Red Hat Product Errata RHSA-2024:1058 - Security Advisory
Issued:
2024-02-29
Updated:
2024-02-29

RHSA-2024:1058 - Security Advisory

Synopsis

Important: python-pillow security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python-pillow is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

  • pillow:Arbitrary Code Execution via the environment parameter (CVE-2023-50447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
  • Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.6 aarch64

Fixes

  • BZ - 2259479 - CVE-2023-50447 pillow:Arbitrary Code Execution via the environment parameter

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
x86_64
python-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: db9947436917a646d1b4f1d9b1ba745d6fc697ffdf33a7446f783344d48c39ef
python-pillow-debugsource-5.1.1-19.el8_6.x86_64.rpm SHA-256: 116b3a7fde4e5da24722af9a2865bf470d2d4e3310e9f57cad63c8cf351d19cb
python3-pillow-5.1.1-19.el8_6.x86_64.rpm SHA-256: 19f8cb688a8ae8d8a06351989f3570af0dcaebee71d4340f0df3f885d5891d7c
python3-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 5e64a1a708c36ca10f41e580ee3b91f7791d464edbebfd61c2ab8c8211d57d3f
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 77586e0a32b25c1432373a5af86383dbb14b03563e315aa9cfd01a1e5841a42d

Red Hat Enterprise Linux Server - AUS 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
x86_64
python-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: db9947436917a646d1b4f1d9b1ba745d6fc697ffdf33a7446f783344d48c39ef
python-pillow-debugsource-5.1.1-19.el8_6.x86_64.rpm SHA-256: 116b3a7fde4e5da24722af9a2865bf470d2d4e3310e9f57cad63c8cf351d19cb
python3-pillow-5.1.1-19.el8_6.x86_64.rpm SHA-256: 19f8cb688a8ae8d8a06351989f3570af0dcaebee71d4340f0df3f885d5891d7c
python3-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 5e64a1a708c36ca10f41e580ee3b91f7791d464edbebfd61c2ab8c8211d57d3f
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 77586e0a32b25c1432373a5af86383dbb14b03563e315aa9cfd01a1e5841a42d

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
s390x
python-pillow-debuginfo-5.1.1-19.el8_6.s390x.rpm SHA-256: 23d8bce5bb454ef5608177c00faf3954d446e8851238777886472fab960e89eb
python-pillow-debugsource-5.1.1-19.el8_6.s390x.rpm SHA-256: 48f277c3da696938264aa3e6d14cf610ef4791f0a50ca92f4ef81dba97ec20d8
python3-pillow-5.1.1-19.el8_6.s390x.rpm SHA-256: 92a8d3ec932803788f233d1205f566588a7cd2b3610af9ac7b4e925963f97c84
python3-pillow-debuginfo-5.1.1-19.el8_6.s390x.rpm SHA-256: 0f7813de460f18a1fe8b406cdbbd1a111e366489254d813de35e68e90b55723b
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.s390x.rpm SHA-256: aea8433b8e0e1253cbb85df7ae4aec7f624dc2a5e6b5eeac732c6c66f42c735f

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
ppc64le
python-pillow-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 9918ae97869f8e6ab24cb2a2ae870bce6fda0c29766e53795517dcca659c6f03
python-pillow-debugsource-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 7adc4473e81cc4bdb40da367f770d72b1292728beb6eb4348670063daf1fdb01
python3-pillow-5.1.1-19.el8_6.ppc64le.rpm SHA-256: dc0281d4427f507e7e60d4093637d4682785f2f4a869a5f1e814f68916292ba6
python3-pillow-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: db3471ffa6b12679b9c0819f021431f78b301e306723b71d5e35164c576f31e9
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 5764dfb7a77094c4ce3a21fe0193433277c491b738aa84d528c94eb0c26a02c0

Red Hat Enterprise Linux Server - TUS 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
x86_64
python-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: db9947436917a646d1b4f1d9b1ba745d6fc697ffdf33a7446f783344d48c39ef
python-pillow-debugsource-5.1.1-19.el8_6.x86_64.rpm SHA-256: 116b3a7fde4e5da24722af9a2865bf470d2d4e3310e9f57cad63c8cf351d19cb
python3-pillow-5.1.1-19.el8_6.x86_64.rpm SHA-256: 19f8cb688a8ae8d8a06351989f3570af0dcaebee71d4340f0df3f885d5891d7c
python3-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 5e64a1a708c36ca10f41e580ee3b91f7791d464edbebfd61c2ab8c8211d57d3f
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 77586e0a32b25c1432373a5af86383dbb14b03563e315aa9cfd01a1e5841a42d

