1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
# See repository root `osv-scanner.toml` for instructions and rules for this file.
# Pillow arbitrary code execution
[[IgnoredVulns]]
id = "CVE-2023-50447" # GHSA-3f63-hfp8-52jq
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
# Pillow buffer overflow
[[IgnoredVulns]]
id = "CVE-2024-28219" # GHSA-44wm-f244-xhp3
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
# Pillow DoS
[[IgnoredVulns]]
id = "CVE-2023-44271" # GHSA-8ghj-p4vj-mr35
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
# libwebp: OOB write in BuildHuffmanTable
[[IgnoredVulns]]
id = "CVE-2023-5129" # GHSA-j7hp-h8jx-5ppr
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
# Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863)
[[IgnoredVulns]]
id = "PYSEC-2023-175"
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
# Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863)
[[IgnoredVulns]]
id = "GHSA-56pw-mpj4-fxww"
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
# Pillow vulnerable to Data Amplification attack.
[[IgnoredVulns]]
id = "CVE-2022-45198" # GHSA-m2vv-5vj5-2hm7
ignoreUntil = 2024-09-05
reason = "Only used internally, on trusted input. This tool is also scheduled for removal completely, so not worth trying to upgrade"
|
