--- hide: - toc --- # Security Overview ## Helm-Chart ##### Scan Results #### Chart Object: headphones/templates/common.yaml | Type | Misconfiguration ID | Check | Severity | Explaination | Links | |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM |
Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.allowPrivilegeEscalation' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv001
| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV017 | Privileged container | HIGH |
Expand... Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.privileged' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv017
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'hostpatch' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV023 | hostPath volumes mounted | MEDIUM |
Expand... HostPath volumes must be forbidden.

Deployment 'RELEASE-NAME-headphones' should not set 'spec.template.volumes.hostPath'
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv023
| | Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-headphones' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583 tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583 tccr.io/truecharts/headphones:version-58edc604@sha256:f605d077d6d6023e3326421ce02eb81bd962163b68569f8e3953cb5ac2898344 ##### Scan Results #### Container: tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583 (alpine 3.15.2) **alpine** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | busybox | CVE-2022-28391 | CRITICAL | 1.34.1-r4 | 1.34.1-r5 |
Expand...https://access.redhat.com/security/cve/CVE-2022-28391
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28391
https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
https://nvd.nist.gov/vuln/detail/CVE-2022-28391
| | curl | CVE-2022-22576 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22576
https://curl.se/docs/CVE-2022-22576.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576
https://ubuntu.com/security/notices/USN-5397-1
| | curl | CVE-2022-27774 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27774
https://curl.se/docs/CVE-2022-27774.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27774
https://ubuntu.com/security/notices/USN-5397-1
| | curl | CVE-2022-27776 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27776
https://curl.se/docs/CVE-2022-27776.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27776
https://ubuntu.com/security/notices/USN-5397-1
| | curl | CVE-2022-27775 | LOW | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27775
https://curl.se/docs/CVE-2022-27775.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27775
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-22576 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22576
https://curl.se/docs/CVE-2022-22576.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-27774 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27774
https://curl.se/docs/CVE-2022-27774.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27774
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-27776 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27776
https://curl.se/docs/CVE-2022-27776.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27776
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-27775 | LOW | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27775
https://curl.se/docs/CVE-2022-27775.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27775
https://ubuntu.com/security/notices/USN-5397-1
| | ssl_client | CVE-2022-28391 | CRITICAL | 1.34.1-r4 | 1.34.1-r5 |
Expand...https://access.redhat.com/security/cve/CVE-2022-28391
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28391
https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
https://nvd.nist.gov/vuln/detail/CVE-2022-28391
| | zlib | CVE-2018-25032 | HIGH | 1.2.11-r3 | 1.2.12-r0 |
Expand...http://seclists.org/fulldisclosure/2022/May/33
http://seclists.org/fulldisclosure/2022/May/35
http://seclists.org/fulldisclosure/2022/May/38
http://www.openwall.com/lists/oss-security/2022/03/25/2
http://www.openwall.com/lists/oss-security/2022/03/26/1
https://access.redhat.com/security/cve/CVE-2018-25032
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032
https://errata.almalinux.org/8/ALSA-2022-2201.html
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12
https://github.com/madler/zlib/issues/605
https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ
https://linux.oracle.com/cve/CVE-2018-25032.html
https://linux.oracle.com/errata/ELSA-2022-2213.html
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html
https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/
https://nvd.nist.gov/vuln/detail/CVE-2018-25032
https://security.netapp.com/advisory/ntap-20220526-0009/
https://support.apple.com/kb/HT213255
https://support.apple.com/kb/HT213256
https://support.apple.com/kb/HT213257
https://ubuntu.com/security/notices/USN-5355-1
https://ubuntu.com/security/notices/USN-5355-2
https://ubuntu.com/security/notices/USN-5359-1
https://www.debian.org/security/2022/dsa-5111
https://www.openwall.com/lists/oss-security/2022/03/24/1
https://www.openwall.com/lists/oss-security/2022/03/28/1
https://www.openwall.com/lists/oss-security/2022/03/28/3
| #### Container: tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583 (alpine 3.15.2) **alpine** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | busybox | CVE-2022-28391 | CRITICAL | 1.34.1-r4 | 1.34.1-r5 |
