Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl: 3 vulnerabilities (highest severity is: 8.1) #47
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/86/d2/ca178ad71dcd1dcddbe2a3f7983639d2f8a20e723d9a978ab978ed08c874/Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Path to dependency file: /projects/whatsapp_Bot/requirements.txt
Path to vulnerable library: /projects/whatsapp_Bot/requirements.txt,/projects/Multi_language_OCR/requirements.txt,/projects/Convert_a_image_to_pdf/requirements.txt,/projects/capture_screenshot/requirements.txt,/projects/racing_barchart_animation/requirements.txt,/projects/Network Usage Tracker/requirements.txt,/projects/Captcha_Genrator/requirements.txt
Found in HEAD commit: bf2f317cb6b371fa8ba87f3a9f45a7dde720c061
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/86/d2/ca178ad71dcd1dcddbe2a3f7983639d2f8a20e723d9a978ab978ed08c874/Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Path to dependency file: /projects/whatsapp_Bot/requirements.txt
Path to vulnerable library: /projects/whatsapp_Bot/requirements.txt,/projects/Multi_language_OCR/requirements.txt,/projects/Convert_a_image_to_pdf/requirements.txt,/projects/capture_screenshot/requirements.txt,/projects/racing_barchart_animation/requirements.txt,/projects/Network Usage Tracker/requirements.txt,/projects/Captcha_Genrator/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: bf2f317cb6b371fa8ba87f3a9f45a7dde720c061
Found in base branch: master
Vulnerability Details
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
Publish Date: 2024-01-19
URL: CVE-2023-50447
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.openwall.com/lists/oss-security/2024/01/20/1
Release Date: 2024-01-19
Fix Resolution: pillow - 10.2.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/86/d2/ca178ad71dcd1dcddbe2a3f7983639d2f8a20e723d9a978ab978ed08c874/Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Path to dependency file: /projects/whatsapp_Bot/requirements.txt
Path to vulnerable library: /projects/whatsapp_Bot/requirements.txt,/projects/Multi_language_OCR/requirements.txt,/projects/Convert_a_image_to_pdf/requirements.txt,/projects/capture_screenshot/requirements.txt,/projects/racing_barchart_animation/requirements.txt,/projects/Network Usage Tracker/requirements.txt,/projects/Captcha_Genrator/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: bf2f317cb6b371fa8ba87f3a9f45a7dde720c061
Found in base branch: master
Vulnerability Details
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
Publish Date: 2023-11-03
URL: CVE-2023-44271
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2023-11-03
Fix Resolution: Pillow - 10.0.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/86/d2/ca178ad71dcd1dcddbe2a3f7983639d2f8a20e723d9a978ab978ed08c874/Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Path to dependency file: /projects/whatsapp_Bot/requirements.txt
Path to vulnerable library: /projects/whatsapp_Bot/requirements.txt,/projects/Multi_language_OCR/requirements.txt,/projects/Convert_a_image_to_pdf/requirements.txt,/projects/capture_screenshot/requirements.txt,/projects/racing_barchart_animation/requirements.txt,/projects/Network Usage Tracker/requirements.txt,/projects/Captcha_Genrator/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: bf2f317cb6b371fa8ba87f3a9f45a7dde720c061
Found in base branch: master
Vulnerability Details
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Publish Date: 2022-11-14
URL: CVE-2022-45199
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2022-11-14
Fix Resolution: 9.3.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: