Lucene search

K
mageiaGentoo FoundationMGASA-2024-0244
HistoryJul 01, 2024 - 8:53 p.m.

Updated python-imageio packages fix security vulnerability

2024-07-0120:53:27
Gentoo Foundation
advisories.mageia.org
4
python-imageio
security vulnerability
shared libraries
github
risk
unix

7.5 High

AI Score

Confidence

Low

imageio can attempt to download shared freeimage libraries from https://github.com/imageio/imageio-binaries/tree/master/freeimage. The code fetches straight from master and provides no way of verifying whether the correct file was fetched. As a result, if the repository is attacked in the future, all prior versions of imageio would be silently downloading arbitrary shared libraries and running them on user systems. This is a serious problem.

OSVersionArchitecturePackageVersionFilename
Mageia9noarchpython-imageio< 2.22.4-1.1python-imageio-2.22.4-1.1.mga9

7.5 High

AI Score

Confidence

Low