{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ceb82b8e-f574-5f41-b075-c7bd26aa40da", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "version": "11.2.1.post7+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:2cb93b71-754f-5a7b-a8a1-7fdc4783dec3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:3416669e-6a72-5813-a9bd-1ed580c15584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:0ee87f3f-b6f3-52cb-8989-63a8b755b124", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:3f75f88a-7ad7-5066-9074-a888563ba178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:b06a6111-daf8-590f-a401-534b9e47adf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:37e15363-987f-573c-9d80-4de6adfc6a40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:8d617598-42ce-5cac-a1ef-a4fcd5e31c58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:ca098100-b167-5bee-922e-3acce2d34f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:c51fd4db-aed1-5609-8595-a54b09e65c1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:9a5501dd-c267-51e5-9ee6-b3be45a42d7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:cea2ba49-f1a0-5c9e-9d5e-f5c31a41128f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:6b3d24bd-e961-5803-add1-d8cf4c18d830", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:41359b0e-e786-523a-a8d9-b40b01ebb1a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:a7993255-4393-5e80-89a4-0d067f083a07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:9fadcebd-1e69-5cd9-8552-34bfe8c25e9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:59663b9e-872c-5d0a-85b5-cc3d9f3b0ae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:e8d95cec-8a07-5d07-a09f-6f628d9071d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:58725942-e716-5985-9259-8da9c3a51b07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:ca967dea-bf6e-51b7-8a09-138ee4e9c2fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:bee91f87-6157-55b9-9ff5-8019a512b408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:03a376d0-00e0-5ec2-904b-e8ae1e3375df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:10513569-1bbd-5e9e-aebb-84ced0aa59a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:5d3e0be8-0654-555b-ba71-2128fbaec4ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:a38d81b0-8588-527a-a854-a1f3953ae454", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:50dd8655-b93c-5cce-a387-7d5a1360618b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:3d1dd287-1bee-57ee-83b4-561876f695b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:5e6d1cbc-64ba-5fa3-ae51-0f186502ba5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:629bfb12-682f-5f8e-89bd-a8b06246cd0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:cdade410-9d48-57fe-b636-c12c92f07174", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:e5d86f50-8351-5d59-b149-497035d4883a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:50b4fddb-b136-5c41-82d5-400cfa3a27da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:9c0c6be9-c1e8-50a0-ab98-63550b4fa675", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:f45e040c-6f1e-5046-800a-19911d7eb2c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:fddcfcdf-bb45-5bc4-a896-b8e715c91056", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:613a2952-b9ee-53e6-998a-36eb338b9205", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:b7e15a27-9587-5c81-9ef2-8e940b94a16a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:0faf383f-1d19-5fd1-9dd4-a5e481b7d524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:87105a47-1041-591c-8ab5-3d7e36c2e6bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:652adb40-7ffd-5829-a02b-52a4a98fbd5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:34c36524-480a-5b9c-a0c4-0630b6f866a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:0779141c-c690-50aa-92a8-ee398ca01104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:8ef724a5-32c3-55d4-82bd-bff4b543b2d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:856aa696-5dac-596d-91bf-bb4d65c8b766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:7d9820ee-5c53-5975-a802-f2c8ac5d44b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:dd68f303-da50-53b7-b7b4-d42f4a2c2d8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:a2778dce-1f2a-5a1f-9137-1457aad8215f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:aca154f4-4198-5c02-9b5c-f7bd46e5ba05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:fa592a84-400b-59ee-95d0-a5edbac84142", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:c983b276-c734-5dc8-a30d-d5772ce32f03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:d8e15c51-3fbe-5bbe-98b2-6db70fa7fbe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:be245d45-5040-532a-9f2e-08a0b53c8e6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:91af2499-80e3-5590-bbea-31f126745b2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:00d5b30f-e77a-5bc7-8782-db3b8d84e1fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:83f3b54d-6090-5c79-8f5e-13f8b0597884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:dd8cf094-29e3-5390-9deb-873d2eecc69e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:58de503f-1e36-53a2-b156-78f30971348e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:19ff51fe-42c7-5f76-ae61-6a49597c6bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ], "bom-ref": "urn:uuid:0f12f967-0567-53f1-9195-cedeb9c4f7c3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post7+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } ] }