{"id":"CVE-2022-22816","aliases":["ALPINE-CVE-2022-22816","ALSA-2022:0643","BIT-pillow-2022-22816","CLSA-2026-1789457556","DEBIAN-CVE-2022-22816","DLA-2893-1","DSA-5053-1","EUVD-2022-0200","GHSA-xrcv-f9gm-v42c","MGASA-2022-0166","OESA-2022-1526","PYSEC-2022-9","RHSA-2022:0609","RHSA-2022:0643","RHSA-2022:0665","RHSA-2022:0667","RHSA-2022:0669","RLSA-2022:0643","SUSE-SU-2022:1729-1","SUSE-SU-2024:1673-1","SUSE-SU-2024:1673-2","UBUNTU-CVE-2022-22816","USN-5227-1","USN-5227-2"],"status":"published","title":"Out-of-bounds Read in Pillow","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02064,"percentile":0.81509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-01-07T00:00:00Z","modified":"2026-11-03T08:02:40Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["9.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-pillow","fixed_in":["8.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-pillow","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"pillow","fixed_in":["9.0.0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["9.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["9.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["9.0.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","fixed_in":["2.3.0-1ubuntu3.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","fixed_in":["3.1.2-0ubuntu1.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pillow","fixed_in":["5.1.0-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pillow","fixed_in":["7.0.0-4ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pillow","fixed_in":["9.0.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"pillow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.0"},{"fixed":"8.4.0.post5+tuxcare"}]}],"versions":["8.4.0","8.4.0.post1+tuxcare","8.4.0.post2+tuxcare","8.4.0.post3+tuxcare","8.4.0.post4+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-4+deb9u4"}]}],"versions":["4.0.0-4","4.0.0-4+deb9u1","4.0.0-4+deb9u2","4.0.0-4+deb9u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-2+deb10u3"}]}],"versions":["5.4.1-2","5.4.1-2+deb10u1","5.4.1-2+deb10u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2+dfsg-0.3+deb11u1"}]}],"versions":["8.1.2+dfsg-0.3"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-8.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-8.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-8.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-23.gitd1c6db8.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-14.el8_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-13.el8_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-13.el8_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-13.el8_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-13.el8_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-13.el8_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-13.el8_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-18.el8_5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1644879908.8a641c1-3.13.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.35.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.38.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-4.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.36.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.41.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.37.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-6.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-150300.3.15.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-150300.3.15.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4+esm3"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4","2.3.0-1ubuntu3.4+esm1","2.3.0-1ubuntu3.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.6+esm1"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1","3.1.2-0ubuntu1.3","3.1.2-0ubuntu1.4","3.1.2-0ubuntu1.5","3.1.2-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.7"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1","5.1.0-1ubuntu0.2","5.1.0-1ubuntu0.3","5.1.0-1ubuntu0.4","5.1.0-1ubuntu0.5","5.1.0-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-4ubuntu0.5"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1","7.0.0-4ubuntu0.1","7.0.0-4ubuntu0.2","7.0.0-4ubuntu0.3","7.0.0-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pillow-python2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1-3~build1","6.2.1-3","6.2.1-3ubuntu0.1~esm1","6.2.1-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1"}]}],"versions":["8.1.2+dfsg-0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.7"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1","5.1.0-1ubuntu0.2","5.1.0-1ubuntu0.3","5.1.0-1ubuntu0.4","5.1.0-1ubuntu0.5","5.1.0-1ubuntu0.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-4ubuntu0.5"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1","7.0.0-4ubuntu0.1","7.0.0-4ubuntu0.2","7.0.0-4ubuntu0.3","7.0.0-4ubuntu0.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4+esm3"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4","2.3.0-1ubuntu3.4+esm1","2.3.0-1ubuntu3.4+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.6+esm1"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1","3.1.2-0ubuntu1.3","3.1.2-0ubuntu1.4","3.1.2-0ubuntu1.5","3.1.2-0ubuntu1.6"],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"python","product":"pillow"}],"references":[{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://www.debian.org/security/2022/dsa-5053","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202211-10","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22816","tags":["web","advisory"]},{"url":"https://github.com/python-pillow/Pillow/pull/5920","tags":["web"]},{"url":"https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xrcv-f9gm-v42c","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-22816","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-0643.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-22815","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-22816","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-22817","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22816.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-22816","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0166.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29887","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5227-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CK3IGXU77EQTXZAYI2PTIAI4XLFS7AFP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JR2LTB6KTUEU7YVPJ5MHA2GHOIL2JQQE/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0609","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042527","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0609.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22816","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22817","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0643","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0643.