{"id":"CLSA-2026-1789993475","summary":"Fix CVE(s): CVE-2023-44271, CVE-2023-50447","details":"   * SECURITY UPDATE: arbitrary code execution via the ImageMath.eval\n     environment parameter (ELSCVE-187962)\n     - debian/patches/CVE-2023-50447.patch: reject environment keys that\n       contain \"__\" or shadow a builtin before they are merged into the\n       execution namespace in src/PIL/ImageMath.py, so an injected name can\n       no longer satisfy the expression allowlist. Adds a regression test in\n       Tests/test_imagemath.py.\n     - CVE-2023-50447\n   * SECURITY UPDATE: denial of service via unbounded allocation when\n     measuring or rendering very long strings\n     - debian/patches/CVE-2023-44271.patch: add ImageFont.MAX_STRING_LENGTH\n       and check it at each text entry point in src/PIL/ImageFont.py before\n       the C layer allocates. Adds a regression test in\n       Tests/test_imagefont.py.\n     - CVE-2023-44271","modified":"2026-10-26T09:32:04.224027559Z","published":"2026-09-21T12:24:47Z","upstream":["CVE-2023-44271","CVE-2023-50447"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1789993475.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447"}],"affected":[{"package":{"name":"python-pil","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-pil?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789993475.json"}},{"package":{"name":"python-pil-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-pil-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789993475.json"}},{"package":{"name":"python-pil.imagetk","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-pil.imagetk?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789993475.json"}},{"package":{"name":"python3-pil","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3-pil?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789993475.json"}},{"package":{"name":"python3-pil.imagetk","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3-pil.imagetk?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789993475.json"}}],"schema_version":"1.9.0"}