{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b60cafd-e553-5fcd-95e1-a6f4d81fb914", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "version": "8.4.0.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:826f1520-4a90-5eb5-96db-1689384d8b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:194b5f8a-f2ce-58f4-96e5-aa69f63d51e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:105b7227-08fe-50c9-af60-42d11da9b22f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:fa7d4d06-2622-5781-835e-37a7a1aadba3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1104d21d-28b1-51cf-a8c2-3a16b646f9a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5c389c9a-9171-5bbf-9cea-25a1bca433c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9706b12e-fe5c-5f90-a7cd-7dc7475cfb26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4863 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2023-4863 is a heap buffer overflow vulnerability in libwebp's huffman_utils.c (BuildHuffmanTable function). Pillow 8.4.0 does not contain libwebp source code - it only has build scripts (install_webp.sh) that specify libwebp-1.2.1 as an external dependency to download and link. The vulnerable code lives in the separate libwebp repository, not in Pillow's codebase. Per the DOC-ONLY PATCH ru...", "justification": "requires_dependency" } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:e66b6d82-09f5-5765-8d9e-3a7178751344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d9c614e2-ed53-55e7-adc0-50917ff0c93f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:fd644636-20d9-53a5-a12e-8a726a013706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9c90ab02-3154-5f7d-b293-bc71e297c3ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:49a6ba3a-f0c5-5240-b46c-06851e92d53a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:f1d23b0e-39b2-551e-befc-ab56352e94f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:38dfd1e7-f9f8-5165-8aa6-36d97113fa96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5f405e56-e848-5b15-8221-70d2d2cd7ce3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b703c61c-a714-57f1-8b6f-0ea1b301f508", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:7749500d-6c24-58ea-8a43-5ee6008a08fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:e1341c47-f208-5be2-9a22-0191e0ed11d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:6c1052ac-8057-55d3-813d-7e7771533520", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:f3227c62-4e8b-5125-adad-7f54328086bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:bff80e3a-874c-5fa6-9c01-f341ebc34e46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:0428c060-ff08-5c6f-961d-522a8d414f0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5d3f926a-01d6-56e1-86eb-92564c051784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:c79f9f3b-70f3-5890-8856-cd0bd2bf490f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5f7e1a84-3b11-5375-81e2-ff0d4d119d77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:26753a88-3995-5ea9-9cc6-44bdf52be9c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:21640288-4699-5763-8072-0253a67b27ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:12d310df-abae-58a0-8349-842a878184a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:bdadd53b-043b-56f8-bf22-89532439f376", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b6b0ff2f-d441-5715-b1af-5a717bb3e84f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:0a45ae41-a5c1-5f47-836d-47f5976df933", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:27dca362-0a8d-5c60-90a7-9fbb84318499", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:82f2efdc-195e-52e0-9044-1e7f67886fdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5eea9ec8-696c-52af-b44d-3023f19bd76e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42310 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b533130b-74e9-57af-bd21-d70a2680ed9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:501316a3-ded0-5632-9656-519b18d671b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:61b1f02b-f76b-587e-b582-0892757e2070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:158ac6f4-3c1b-5b1a-b796-d06e1bdd29d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:f1e7738e-33cd-5540-abcf-f78748d4c64b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:7049938a-2565-53c7-8463-e64bfa5ceb9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:82f1c9aa-2d59-50a4-99c1-2c8d9ca8501d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:59f017b0-01e7-524c-94ea-ab40a35e990b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1d6e854d-04f3-582a-8812-1b80933614e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5b696bc3-d753-5098-a81d-714493d9a3bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:23129aaa-2a1d-57fa-8f66-8e209047782c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d12c195f-31d8-57ef-9445-c6802adb551f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:2520d21a-e27c-5e81-89d9-03066d265483", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:6958d46f-30e8-5136-a12d-3a490e5f52d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:c83d4f8b-4d01-5c08-9d2f-01622d1b6b1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b38b490a-2dde-518e-9712-c8951d97367f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:739c6efd-11d5-57df-bbc4-6cbb59a4ed5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:55023f4f-ea49-500b-860f-bc957811c3bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b5263949-6ac3-5f92-9b29-c99b2757968f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9aecbbdf-6d06-522c-8a7d-0a9005873a88", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post5+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ] }