Expand...https://access.redhat.com/security/cve/CVE-2022-28391
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28391
https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
https://nvd.nist.gov/vuln/detail/CVE-2022-28391
| | curl | CVE-2022-22576 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22576
https://curl.se/docs/CVE-2022-22576.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576
https://ubuntu.com/security/notices/USN-5397-1
| | curl | CVE-2022-27774 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27774
https://curl.se/docs/CVE-2022-27774.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27774
https://ubuntu.com/security/notices/USN-5397-1
| | curl | CVE-2022-27776 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27776
https://curl.se/docs/CVE-2022-27776.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27776
https://ubuntu.com/security/notices/USN-5397-1
| | curl | CVE-2022-27775 | LOW | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27775
https://curl.se/docs/CVE-2022-27775.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27775
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-22576 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22576
https://curl.se/docs/CVE-2022-22576.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-27774 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27774
https://curl.se/docs/CVE-2022-27774.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27774
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-27776 | MEDIUM | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27776
https://curl.se/docs/CVE-2022-27776.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27776
https://ubuntu.com/security/notices/USN-5397-1
| | libcurl | CVE-2022-27775 | LOW | 7.80.0-r0 | 7.80.0-r1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-27775
https://curl.se/docs/CVE-2022-27775.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27775
https://ubuntu.com/security/notices/USN-5397-1
| | ssl_client | CVE-2022-28391 | CRITICAL | 1.34.1-r4 | 1.34.1-r5 |
Expand...https://access.redhat.com/security/cve/CVE-2022-28391
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28391
https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
https://nvd.nist.gov/vuln/detail/CVE-2022-28391
| | zlib | CVE-2018-25032 | HIGH | 1.2.11-r3 | 1.2.12-r0 |
Expand...http://seclists.org/fulldisclosure/2022/May/33
http://seclists.org/fulldisclosure/2022/May/35
http://seclists.org/fulldisclosure/2022/May/38
http://www.openwall.com/lists/oss-security/2022/03/25/2
http://www.openwall.com/lists/oss-security/2022/03/26/1
https://access.redhat.com/security/cve/CVE-2018-25032
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032
https://errata.almalinux.org/8/ALSA-2022-2201.html
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12
https://github.com/madler/zlib/issues/605
https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ
https://linux.oracle.com/cve/CVE-2018-25032.html
https://linux.oracle.com/errata/ELSA-2022-2213.html
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html
https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/
https://nvd.nist.gov/vuln/detail/CVE-2018-25032
https://security.netapp.com/advisory/ntap-20220526-0009/
https://support.apple.com/kb/HT213255
https://support.apple.com/kb/HT213256
https://support.apple.com/kb/HT213257
https://ubuntu.com/security/notices/USN-5355-1
https://ubuntu.com/security/notices/USN-5355-2
https://ubuntu.com/security/notices/USN-5359-1
https://www.debian.org/security/2022/dsa-5111
https://www.openwall.com/lists/oss-security/2022/03/24/1
https://www.openwall.com/lists/oss-security/2022/03/28/1
https://www.openwall.com/lists/oss-security/2022/03/28/3
| #### Container: Python **python-pkg** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | Pillow | CVE-2021-25287 | CRITICAL | 6.2.2 | 8.2.0 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25287
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25287
https://github.com/advisories/GHSA-77gc-v2xv-rvvh
https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://nvd.nist.gov/vuln/detail/CVE-2021-25287
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4963-1
| | Pillow | CVE-2021-25288 | CRITICAL | 6.2.2 | 8.2.0 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25288
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25288
https://github.com/advisories/GHSA-rwv7-3v45-hg29
https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://nvd.nist.gov/vuln/detail/CVE-2021-25288
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4963-1
| | Pillow | CVE-2021-25289 | CRITICAL | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25289
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25289
https://github.com/advisories/GHSA-57h3-9rgr-c24m
https://github.com/python-pillow/Pillow/commit/3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c
https://nvd.nist.gov/vuln/detail/CVE-2021-25289
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-34552 | CRITICAL | 6.2.2 | 8.3.0 |
Expand...https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34552.json
https://access.redhat.com/security/cve/CVE-2021-34552
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34552
https://github.com/advisories/GHSA-7534-mm45-c74v
