VulnSocial

CVE-2022-22817(debian / debian_linux)

LOWCVSS 9.8 · CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

debian CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • debian_linux
  • pillow

Affected systems

Vendors
debianpython
Products
debian_linuxpillow

3 versions affected across 2 products

Deep dive

Full discourse1 post
  • DailyCVE@dailycve

    🟠 Pillow, Regular Expression Denial of Service (ReDoS), #CVE-2022-22817 (Medium) -DC-Oct2026-3579 https://dailycve.com/pillow-regular-expression-denial-of-service-redos-cve-2022-22817-medium-dc-oct2026-3579/

    0000010
    244 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
OSdebiandebian_linux10.0--
OSdebiandebian_linux11.0--
OSdebiandebian_linux9.0--
Apppythonpillow---

Explore more

Back to dashboarddebian CVEspython CVEsdebian_linux vulnerabilities