Pillow, a widely used open-source library for working with images, disclosed several vulnerabilities, one of them rated critical. A specially crafted image file could crash an application or, in some cases, let an attacker run code. A demonstration of the problem has been published, but we are not aware of active attacks.
- The H2O.ai Platform uses Pillow. We are assessing each product’s exposure.
- We will release updates with the fixed version of Pillow (13.0.0).
- Until patched versions are available, hybrid and on-premises customers can reduce risk by limiting image and document uploads to trusted users and expected file types.
If you have questions, contact your H2O.ai Customer Success manager or our security team at security@h2o.ai.