https://github.com/python-pillow/Pillow/pull/5567
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/
https://nvd.nist.gov/vuln/detail/CVE-2021-34552
https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://ubuntu.com/security/notices/USN-5227-1
https://ubuntu.com/security/notices/USN-5227-2
| | Pillow | CVE-2022-22817 | CRITICAL | 6.2.2 | 9.0.0 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22817
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817
https://github.com/advisories/GHSA-8vj2-vxx3-667w
https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11
https://linux.oracle.com/cve/CVE-2022-22817.html
https://linux.oracle.com/errata/ELSA-2022-0643.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2022-22817
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
https://ubuntu.com/security/notices/USN-5227-1
https://ubuntu.com/security/notices/USN-5227-2
https://www.debian.org/security/2022/dsa-5053
| | Pillow | CVE-2022-24303 | CRITICAL | 6.2.2 | 9.0.1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-24303
https://github.com/advisories/GHSA-9j59-75qj-795w
https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
https://github.com/python-pillow/Pillow/pull/3450
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/
https://nvd.nist.gov/vuln/detail/CVE-2022-24303
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
| | Pillow | CVE-2020-10379 | HIGH | 6.2.2 | 7.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-10379
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10379
https://github.com/advisories/GHSA-8843-m7mw-mxqm
https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac
https://github.com/python-pillow/Pillow/commits/master/src/libImaging
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://nvd.nist.gov/vuln/detail/CVE-2020-10379
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574577
https://ubuntu.com/security/notices/USN-4430-2
https://usn.ubuntu.com/4430-2/
| | Pillow | CVE-2020-11538 | HIGH | 6.2.2 | 7.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-11538
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11538
https://github.com/advisories/GHSA-43fq-w8qq-v88h
https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
https://github.com/python-pillow/Pillow/pull/4504
https://github.com/python-pillow/Pillow/pull/4538
https://linux.oracle.com/cve/CVE-2020-11538.html
https://linux.oracle.com/errata/ELSA-2020-3185.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://nvd.nist.gov/vuln/detail/CVE-2020-11538
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
https://ubuntu.com/security/notices/USN-4430-1
https://ubuntu.com/security/notices/USN-4430-2
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2/
| | Pillow | CVE-2020-35653 | HIGH | 6.2.2 | 8.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-35653
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35653
https://github.com/advisories/GHSA-f5g8-5qq7-938w
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/
https://nvd.nist.gov/vuln/detail/CVE-2020-35653
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://ubuntu.com/security/notices/USN-4697-1
https://ubuntu.com/security/notices/USN-4697-2
| | Pillow | CVE-2020-35654 | HIGH | 6.2.2 | 8.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-35654
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35654
https://github.com/advisories/GHSA-vqcj-wrf2-7v73
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
https://nvd.nist.gov/vuln/detail/CVE-2020-35654
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://ubuntu.com/security/notices/USN-4697-1
| | Pillow | CVE-2021-23437 | HIGH | 6.2.2 | 8.3.2 |
Expand...https://access.redhat.com/security/cve/CVE-2021-23437
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23437
https://github.com/advisories/GHSA-98vv-pw6r-q6q4
https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/
https://nvd.nist.gov/vuln/detail/CVE-2021-23437
https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443
https://ubuntu.com/security/notices/USN-5227-1
https://ubuntu.com/security/notices/USN-5227-2
| | Pillow | CVE-2021-25290 | HIGH | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25290
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25290
https://github.com/advisories/GHSA-8xjq-8fcg-g5hw
https://github.com/python-pillow/Pillow/commit/86f02f7c70862a0954bfe8133736d352db978eaa
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25290
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-25291 | HIGH | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25291
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25291
https://github.com/advisories/GHSA-mvg9-xffr-p774
https://github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a
https://nvd.nist.gov/vuln/detail/CVE-2021-25291
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-25293 | HIGH | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25293
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25293
https://github.com/advisories/GHSA-p43w-g3c5-g5mq
https://github.com/python-pillow/Pillow/commit/4853e522bddbec66022c0915b9a56255d0188bf9
https://nvd.nist.gov/vuln/detail/CVE-2021-25293
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-27921 | HIGH | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-27921
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27921
