{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1272b36-bf9d-54af-8891-7268e60c498a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "version": "11.2.1.post6+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:8e0c902f-07fd-516d-8e9e-4d802b6030ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:361d951f-218b-5b43-bdd2-5fafa7e31368", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:b45f305e-7368-55d4-a7b8-4f5bebc63c92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:23e08b3f-dc82-52f0-a1f6-440888d75b8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:2a2deaa3-4040-5dfe-a29c-d5edc11aaec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:02fc9618-360f-507e-be12-511a7533c7ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:6f07b04d-5236-5130-b582-9ef273c282c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:1920c221-2225-56ff-97b9-4cfd44405e3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:5dc82833-c0db-5a3c-b054-e4ff3f7bfa7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:90911948-203d-5f34-91cc-a0b32a92c8b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:130869ea-a576-53fe-b295-a4146960593e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:432d927a-f54e-5b5f-9f8c-68954da1ab68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:2f757ce4-036b-5bd0-a2da-9c6db41d1577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:3566d2fd-ac38-59c6-9e37-296fd69b8e0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:1471590c-1a4e-5bbf-8b51-feb1c4362ab7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:be45263d-b493-5297-a0d7-1b83f7dba41e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:1c90e87e-c8af-5f9c-a7d5-66daee40c3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:bd872e31-2a46-5a2f-bcfc-5332bd489a7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:5ff958d1-06d0-5149-a893-93e16bb54ba9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:d806c18f-3572-5cdc-8f5b-d652f9c62ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:8eb78a99-a1c1-5f85-802e-c271ab108750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:9b3c44d7-77ee-5b33-9a08-620eff42b6f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:131e65aa-b998-5475-834f-bda5bbb1ee97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:d5a523ef-deec-58b9-a410-712859289ca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:2cd448dd-adcc-587d-80c5-94e25ac845c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:4c5537d1-eca7-52cb-8e7e-b853c5af1174", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:3d1651c9-861c-515a-b976-41f7d6a4a09e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:8f5b9ae8-d6b7-5810-ab49-02365cdbdae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:963e5a08-a718-55fb-ad66-813033f608ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:bcfede32-b40e-5db1-ac2f-255b03245ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:b3a64545-fa9e-5426-be7a-90c59f346989", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:6eb0bdf6-e0ef-5f88-ae40-9a34d4493703", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:a0b1030e-5761-58a0-8ebf-7ef589d47ac8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:7fab90be-8eeb-50b9-bc38-2a0973b61edf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:062f5c73-036e-51b8-ba52-33908181ee6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42311 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:65bd517e-329f-504c-b7c3-bb309bca7409", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:fdbc9879-76b8-5faf-86c7-3b92497c89d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:8691f7f0-e9b9-5fd0-b630-7bc7ff69e9c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:fe3f2c7c-ecd4-5ead-b670-cb6a7f4cdeb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:004d2afb-6d6d-5372-8a79-5ebc5c77a5ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:1b0f2cf4-8a79-551e-9e01-db00d5195ea9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:0bcac1cb-7836-5a05-bda3-296de961719b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:ec206ed2-93c9-5be4-b19d-1dc59c92b492", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:93b3141b-5f1c-52af-9835-7aa29414026a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:571a6977-8802-5810-8805-465e75a8f947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:525371fc-654e-5392-ad04-4fd92d78fc24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:258f0137-e9c6-5053-b80a-d095071c5fe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:d07a8366-61f2-55e2-bdc5-bb98261eb258", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:d5912b0d-3082-5202-8682-31d9c9d02f42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:0ff7bed9-f6b5-56e8-a411-82f3074fde74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:569b3394-b017-5187-9a33-43b99cef2f41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:1cb03377-56eb-522a-8ec5-0eb6f7718eee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:93912827-5dbb-5282-92e6-2be5f405c8d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:399bdc6d-5e08-53dc-b69a-edb8891e7195", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:ae09db2e-b38e-5d88-bbe5-4ce360710684", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:c7dfe53e-3028-54b7-a344-e8b65207136a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:27504d8f-dda1-5846-97ee-ad145e83a572", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ], "bom-ref": "urn:uuid:2b3b4b7e-821a-50ea-92ed-4aa927e0a4fe", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post6+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } ] }