{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6e032f5e-2e53-5985-81c8-0998fa1f9729", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "version": "8.4.0.post9+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:92ae096a-3db1-5950-ba78-ba2d8cb8bd69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b659fb27-61d9-5f00-bab4-87cceb97d2e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:94a2592d-02cd-5385-8e0d-307066f3f3e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:75a96494-106e-51e7-8cd6-26a79f453f2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:47f6942a-1fbc-5ea4-9bab-58da666b49d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:88e7bc06-8bc4-5090-a557-1d1823227dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2265ab84-bda9-53f0-872d-47316db261b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4863 does not affect version 8.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2023-4863 is a heap buffer overflow vulnerability in libwebp's huffman_utils.c (BuildHuffmanTable function). Pillow 8.4.0 does not contain libwebp source code - it only has build scripts (install_webp.sh) that specify libwebp-1.2.1 as an external dependency to download and link. The vulnerable code lives in the separate libwebp repository, not in Pillow's codebase. Per the DOC-ONLY PATCH ru...", "justification": "requires_dependency" } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:dd5eb99a-14e5-5467-b858-6080fbc4fe37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d1c4ca41-866c-5fe7-ae33-60a506790b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:34b7eac3-b2e6-5da8-838b-3f608de97d20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:04151819-142d-53c5-a66b-b68008ed4577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:13c5c42d-91d2-5c5d-8f93-52884b35629e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:bb07e00f-666d-5dd2-839c-6dd15a98fbb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:08efe2b9-750d-5569-8bc7-5353e1670224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:7d556e33-fe0c-5b26-83ad-39592336616d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2f2a3b22-8e24-511d-b5fa-320062c6093e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:9100dd86-7c3f-50c5-a5fa-76d283c4aa48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2de02787-f4d6-564b-8ea4-e49e6b812bb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b9be4f6b-5c24-51ee-bc32-4ea30a6ff17d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:fa481e39-9078-50f3-a29e-db29dd2b3485", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:aaf492cc-a122-534c-838d-ed235337f102", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4707fe99-a400-55b4-b826-abfc1896dd7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:f2a4aed7-86c1-5fc6-bd92-b39093a17a93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:5dddc676-7ed7-5fd7-ab33-4e44a64abd9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2488d41c-4cb5-595d-9e1c-a5a2445c0c28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:00d58140-50fe-57b5-afdd-050848d28cb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:a40ddef0-d5ac-50a5-9e86-acb5d277dfdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c740f25e-37f6-5685-b996-d755f593b6b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:435f18f2-b668-5980-8000-035e63c17abc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e6a6f758-f391-51d8-a76e-6a5b9827f8bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:6811945b-74c8-58f9-a1c8-a6f791d2901f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:cd67d562-4b42-52b7-b653-6b66cb17e8c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e1809b49-7e8f-55b1-9d08-217475b311e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b9ccbe1c-9f55-5dcd-9bf4-158f1f536728", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:124e7410-d143-5cfb-b9c9-6f80080441be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:33cb809a-3356-5455-9b6a-abd8f494f9d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:31ec2a6a-2375-5fa7-ab78-9a28969bf483", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:44db569b-b815-5614-bbc6-770705a1cca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:06f8e851-7fe3-5edd-a8ce-4f622486f053", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2c36bae9-36da-5dfe-9b02-869f88c21743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2580dc28-d7af-5ad7-a874-45f91e3aef19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c4592b29-925f-58aa-8125-e303d6bdc3fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:1e9d1c75-fecf-57eb-9006-d5eb52d576d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:7459cd28-6caa-5335-9996-eaaf601fd7a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d8e64154-34f3-583d-8eda-ec46b6c8735c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:5c2e5dab-edbf-5d7d-b252-870c3685ef3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:7d75fe2a-bf79-5f7a-ba75-44335aedf21e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:03bf0853-fe94-56bf-b3b2-5a40d972ba91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:0686e6c4-c608-55a1-aedb-08aedab93ded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e680543a-6b92-5539-97c3-21ddb0af7a2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b4e9fd48-77a1-57ab-9c0a-989ee3a48b68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c50ea0c8-1626-5431-86f0-371dfc3e296b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post9+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:50306990-569e-53d4-b2c9-402acd97936c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post9+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:be7c4388-beb7-559e-a390-5c102c2feb9a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post9+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } ] }