GitHub Advisoryadvisory · PyPI

GHSA-8m9x-pxwq-j236 Pillow command injection

CRITICAL Published 2022-05-17 Modified 2024-10-09 Official page ↗
Aliases
CVE-2014-3007
Ecosystem
PyPI
Packages
pillow
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2023-08-16

Affected packages

• PyPI pillow: < 2.5.0 → fixed in 2.5.0

Description

Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

Related

Alias · CVE (1)

  • CVE-2014-3007 Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References