CVE ID:	CVE-2022-22817
Description:	PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Test IDs:	1.3.6.1.4.1.25623.1.1.2.2024.1247   1.3.6.1.4.1.25623.1.1.2.2024.2009   1.3.6.1.4.1.25623.1.1.2.2024.2658   1.3.6.1.4.1.25623.1.1.2.2024.1774   1.3.6.1.4.1.25623.1.1.2.2024.1751   1.3.6.1.4.1.25623.1.1.2.2024.1225   1.3.6.1.4.1.25623.1.1.2.2024.2050   1.3.6.1.4.1.25623.1.1.2.2024.1617   1.3.6.1.4.1.25623.1.1.2.2024.1516   1.3.6.1.4.1.25623.1.1.2.2024.1495   1.3.6.1.4.1.25623.1.1.2.2024.1991   1.3.6.1.4.1.25623.1.1.12.2022.5227.3   1.3.6.1.4.1.25623.1.1.2.2024.2488   1.3.6.1.4.1.25623.1.1.2.2024.1600   1.3.6.1.4.1.25623.1.1.2.2024.2624   1.3.6.1.4.1.25623.1.1.2.2024.1577   1.3.6.1.4.1.25623.1.1.2.2024.1636   1.3.6.1.4.1.25623.1.1.10.2024.0018
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2022-22817 Debian Security Information: DSA-5053 (Google Search) https://www.debian.org/security/2022/dsa-5053 https://security.gentoo.org/glsa/202211-10 https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html