CVE-2022-45198: Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification)

High severity · published Nov 14, 2022

CVE-2022-45198

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification)

7.5

CVSS

1.3%

EPSS

On KEV

Description

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.3% · higher than 70% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Pillow · Python

before 9.2.0 · source: NVD

Affected product

Pillow

Python

All Pillow CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-45198

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-45198

Issue Tracking

https://bugs.gentoo.org/855683

Third Party Advisory

https://cwe.mitre.org/data/definitions/409.html

Patch

https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4

Patch

https://github.com/python-pillow/Pillow/pull/6402

Release Notes

https://github.com/python-pillow/Pillow/releases/tag/9.2.0

Third Party Advisory

https://security.gentoo.org/glsa/202211-10