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
aarch64
python-pillow-debuginfo-5.1.1-19.el8_6.aarch64.rpm SHA-256: 6760a7150056c8e57f028925ca601bb7783addb5affb4ce65a124ace580126b3
python-pillow-debugsource-5.1.1-19.el8_6.aarch64.rpm SHA-256: ccfac266c0e3475144b0b7841de450fe778b1c07205bd868e78f55c5f5d7196a
python3-pillow-5.1.1-19.el8_6.aarch64.rpm SHA-256: ae2c3b5e5753da0a7d82ba19f44addad91ec33d93a513777fb54a6324e32cfa2
python3-pillow-debuginfo-5.1.1-19.el8_6.aarch64.rpm SHA-256: 3bc0b8694330bb050304050832d1e869db45fc597cec06382eca1e00b07bf4f3
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.aarch64.rpm SHA-256: 02f4353399237655fa36a71bd620d84e298ad7f86469a3eba621f8d7e66e810d

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
ppc64le
python-pillow-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 9918ae97869f8e6ab24cb2a2ae870bce6fda0c29766e53795517dcca659c6f03
python-pillow-debugsource-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 7adc4473e81cc4bdb40da367f770d72b1292728beb6eb4348670063daf1fdb01
python3-pillow-5.1.1-19.el8_6.ppc64le.rpm SHA-256: dc0281d4427f507e7e60d4093637d4682785f2f4a869a5f1e814f68916292ba6
python3-pillow-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: db3471ffa6b12679b9c0819f021431f78b301e306723b71d5e35164c576f31e9
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 5764dfb7a77094c4ce3a21fe0193433277c491b738aa84d528c94eb0c26a02c0

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM
python-pillow-5.1.1-19.el8_6.src.rpm SHA-256: ebca116a5958f2a2ad0415e8e795de12dbfe84c82bc5b7aba50257e91900cae3
x86_64
python-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: db9947436917a646d1b4f1d9b1ba745d6fc697ffdf33a7446f783344d48c39ef
python-pillow-debugsource-5.1.1-19.el8_6.x86_64.rpm SHA-256: 116b3a7fde4e5da24722af9a2865bf470d2d4e3310e9f57cad63c8cf351d19cb
python3-pillow-5.1.1-19.el8_6.x86_64.rpm SHA-256: 19f8cb688a8ae8d8a06351989f3570af0dcaebee71d4340f0df3f885d5891d7c
python3-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 5e64a1a708c36ca10f41e580ee3b91f7791d464edbebfd61c2ab8c8211d57d3f
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 77586e0a32b25c1432373a5af86383dbb14b03563e315aa9cfd01a1e5841a42d

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.6

SRPM
x86_64
python-pillow-debuginfo-5.1.1-19.el8_6.i686.rpm SHA-256: 69092be0ddd28d61af1860eb3e5b0d8d057b04d4896a107ec6e508bdbc418e28
python-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: db9947436917a646d1b4f1d9b1ba745d6fc697ffdf33a7446f783344d48c39ef
python-pillow-debugsource-5.1.1-19.el8_6.i686.rpm SHA-256: 133f841159a4bfcaf0649a443385981f1a5314c51e18a67170eb5cf304ec2058
python-pillow-debugsource-5.1.1-19.el8_6.x86_64.rpm SHA-256: 116b3a7fde4e5da24722af9a2865bf470d2d4e3310e9f57cad63c8cf351d19cb
python3-pillow-5.1.1-19.el8_6.i686.rpm SHA-256: 6451084bfbedd62f37f552c5bfc8042aabad347dce5f36e2fda01618e5b2014b
python3-pillow-debuginfo-5.1.1-19.el8_6.i686.rpm SHA-256: c72b620ecb5a66d4d5d9271b5d557e70d388bc0c2fbd174f34119a8742dbfa70
python3-pillow-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 5e64a1a708c36ca10f41e580ee3b91f7791d464edbebfd61c2ab8c8211d57d3f
python3-pillow-devel-5.1.1-19.el8_6.i686.rpm SHA-256: 9993742193907c894afef7c7b4e1b48e35bdcd9f8e68ddad9ece7a0a58951436
python3-pillow-devel-5.1.1-19.el8_6.x86_64.rpm SHA-256: 54fb7ca0dde01e6a773d4c02d9c4180b959093d4fb1e7496f46e7016a99f32fa
python3-pillow-doc-5.1.1-19.el8_6.noarch.rpm SHA-256: 72743b1a4fea8bedca34ac60f0c7150d7e25aacd059dde08d06c96cce2a4849f
python3-pillow-tk-5.1.1-19.el8_6.x86_64.rpm SHA-256: 1548b9fe2572ba6e62dfe26af3e516489b396734432a6e5edc7e05c79cdee19e
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.i686.rpm SHA-256: dfe0df2e81ace0d47a60a0c41e2fc17c9f0608d154769b2c6571c2da6583e667
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.x86_64.rpm SHA-256: 77586e0a32b25c1432373a5af86383dbb14b03563e315aa9cfd01a1e5841a42d