https://github.com/advisories/GHSA-f4w8-cv6p-x6r5
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
https://nvd.nist.gov/vuln/detail/CVE-2021-27921
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-27922 | HIGH | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-27922
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27922
https://github.com/advisories/GHSA-3wvg-mj6g-m9cv
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
https://nvd.nist.gov/vuln/detail/CVE-2021-27922
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-27923 | HIGH | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-27923
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27923
https://github.com/advisories/GHSA-95q3-8gr9-gm8w
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
https://nvd.nist.gov/vuln/detail/CVE-2021-27923
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-28676 | HIGH | 6.2.2 | 8.2.0 |
Expand...https://access.redhat.com/security/cve/CVE-2021-28676
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28676
https://github.com/advisories/GHSA-7r7m-5h27-29hp
https://github.com/python-pillow/Pillow/pull/5377
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://nvd.nist.gov/vuln/detail/CVE-2021-28676
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4963-1
| | Pillow | CVE-2021-28677 | HIGH | 6.2.2 | 8.2.0 |
Expand...https://access.redhat.com/security/cve/CVE-2021-28677
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28677
https://github.com/advisories/GHSA-q5hq-fp76-qmrc
https://github.com/python-pillow/Pillow/pull/5377
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://nvd.nist.gov/vuln/detail/CVE-2021-28677
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4963-1
| | Pillow | CVE-2020-10177 | MEDIUM | 6.2.2 | 7.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-10177
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10177
https://github.com/advisories/GHSA-cqhg-xjhh-p8hf
https://github.com/python-pillow/Pillow/commits/master/src/libImaging
https://github.com/python-pillow/Pillow/pull/4503
https://github.com/python-pillow/Pillow/pull/4538
https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://nvd.nist.gov/vuln/detail/CVE-2020-10177
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573
https://ubuntu.com/security/notices/USN-4430-1
https://ubuntu.com/security/notices/USN-4430-2
https://ubuntu.com/security/notices/USN-4697-2
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2/
| | Pillow | CVE-2020-10378 | MEDIUM | 6.2.2 | 7.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-10378
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10378
https://github.com/advisories/GHSA-3xv8-3j54-hgrp
https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml
https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac
https://github.com/python-pillow/Pillow/commits/master/src/libImaging
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://nvd.nist.gov/vuln/detail/CVE-2020-10378
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://ubuntu.com/security/notices/USN-4430-1
https://ubuntu.com/security/notices/USN-4430-2
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2/
| | Pillow | CVE-2020-10994 | MEDIUM | 6.2.2 | 7.0.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-10994
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10994
https://github.com/advisories/GHSA-vj42-xq3r-hr3r
https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
https://github.com/python-pillow/Pillow/commit/ff60894d697d1992147b791101ad53a8bf1352e4
https://github.com/python-pillow/Pillow/commits/master/src/libImaging/
https://github.com/python-pillow/Pillow/pull/4505
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://nvd.nist.gov/vuln/detail/CVE-2020-10994
https://pillow.readthedocs.io/en/stable/releasenotes/
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574575
https://ubuntu.com/security/notices/USN-4430-1
https://ubuntu.com/security/notices/USN-4430-2
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2/
| | Pillow | CVE-2020-35655 | MEDIUM | 6.2.2 | 8.1.0 |
Expand...https://access.redhat.com/security/cve/CVE-2020-35655
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35655
https://github.com/advisories/GHSA-hf64-x4gq-p99h
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/
https://nvd.nist.gov/vuln/detail/CVE-2020-35655
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://ubuntu.com/security/notices/USN-4697-1
| | Pillow | CVE-2021-25292 | MEDIUM | 6.2.2 | 8.1.1 |
Expand...https://access.redhat.com/security/cve/CVE-2021-25292
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25292
https://github.com/advisories/GHSA-9hx2-hgq2-2g4f
https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c
https://github.com/python-pillow/Pillow/commit/6207b44ab1ff4a91d8ddc7579619876d0bb191a4
https://nvd.nist.gov/vuln/detail/CVE-2021-25292
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4763-1
| | Pillow | CVE-2021-28675 | MEDIUM | 6.2.2 | 8.2.0 |
Expand...https://access.redhat.com/security/cve/CVE-2021-28675
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28675
https://github.com/advisories/GHSA-g6rj-rv7j-xwp4
https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c623497
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://nvd.nist.gov/vuln/detail/CVE-2021-28675
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4963-1
