{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:153f09fb-40b1-5905-a0f2-2a56eaa95e43", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "version": "8.4.0.post5+tuxcare", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:826f1520-4a90-5eb5-96db-1689384d8b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:194b5f8a-f2ce-58f4-96e5-aa69f63d51e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:105b7227-08fe-50c9-af60-42d11da9b22f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1104d21d-28b1-51cf-a8c2-3a16b646f9a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9706b12e-fe5c-5f90-a7cd-7dc7475cfb26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4863 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2023-4863 is a heap buffer overflow vulnerability in libwebp's huffman_utils.c (BuildHuffmanTable function). Pillow 8.4.0 does not contain libwebp source code - it only has build scripts (install_webp.sh) that specify libwebp-1.2.1 as an external dependency to download and link. The vulnerable code lives in the separate libwebp repository, not in Pillow's codebase. Per the DOC-ONLY PATCH ru...", "justification": "requires_dependency" } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:e66b6d82-09f5-5765-8d9e-3a7178751344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d9c614e2-ed53-55e7-adc0-50917ff0c93f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:82f2efdc-195e-52e0-9044-1e7f67886fdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5eea9ec8-696c-52af-b44d-3023f19bd76e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42310 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:501316a3-ded0-5632-9656-519b18d671b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54059 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:61b1f02b-f76b-587e-b582-0892757e2070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:158ac6f4-3c1b-5b1a-b796-d06e1bdd29d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55379 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:f1e7738e-33cd-5540-abcf-f78748d4c64b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:7049938a-2565-53c7-8463-e64bfa5ceb9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:82f1c9aa-2d59-50a4-99c1-2c8d9ca8501d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:59f017b0-01e7-524c-94ea-ab40a35e990b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1d6e854d-04f3-582a-8812-1b80933614e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5b696bc3-d753-5098-a81d-714493d9a3bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:23129aaa-2a1d-57fa-8f66-8e209047782c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d12c195f-31d8-57ef-9445-c6802adb551f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b5263949-6ac3-5f92-9b29-c99b2757968f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post5+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9aecbbdf-6d06-522c-8a7d-0a9005873a88", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post5+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } ] }