diff options
| author | Linus Färnstrand <linus@mullvad.net> | 2024-03-21 23:41:30 +0100 |
|---|---|---|
| committer | Linus Färnstrand <linus@mullvad.net> | 2024-07-09 07:27:44 +0200 |
| commit | c4425f266b821b7e911ae7eb2012b5f64a79f1c2 (patch) | |
| tree | 352ba526e02a24336ef27e7b53e736ea2cbf0a08 /gui/scripts | |
| parent | 0b7d4d073a3c4e7bdce20a8ef9916d9cec43b9b0 (diff) | |
| download | mullvadvpn-c4425f266b821b7e911ae7eb2012b5f64a79f1c2.tar.xz mullvadvpn-c4425f266b821b7e911ae7eb2012b5f64a79f1c2.zip | |
Add osv-scanner.toml, ignoring some non-exploitable vulns
Diffstat (limited to 'gui/scripts')
| -rw-r--r-- | gui/scripts/osv-scanner.toml | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/gui/scripts/osv-scanner.toml b/gui/scripts/osv-scanner.toml new file mode 100644 index 0000000000..ec390ea1d3 --- /dev/null +++ b/gui/scripts/osv-scanner.toml @@ -0,0 +1,43 @@ +# See repository root `osv-scanner.toml` for instructions and rules for this file. + +# Pillow arbitrary code execution +[[IgnoredVulns]] +id = "CVE-2023-50447" # GHSA-3f63-hfp8-52jq +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" + +# Pillow buffer overflow +[[IgnoredVulns]] +id = "CVE-2024-28219" # GHSA-44wm-f244-xhp3 +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" + +# Pillow DoS +[[IgnoredVulns]] +id = "CVE-2023-44271" # GHSA-8ghj-p4vj-mr35 +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" + +# libwebp: OOB write in BuildHuffmanTable +[[IgnoredVulns]] +id = "CVE-2023-5129" # GHSA-j7hp-h8jx-5ppr +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" + +# Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863) +[[IgnoredVulns]] +id = "PYSEC-2023-175" +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" + +# Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863) +[[IgnoredVulns]] +id = "GHSA-56pw-mpj4-fxww" +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" + +# Pillow vulnerable to Data Amplification attack. +[[IgnoredVulns]] +id = "CVE-2022-45198" # GHSA-m2vv-5vj5-2hm7 +ignoreUntil = 2024-09-05 +reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade" |