{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:16016076-9e30-5cd3-b257-89eedd12d136", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "version": "8.4.0.post7+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:a47ae00a-3849-5d3e-b198-74af42812d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:876bf499-9093-53a2-9bb3-878f41c7a10f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4cc50b94-01c4-554b-af23-3757a49dc86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2f6f79ba-0269-52f6-a1c1-d0e4cfa30345", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:32695904-9b51-5078-901d-ae6a3c235b5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:baf34fc0-2f8d-51e5-b639-d0e3d6271afa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:5ef6cd12-7561-54a7-aba1-4cfe890e9257", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4863 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2023-4863 is a heap buffer overflow vulnerability in libwebp's huffman_utils.c (BuildHuffmanTable function). Pillow 8.4.0 does not contain libwebp source code - it only has build scripts (install_webp.sh) that specify libwebp-1.2.1 as an external dependency to download and link. The vulnerable code lives in the separate libwebp repository, not in Pillow's codebase. Per the DOC-ONLY PATCH ru...", "justification": "requires_dependency" } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f823a8d1-e9dc-5668-a39a-932e31538cb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:07b162a3-94a8-52f9-a27b-b48d25af0325", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1c3c6ecc-d80e-5897-aae5-eb2c2dbf4272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d73eb7e9-5b1c-565b-bc91-4c800c889246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:29a8d8e9-ccd2-571b-93d4-7e1b9be3d97c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:9adc4972-e2f9-59d8-95e0-add6da2ec438", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f38c4f61-6697-5b48-947f-4caf1acbdd11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:862ad6de-e27d-51c2-a543-70a69971af82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:de46062a-68d0-5aa9-843d-101bfe4b4846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:e41ebec1-9ec1-5a2d-bf74-a67f29a60a96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0f25d62d-4a7c-5abf-a559-98ba8f6eb828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:703f8f3d-1084-5e6a-bf3a-8858cd278c0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:9f7af947-7e0c-5372-92d1-13899a6c3b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:6c6d7e76-d1af-5e3c-8e75-1a4ef0d9982b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:50f8be68-d85d-5493-a35f-a70cbcf0c1d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d47be018-f639-59ae-b038-eef353b98c35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b7858652-2fc9-5aa1-b15c-7d9227344b46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0c183f3c-651f-5736-8945-d0d1bf1daf22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d63340e7-1910-5a27-808c-5e9c7bcbff78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:45a71b6c-0b8e-514a-ba9b-70a0689f290d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d90d5d22-d9c4-5b44-9c36-402f6149541b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ba740fcf-3686-54bd-a913-fb5be3c42f8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2397b7a5-619f-5b2e-84a4-bf5fc1a5e0c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:dda99c02-3c38-51e2-b1f9-e3f4e86aa06a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0bdbd3e1-bd68-5646-bb62-dd51bf17f6ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:a9fab433-febd-58b0-a8d3-57b032c83c78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c6e91cfa-4c93-5180-84e4-23ee284352c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:60ce1484-40f0-5fc4-b615-88ae79a40afc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b123fecf-f288-5577-8e59-e0afc6a65c55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:af5e9d3d-f788-50a7-a5f4-301c05ed76c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b8af8701-5e12-5606-b5d1-12348a7a5773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c62c3734-1981-5b75-987a-026fc4a52789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:df152554-b512-5d22-8d6b-5eda2d884188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:969e093b-8def-5f35-8742-f81098bc8372", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:425ddf28-3917-5e81-8c84-3d19ea4934de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:865096c2-b3b0-5ea8-8d43-acd1efab5569", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:7938e9c4-a0f8-504f-b772-bf2551c686a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:95e8a759-1809-5397-a971-34043f78b2cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:bc806118-fb54-57f8-b554-63938d241203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:da8e7ec5-5011-52c2-b913-9fcab8e14d7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0f996722-1758-54ea-adfd-144a7ea0c656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:dbf70797-d811-5cc3-9ede-028b72947e94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:460a10ce-09a1-51ea-9d70-300d04bfbc6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:073dfe15-982d-570e-81c9-79ce42cae8e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ae938905-b680-5660-b0cb-ca1dbc3e5621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:072b13f0-252b-51d5-a3cb-04c67b7b83de", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1ad79a7c-da26-5ddd-b445-5b42baa781fb", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post7+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ] }