| | Pillow | CVE-2021-28678 | MEDIUM | 6.2.2 | 8.2.0 |
Expand...https://access.redhat.com/security/cve/CVE-2021-28678
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28678
https://github.com/advisories/GHSA-hjfx-8p6c-g7gx
https://github.com/python-pillow/Pillow/pull/5377
https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://nvd.nist.gov/vuln/detail/CVE-2021-28678
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos
https://security.gentoo.org/glsa/202107-33
https://ubuntu.com/security/notices/USN-4963-1
| | Pillow | CVE-2022-22815 | MEDIUM | 6.2.2 | 9.0.0 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22815
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815
https://github.com/advisories/GHSA-pw3c-h7wp-cvhx
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2022-22815
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
https://ubuntu.com/security/notices/USN-5227-1
https://ubuntu.com/security/notices/USN-5227-2
https://www.debian.org/security/2022/dsa-5053
| | Pillow | CVE-2022-22816 | MEDIUM | 6.2.2 | 9.0.0 |
Expand...https://access.redhat.com/security/cve/CVE-2022-22816
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816
https://github.com/advisories/GHSA-xrcv-f9gm-v42c
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
https://linux.oracle.com/cve/CVE-2022-22816.html
https://linux.oracle.com/errata/ELSA-2022-0643.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2022-22816
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
https://ubuntu.com/security/notices/USN-5227-1
https://ubuntu.com/security/notices/USN-5227-2
https://www.debian.org/security/2022/dsa-5053
| | Pillow | GHSA-jgpv-4h4c-xhw3 | MEDIUM | 6.2.2 | 8.1.2 |
Expand...https://github.com/advisories/GHSA-jgpv-4h4c-xhw3
https://github.com/calix2/pyVulApp/security/advisories/GHSA-jgpv-4h4c-xhw3
| | Pillow | GHSA-4fx9-vc88-q2xc | LOW | 6.2.2 | 9.0.0 |
Expand...https://github.com/advisories/GHSA-4fx9-vc88-q2xc
https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file
| | Pillow | PYSEC-2020-77 | UNKNOWN | 6.2.2 | 7.1.0 |
Expand...https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac
https://github.com/python-pillow/Pillow/commits/master/src/libImaging
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2/
| | Pillow | PYSEC-2020-78 | UNKNOWN | 6.2.2 | 7.1.0 |
Expand...https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac
https://github.com/python-pillow/Pillow/commits/master/src/libImaging
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://usn.ubuntu.com/4430-2/
| | lxml | CVE-2021-43818 | HIGH | 4.6.3 | 4.6.5 |
Expand...https://access.redhat.com/security/cve/CVE-2021-43818
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43818
https://errata.almalinux.org/8/ALSA-2022-1932.html
https://github.com/advisories/GHSA-55x5-fj6c-h6m8
https://github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txt
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a (lxml-4.6.5)
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0 (lxml-4.6.5)
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
https://linux.oracle.com/cve/CVE-2021-43818.html
https://linux.oracle.com/errata/ELSA-2022-9341.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/
https://nvd.nist.gov/vuln/detail/CVE-2021-43818
https://security.netapp.com/advisory/ntap-20220107-0005/
https://ubuntu.com/security/notices/USN-5225-1
https://www.debian.org/security/2022/dsa-5043
https://www.oracle.com/security-alerts/cpuapr2022.html
| | paramiko | CVE-2022-24302 | MEDIUM | 2.7.2 | 2.10.1 |
Expand...https://access.redhat.com/security/cve/CVE-2022-24302
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24302
https://github.com/advisories/GHSA-f8q4-jwww-x3wv
https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546
https://github.com/paramiko/paramiko/commit/4c491e299c9b800358b16fa4886d8d94f45abe2e
https://github.com/paramiko/paramiko/releases/tag/2.10.1
https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2022-166.yaml
https://lists.debian.org/debian-lts-announce/2022/03/msg00032.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUEUEGILZ7MQXRSUF5VMMO4SWJQVPTQL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPMKRUS4HO3P7NR7P4Y6CLHB4MBEE3AI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U63MJ2VOLLQ35R7CYNREUHSXYLWNPVSB/
https://nvd.nist.gov/vuln/detail/CVE-2022-24302
https://ubuntu.com/security/notices/USN-5351-1
https://ubuntu.com/security/notices/USN-5351-2
https://www.paramiko.org/changelog.html
| | pip | CVE-2021-3572 | MEDIUM | 20.3.4 | 21.1 |
Expand...https://access.redhat.com/errata/RHSA-2021:3254
https://access.redhat.com/security/cve/CVE-2021-3572
https://bugzilla.redhat.com/show_bug.cgi?id=1962856
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3572
https://github.com/advisories/GHSA-5xp3-jfq3-5q8x
https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b
https://github.com/pypa/pip/issues/10042
https://github.com/pypa/pip/issues/10042#issuecomment-857452480
https://github.com/pypa/pip/pull/9827
https://github.com/skazi0/CVE-2021-3572/blob/master/CVE-2021-3572-v9.0.1.patch
https://linux.oracle.com/cve/CVE-2021-3572.html
https://linux.oracle.com/errata/ELSA-2021-4455.html
https://nvd.nist.gov/vuln/detail/CVE-2021-3572
https://packetstormsecurity.com/files/162712/USN-4961-1.txt
https://www.oracle.com/security-alerts/cpuapr2022.html
|