{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2fa9d30a-7186-5b52-ac03-e6d708ee081f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "version": "11.2.1.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:fcb2582b-f287-5001-8169-f299e41ebd38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:c0ec54fc-10bf-5202-95f0-1a1ac3b1f91f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:e1aa5343-7ab7-5801-8d2f-b2ab5a5c567c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:447897a0-431e-51ef-91e1-208e156b843b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:eb91d539-57cf-5627-a693-f0a5dea25240", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:8b519228-4cb8-58bf-b830-839dede73956", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:bde2d5b3-a557-530b-aa61-4c7c8e36a9f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:ac38314f-9279-5d7e-852c-fb4370e5cc67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:e69290fc-169b-5a62-911d-f92179dca2d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:25507f9a-3c1b-5d06-95fa-0bc818a1c13c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:435d0fd8-5b9a-5448-ae01-4044730cae5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:8323cff4-b841-5f55-aaa8-33b038c65d95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:bdf43dcf-253f-53db-bba3-6cd5f301dc97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:8f2d0f17-fec8-5c80-8092-d741450a3cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:d2565eae-c98a-597c-b53a-8d7236842a09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:af9f4bcb-a4e1-5191-8dc8-868053de6fda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:e5b92283-c99d-5abd-9186-f36faac254a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:7fa1180a-3d9b-5d6b-a700-727240a87994", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:6575ec0d-ebe9-586a-a818-fe7b361bd637", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:af1cfce3-f891-53c9-84da-3ebe2e75f055", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:34acb50d-509f-598a-ae03-d3f0db0d3625", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:2d23a85f-e1bc-5bd2-aca0-a72390d9e56b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:c1ca576c-b30e-53c2-8f74-938697806839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:f298578f-052b-5ef7-ba0f-3e8315769311", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:2937eafb-2222-5b3a-a637-cde26903628e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:02423c5f-da84-5634-995f-e6593d67161d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:9db01a2e-9f3a-5d8c-a98f-c5bdd484c148", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:f7e01c7e-47c3-5a92-a778-27142fbe4b73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:1fad75f6-fc8e-54b0-86eb-49d514b25518", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:1f5fc3e4-1290-504b-8464-558da7679c38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:a4140cbc-1163-5c74-ba7d-41f960c64846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:223780d9-6855-5ef9-b95b-34b63199fca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:f2aa5a6c-1648-5439-9855-b4d0c7bef6a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:ce5f3a2f-22f2-5fb3-9860-56cc3dfcd08f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:97ed8d0e-7e27-583a-a664-cde1bf90b45a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:81f29497-fc44-5515-a67b-c7ccbd844d3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:ac2fc4c2-5990-5bfb-8e61-2fbb5756008c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:115504f1-ced8-5d39-85cd-74d6501276ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:29eeb24c-a9a6-5499-b4fe-7d677be470bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:0224ab13-ef67-50c3-b662-1681ce7fc407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:4dfa4795-82be-59a8-9780-41526dec86d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:1880486b-b0d6-5477-bc14-3a588e7a620b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:8aa2e9d5-b5a1-52e6-942e-910db2442277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:406c1d62-02b2-572b-aab9-38c5e557c5eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:01da09b6-a9a4-560e-b918-9fea1be36072", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:1e50d566-4edc-5e64-8ee5-bc1c6a434924", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:fe0f6dd5-7c01-5598-85d1-4f671665de4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:8d0bf889-861a-5519-a906-93f72efdd8ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:ea212ed1-c712-50c3-a402-9ca4991f57e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:c26cfea6-dae2-5841-b4db-290bf816a264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:60de6f59-c8fe-5021-9d3f-812a6dffec45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:f78a1db2-e3a8-584f-b66f-5f0a6b82a588", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:1cd357eb-f103-5e7b-95a9-97bc80f52b05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:a2478e23-d541-5dd3-adc6-4682cb8088cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:2e056680-224f-50fa-93e6-72e82a3bfe82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:ddd86b96-d32a-582e-b57b-472042afcc70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:8df57756-94b2-5380-bcf4-4b370b9a14bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ], "bom-ref": "urn:uuid:e338e3df-824d-5d3a-bb17-e331e30c0e58", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } ] }