },
    {
      "name": "pillow",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "9.4.0-1.1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.0-1"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.0-1"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.0-1"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.0-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "pillow",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.1"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "9.0.1",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "9.0.0",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.0-1ubuntu0.8"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "4.1.1-3build2",
        "4.3.0-2ubuntu1",
        "5.0.0-1",
        "5.1.0-1",
        "5.1.0-1ubuntu0.2",
        "5.1.0-1ubuntu0.3",
        "5.1.0-1ubuntu0.4",
        "5.1.0-1ubuntu0.5",
        "5.1.0-1ubuntu0.6",
        "5.1.0-1ubuntu0.7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5227-3",
      "fixed_version": "5.1.0-1ubuntu0.8",
      "provider_source": "pypi",
      "provider_record_id": "USN-5227-3",
      "provider_updated_at": "2026-04-27T16:01:33.367432Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.0-4ubuntu0.6"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "6.1.0-1",
        "6.1.0-1build1",
        "6.2.1-2",
        "7.0.0-4",
        "7.0.0-4build1",
        "7.0.0-4ubuntu0.1",
        "7.0.0-4ubuntu0.2",
        "7.0.0-4ubuntu0.3",
        "7.0.0-4ubuntu0.4",
        "7.0.0-4ubuntu0.5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5227-3",
      "fixed_version": "7.0.0-4ubuntu0.6",
      "provider_source": "pypi",
      "provider_record_id": "USN-5227-3",
      "provider_updated_at": "2026-04-27T16:01:33.367432Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.0-1ubuntu0.8"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "4.1.1-3build2",
        "4.3.0-2ubuntu1",
        "5.0.0-1",
        "5.1.0-1",
        "5.1.0-1ubuntu0.2",
        "5.1.0-1ubuntu0.3",
        "5.1.0-1ubuntu0.4",
        "5.1.0-1ubuntu0.5",
        "5.1.0-1ubuntu0.6",
        "5.1.0-1ubuntu0.7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-22817",
      "fixed_version": "5.1.0-1ubuntu0.8",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-22817",
      "provider_updated_at": "2026-04-02T18:44:33.165438Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.0-4ubuntu0.6"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "6.1.0-1",
        "6.1.0-1build1",
        "6.2.1-2",
        "7.0.0-4",
        "7.0.0-4build1",
        "7.0.0-4ubuntu0.1",
        "7.0.0-4ubuntu0.2",
        "7.0.0-4ubuntu0.3",
        "7.0.0-4ubuntu0.4",
        "7.0.0-4ubuntu0.5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-22817",
      "fixed_version": "7.0.0-4ubuntu0.6",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-22817",
      "provider_updated_at": "2026-04-02T18:44:33.165438Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow-python2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "6.2.1-3~build1",
        "6.2.1-3",
        "6.2.1-3ubuntu0.1~esm1",
        "6.2.1-3ubuntu0.1~esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-22817",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-22817",
      "provider_updated_at": "2026-04-02T18:44:33.165438Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Pillow",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.1-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:11814-1",
      "fixed_version": "9.0.1-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:11814-1",
      "provider_updated_at": "2026-02-04T04:38:34.996493Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Pillow",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.1-3.26.1"
            }
          ]
        }
      ],
      "release": "hpe helion openstack 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:0290-1",
      "fixed_version": "4.2.1-3.26.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:0290-1",
      "provider_updated_at": "2026-02-04T03:38:45.247803Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Pillow",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.1-3.26.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:0290-1",
      "fixed_version": "4.2.1-3.26.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:0290-1",
      "provider_updated_at": "2026-02-04T03:38:45.247803Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Pillow",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.1-3.26.1"
            }
          ]
        }
      ],
      "release": "openstack cloud crowbar 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:0290-1",
      "fixed_version": "4.2.1-3.26.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:0290-1",
      "provider_updated_at": "2026-02-04T03:38:45.247803Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Pillow",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.1.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2025:14645-1",
      "fixed_version": "11.1.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2025:14645-1",
      "provider_updated_at": "2026-02-04T02:24:58.148358Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

  • [python3-pil]Sconosciuto

    Pacchetto sorgente: [pillow]

    Dettagli (4)
    • 9.4.0-1.1+deb12u1 · amd64 · bookworm

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · arm64 · bookworm

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · amd64 · bookworm-security

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · arm64 · bookworm-security

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

  • [python3-pil.imagetk]Sconosciuto

    Pacchetto sorgente: [pillow]

    Dettagli (4)
    • 9.4.0-1.1+deb12u1 · amd64 · bookworm

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · arm64 · bookworm

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · amd64 · bookworm-security

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · arm64 · bookworm-security

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

  • [python-pil-doc]Sconosciuto

    Pacchetto sorgente: [pillow]

    Dettagli (4)
    • 9.4.0-1.1+deb12u1 · all · bookworm

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · all · bookworm

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · all · bookworm-security

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

    • 9.4.0-1.1+deb12u1 · all · bookworm-security

      Corretta · Corretta: 9.0.0-1

      dsa · pillow · debian · bookworm

[openSUSE Tumbleweed]

  • [python313-Pillow]Sconosciuto

    Pacchetto sorgente: [python-Pillow]

    Dettagli (1)
    • 12.3.0-2.2 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 11.1.0-1.1, 9.0.1-1.1

      Version impact unknown

      dsa · python-Pillow · opensuse · tumbleweed

  • [python313-Pillow-tk]Sconosciuto

    Pacchetto sorgente: [python-Pillow]

    Dettagli (1)
    • 12.3.0-2.2 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 11.1.0-1.1, 9.0.1-1.1

      Version impact unknown

      dsa · python-Pillow · opensuse · tumbleweed

  • [python314-Pillow]Sconosciuto

    Pacchetto sorgente: [python-Pillow]

    Dettagli (1)
    • 12.3.0-2.2 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 11.1.0-1.1, 9.0.1-1.1

      Version impact unknown

      dsa · python-Pillow · opensuse · tumbleweed

  • [python314-Pillow-tk]Sconosciuto

    Pacchetto sorgente: [python-Pillow]

    Dettagli (1)
    • 12.3.0-2.2 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 11.1.0-1.1, 9.0.1-1.1

      Version impact unknown

      dsa · python-Pillow · opensuse · tumbleweed

Osservato:

Riferimenti