{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:22ed6295-8256-5955-989a-6734997dfdce", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "version": "8.4.0.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:89746234-1743-5756-a93c-50442442f3f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e7b7c1b7-bc57-5bac-ae8d-7aaf4a87de16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:13aafdc9-d721-5c2f-b097-20ebdd4aebdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4da7865c-78e3-5646-8b27-5345ad2ed5df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2d8596af-12ca-55ab-8afc-06c1d80b9866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:678baacf-a20e-5f49-881b-0ee72dd2268e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c7ab1021-def8-5df3-a2a1-694c79d08070", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4863 does not affect version 8.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2023-4863 is a heap buffer overflow vulnerability in libwebp's huffman_utils.c (BuildHuffmanTable function). Pillow 8.4.0 does not contain libwebp source code - it only has build scripts (install_webp.sh) that specify libwebp-1.2.1 as an external dependency to download and link. The vulnerable code lives in the separate libwebp repository, not in Pillow's codebase. Per the DOC-ONLY PATCH ru...", "justification": "requires_dependency" } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:04d464ba-4c6e-5d40-80ca-92e4e4c5919c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:20a936ad-9907-5346-b05d-181da5f41529", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e0997d8a-8c60-5dc8-b0b9-bbc54818e8c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:598fd046-116e-5d83-b1cc-e16b525b2cda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:93948bad-ec1d-5a72-bbc7-3f471293ca1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:19ed5832-5de1-5116-9fd7-19c190359c24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ebced683-32a2-559e-b2c2-2cfe5cfe4620", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c3e05633-be3f-5be2-88bd-f5ef3dcb110a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:5785ea23-1a85-51c7-91eb-92cd4f734ae9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:719ea5ca-40b2-5990-8327-45680b0edfd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f8edbf4c-2794-5632-a652-c7439cbd4faf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6d9e4b52-5258-5fa2-b08d-4127a582581c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e5f1d723-f5fa-5e5f-a975-5d3e7f50fdc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:5e719b63-74d4-5de4-a4e1-0efedb6eab97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bed14fa1-bed2-51c4-82b9-f35a22889cc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:747cf5f7-652b-5d50-beb3-e55cbfd798d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:eb1d92a1-398d-5b24-bc30-05a1ad4d68c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2df0b585-a323-58d9-9ea3-9d05f782eb07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7533c458-0b1f-59b3-8952-34a993be8a56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e8b5e870-47b1-5e5f-bdc9-6964753d3823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b0af1bc4-631d-5bc0-b6d8-ef1eff6a2e3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:129f805b-dfc9-5c3f-99a0-7aa56f1d5bc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:dab0f573-b1b1-5d72-bdf2-b4db766776b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b8022f0c-dd20-50d9-a9cb-6e2c00308d82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b848b53e-805c-58c4-bc09-efcbf7f62957", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c6dcad36-b528-5bdc-b053-2bdafaba258a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:eb0c4312-37f2-52e0-8677-514e47b65369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:40aa57bd-0768-55bd-ba49-01838740ade1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:32228610-ed7b-533b-a5dd-561b3783fcb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4f34ef67-5260-5a88-ac28-3c90e9312d01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:688754e3-f1b1-5e9e-8049-c5b1a0bd67f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:dc6ec675-c0b4-55f9-a423-9778d3a58e15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f2c7aa6e-368f-53c5-8fb7-d3c38e5506fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d264f9a9-05ba-5e0c-9f8d-5c6179ad80cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:26666074-b000-5f62-b3d0-1943adf2a4e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:af5c0086-f3e9-5cae-9a07-e0d1330bc4af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:86c26983-56bb-50a9-b1af-af2037ffe79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:cf97e851-1199-5be4-a1d0-f617301674b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:77fa4ec2-ac9f-58e3-a606-205dcbdbc914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b65ccaf0-45e5-5ecc-ac92-8bbc311f723c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8f964ecf-df11-5c4d-8240-0251761fa6ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:77f7c97a-cb5d-5cc1-aff2-86e5d33d7f9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8cc46c0c-f61b-5205-843a-379e4cc054d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6980a83e-7aa4-5470-9d9b-5308a7d10187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:3a6f197f-8d83-5bb7-ba7a-fc2d0c3e4ce8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post8+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:16a1f10a-e7fb-525e-aee0-71ad269806af", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post8+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:85d25b16-a1ec-5afc-89e6-b48f4f6424cf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post8+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } ] }