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.6

SRPM
ppc64le
python-pillow-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 9918ae97869f8e6ab24cb2a2ae870bce6fda0c29766e53795517dcca659c6f03
python-pillow-debugsource-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 7adc4473e81cc4bdb40da367f770d72b1292728beb6eb4348670063daf1fdb01
python3-pillow-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: db3471ffa6b12679b9c0819f021431f78b301e306723b71d5e35164c576f31e9
python3-pillow-devel-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 8a4e96523976bfd8ed7100865c275f712c0a68fa8ddf11289f22fff3b5830748
python3-pillow-doc-5.1.1-19.el8_6.noarch.rpm SHA-256: 72743b1a4fea8bedca34ac60f0c7150d7e25aacd059dde08d06c96cce2a4849f
python3-pillow-tk-5.1.1-19.el8_6.ppc64le.rpm SHA-256: a3567be692c03c8d9abffd192e0bbe15820295fabe89096d5b9e4511f41b1f4d
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.ppc64le.rpm SHA-256: 5764dfb7a77094c4ce3a21fe0193433277c491b738aa84d528c94eb0c26a02c0

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.6

SRPM
s390x
python-pillow-debuginfo-5.1.1-19.el8_6.s390x.rpm SHA-256: 23d8bce5bb454ef5608177c00faf3954d446e8851238777886472fab960e89eb
python-pillow-debugsource-5.1.1-19.el8_6.s390x.rpm SHA-256: 48f277c3da696938264aa3e6d14cf610ef4791f0a50ca92f4ef81dba97ec20d8
python3-pillow-debuginfo-5.1.1-19.el8_6.s390x.rpm SHA-256: 0f7813de460f18a1fe8b406cdbbd1a111e366489254d813de35e68e90b55723b
python3-pillow-devel-5.1.1-19.el8_6.s390x.rpm SHA-256: 07637d3f7cbf9054c2246322b1267755ff22cb61b72b3aead14016875dbbd866
python3-pillow-doc-5.1.1-19.el8_6.noarch.rpm SHA-256: 72743b1a4fea8bedca34ac60f0c7150d7e25aacd059dde08d06c96cce2a4849f
python3-pillow-tk-5.1.1-19.el8_6.s390x.rpm SHA-256: 303d5099d4c9e00366d8b43112f957cf9ee399f5effe97c77d15be15c40fe41b
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.s390x.rpm SHA-256: aea8433b8e0e1253cbb85df7ae4aec7f624dc2a5e6b5eeac732c6c66f42c735f

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.6

SRPM
aarch64
python-pillow-debuginfo-5.1.1-19.el8_6.aarch64.rpm SHA-256: 6760a7150056c8e57f028925ca601bb7783addb5affb4ce65a124ace580126b3
python-pillow-debugsource-5.1.1-19.el8_6.aarch64.rpm SHA-256: ccfac266c0e3475144b0b7841de450fe778b1c07205bd868e78f55c5f5d7196a
python3-pillow-debuginfo-5.1.1-19.el8_6.aarch64.rpm SHA-256: 3bc0b8694330bb050304050832d1e869db45fc597cec06382eca1e00b07bf4f3
python3-pillow-devel-5.1.1-19.el8_6.aarch64.rpm SHA-256: 9b624de40c34ff18b4bb7b0a4b371a87348024eb37de60b93418b5e38636e1f6
python3-pillow-doc-5.1.1-19.el8_6.noarch.rpm SHA-256: 72743b1a4fea8bedca34ac60f0c7150d7e25aacd059dde08d06c96cce2a4849f
python3-pillow-tk-5.1.1-19.el8_6.aarch64.rpm SHA-256: 97f745be79b90239e94df04ba2da8c61637227fd87e87ffc38438a3b985a8be4
python3-pillow-tk-debuginfo-5.1.1-19.el8_6.aarch64.rpm SHA-256: 02f4353399237655fa36a71bd620d84e298ad7f86469a3eba621f8d7e66e810d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.