CVE-2022-45198

一、漏洞信息
漏洞编号：CVE-2022-45198
漏洞归属组件：Pillow
漏洞归属的版本：8.2.0,>= 6.2.0
CVSS V3.0分值：
BaseScore：7.5 High
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
漏洞公开时间：2022-11-14 15:15:10
漏洞创建时间：2024-11-28 19:13:53
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2022-45198

更多参考(点击展开)

参考来源	参考链接	来源链接
cve.mitre.org	https://bugs.gentoo.org/855683
cve.mitre.org	https://cwe.mitre.org/data/definitions/409.html
cve.mitre.org	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4
cve.mitre.org	https://github.com/python-pillow/Pillow/pull/6402
cve.mitre.org	https://github.com/python-pillow/Pillow/releases/tag/9.2.0
cve.mitre.org	https://security.gentoo.org/glsa/202211-10
suse_bugzilla	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-45198	https://bugzilla.suse.com/show_bug.cgi?id=1205416
suse_bugzilla	http://www.cvedetails.com/cve/CVE-2022-45198/	https://bugzilla.suse.com/show_bug.cgi?id=1205416
ubuntu	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45198	https://ubuntu.com/security/CVE-2022-45198
ubuntu	https://github.com/python-pillow/Pillow/pull/6402	https://ubuntu.com/security/CVE-2022-45198
ubuntu	https://ubuntu.com/security/notices/USN-5777-1	https://ubuntu.com/security/CVE-2022-45198
ubuntu	https://ubuntu.com/security/notices/USN-5777-2	https://ubuntu.com/security/CVE-2022-45198
ubuntu	https://nvd.nist.gov/vuln/detail/CVE-2022-45198	https://ubuntu.com/security/CVE-2022-45198
ubuntu	https://launchpad.net/bugs/cve/CVE-2022-45198	https://ubuntu.com/security/CVE-2022-45198
ubuntu	https://security-tracker.debian.org/tracker/CVE-2022-45198	https://ubuntu.com/security/CVE-2022-45198
debian		https://security-tracker.debian.org/tracker/CVE-2022-45198
gentoo		https://security.gentoo.org/glsa/202211-10
anolis		https://anas.openanolis.cn/cves/detail/CVE-2022-45198
cve_search		https://bugs.gentoo.org/855683
cve_search		https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4
cve_search		https://github.com/python-pillow/Pillow/pull/6402
cve_search		https://github.com/python-pillow/Pillow/releases/tag/9.2.0
cve_search		https://cwe.mitre.org/data/definitions/409.html
cve_search		https://security.gentoo.org/glsa/202211-10
github_advisory	https://cwe.mitre.org/data/definitions/409.html	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://nvd.nist.gov/vuln/detail/CVE-2022-45198	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://security.gentoo.org/glsa/202211-10	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://bugs.gentoo.org/855683	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://github.com/python-pillow/Pillow/releases/tag/9.2.0	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://github.com/python-pillow/Pillow/commit/c9f1b35e981075110a23487a8d4a6cbb59a588ea	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
github_advisory	https://github.com/python-pillow/Pillow/pull/6402	https://github.com/advisories/GHSA-m2vv-5vj5-2hm7
mageia		http://advisories.mageia.org/MGASA-2023-0164.html
osv	https://security.gentoo.org/glsa/202211-10	https://osv.dev/vulnerability/CVE-2022-45198
osv	https://bugs.gentoo.org/855683	https://osv.dev/vulnerability/CVE-2022-45198
osv	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4	https://osv.dev/vulnerability/CVE-2022-45198
osv	https://github.com/python-pillow/Pillow/pull/6402	https://osv.dev/vulnerability/CVE-2022-45198
osv	https://cwe.mitre.org/data/definitions/409.html	https://osv.dev/vulnerability/CVE-2022-45198
osv	https://github.com/python-pillow/Pillow/releases/tag/9.2.0	https://osv.dev/vulnerability/CVE-2022-45198
amazon_linux_explore	https://access.redhat.com/security/cve/CVE-2022-45198	https://explore.alas.aws.amazon.com/CVE-2022-45198.html
amazon_linux_explore	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45198	https://explore.alas.aws.amazon.com/CVE-2022-45198.html

漏洞分析指导链接：
https://gitee.com/mindspore/community/blob/master/security/cve_issue_template.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)

影响的包	修复补丁	来源
	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4	cve.mitre.org
	https://github.com/python-pillow/Pillow/pull/6402	cve.mitre.org
	https://github.com/python-pillow/Pillow/pull/6402	ubuntu
	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4	github_advisory
	https://github.com/python-pillow/Pillow/commit/c9f1b35e981075110a23487a8d4a6cbb59a588ea	github_advisory
	https://github.com/python-pillow/Pillow/pull/6402	github_advisory
	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4	osv
	https://github.com/python-pillow/Pillow/pull/6402	osv
	https://bugs.gentoo.org/855683	nvd
	https://cwe.mitre.org/data/definitions/409.html	nvd
	https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4	nvd
	https://github.com/python-pillow/Pillow/pull/6402	nvd
	https://github.com/python-pillow/Pillow/releases/tag/9.2.0	nvd
	https://security.gentoo.org/glsa/202211-10	nvd
pillow	https://github.com/python-pillow/Pillow/commit/c9f1b35e981075110a23487a8d4a6cbb59a588ea	ubuntu

二、漏洞分析结构反馈
影响性分析说明：

MindSpore评分：

受影响版本排查(受影响/不受影响)：
1.master:
2.v0.5.0:
3.v2.0.0:

@hewei ,@ZhibinGuo ,@gongyue19941231 ,@mindwang ,@liangchenghui ,@liulili-huawei ,@zuochuanyong ,@jpc_chenjianping ,@david-he91 ,@qiuzhongya ,@liuchongming74 ,@ljl0711 ,@ljing-git ,@echomingzhu ,@changzherui ,@rainyhorse ,@zqstar ,@Rice ,@corleoneliu ,@huangbingjian ,@dairenjie ,@liyuxiaHp ,@zyli2020 ,@emmmmtang ,@henryshi1 ,@fangzhou0329 ,@shenwei41 ,@jxlang910 ,@c_34 ,@zhanghaibo5 ,@nicholas_yhr ,@looop5 ,@kangyangzc ,@cristoval ,@mindspore_ding ,@ouwenchang ,@zhunaipan ,@herryshi1 ,@zhujiaxing ,@zhao_ting_v ,@xu-yfei ,@yangxixin ,@zpac ,@greatpanc ,@YeFeng_24 ,@fangzehua 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, MindSpore评分, 受影响版本排查(受影响/不受影响))不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

MindSpore评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master:
2.v0.5.0:
3.v2.0.0:

-----------------------------------------------------------------------
issue处理具体操作请参考: 
https://gitee.com/mindspore/community/blob/master/security/cve_issue_template.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

GVP MindSpore/mindscience

内容风险标识

评论 (1)

GVPMindSpore/mindscience

内容风险标识

CVE-2022-45198

评论 (1)

搜索帮助

GVP MindSpore/mindscience