Detections
Analytics

SCA: security update for pillow (GHSA-x895-2wrm-hvp7)

high Tenable Self-Hosted Container Security Plugin ID 433545

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load
 function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and
 earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to
 overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
 (CVE-2014-1932)

See Also

https://github.com/advisories/GHSA-x895-2wrm-hvp7

Plugin Details

Severity: High

ID: 433545

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2014-1932

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.9

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/17/2022

Vulnerability Publication Date: 2/10/2014

Reference Information

CVE: CVE-2014-1932

BID: 65511

cwe: CWE-59