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22815","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0665","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0665.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0667","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0667.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0669","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0669.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0643","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1179534","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1186380","tags":["report"]},{"url":"https://bugzilla.suse.com/1189390","tags":["report"]},{"url":"https://bugzilla.suse.com/1189794","tags":["report"]},{"url":"https://bugzilla.suse.com/1192070","tags":["report"]},{"url":"https://bugzilla.suse.com/1192073","tags":["report"]},{"url":"https://bugzilla.suse.com/1192075","tags":["report"]},{"url":"https://bugzilla.suse.com/1193597","tags":["report"]},{"url":"https://bugzilla.suse.com/1193688","tags":["report"]},{"url":"https://bugzilla.suse.com/1193752","tags":["report"]},{"url":"https://bugzilla.suse.com/1194521","tags":["report"]},{"url":"https://bugzilla.suse.com/1194551","tags":["report"]},{"url":"https://bugzilla.suse.com/1194552","tags":["report"]},{"url":"https://bugzilla.suse.com/1194952","tags":["report"]},{"url":"https://bugzilla.suse.com/1194954","tags":["report"]},{"url":"https://bugzilla.suse.com/1199138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29970","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241673-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180833","tags":["report"]},{"url":"https://bugzilla.suse.com/1183101","tags":["report"]},{"url":"https://bugzilla.suse.com/1183102","tags":["report"]},{"url":"https://bugzilla.suse.com/1183103","tags":["report"]},{"url":"https://bugzilla.suse.com/1183105","tags":["report"]},{"url":"https://bugzilla.suse.com/1183107","tags":["report"]},{"url":"https://bugzilla.suse.com/1183108","tags":["report"]},{"url":"https://bugzilla.suse.com/1183110","tags":["report"]},{"url":"https://bugzilla.suse.com/1188574","tags":["report"]},{"url":"https://bugzilla.suse.com/1190229","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34552","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241673-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-22816","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5227-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22817","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-07T00:00:00Z","modified":"2024-08-03T03:21:49.162Z","updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-0200","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-07T00:00:00Z","modified":"2024-08-03T03:21:49Z","updated_at":"2026-11-03T03:25:52.201883Z"}],"ghsa":[{"id":"GHSA-xrcv-f9gm-v42c","title":"Out-of-bounds Read in Pillow","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-12T20:07:41Z","modified":"2024-10-11T21:27:30Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-10T14:12:54.813Z","modified":"2026-06-17T04:29:05.357Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"ALPINE-CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-10T14:12:54.813Z","modified":"2026-11-03T07:31:13.927615608Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"DEBIAN-CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-10T14:12:54.813Z","modified":"2026-11-03T08:02:40.5863979Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-xrcv-f9gm-v42c","title":"Out-of-bounds Read in Pillow","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-12T20:07:41Z","modified":"2024-10-14T18:38:42.596412Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"OESA-2022-1526","title":"python-pillow security update","description":"Python image processing library.\r\n\r\nSecurity Fix(es):\r\n\r\npath_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.(CVE-2022-22816)\r\n\r\nPIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.(CVE-2022-22817)\r\n\r\npath_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.(CVE-2022-22815)","status":"published","published":"2022-02-14T11:04:48Z","modified":"2026-08-18T01:16:26.492666191Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:0609","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T01:25:47Z","modified":"2026-06-29T10:40:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0643","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T01:25:40Z","modified":"2026-06-29T10:40:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0665","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T01:25:55Z","modified":"2026-06-29T10:40:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0667","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T01:26:04Z","modified":"2026-06-29T10:40:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0669","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T01:26:12Z","modified":"2026-06-29T10:40:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2022:0643","title":"Important: python-pillow security update","description":"The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions (CVE-2022-22817)\n\n* python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c (CVE-2022-22816)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-22T17:25:31Z","modified":"2026-02-04T16:00:11.162667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-10T14:12:00Z","modified":"2026-02-04T04:31:58.472647Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"ALSA-2022:0643","title":"Important: python-pillow security update","description":"The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions (CVE-2022-22817)\n\n* python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c (CVE-2022-22816)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-22T17:25:31Z","modified":"2026-10-29T11:12:07.12167036Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-pillow-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2024-03-06T11:02:41.798Z","modified":"2026-09-08T08:48:18.513528713Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2026-1789457556","title":"TuxCare security update for pillow (3 CVEs)","description":"TuxCare rebuilt pillow to address 3 CVEs. Fixed in 8.4.0.post5+tuxcare.","status":"published","published":"2026-09-15T07:32:36Z","modified":"2026-10-15T09:48:01.723436246Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-07T00:00:00Z","modified":"2026-10-28T02:31:14.593303804Z","updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DLA-2893-1","title":"pillow - security update","status":"published","published":"2022-01-23T00:00:00Z","modified":"2026-03-09T01:23:36.618468Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5053-1","title":"pillow - security update","status":"published","published":"2022-01-21T00:00:00Z","modified":"2026-03-09T02:10:55.641217Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0166","title":"Updated python-pillow packages fix security vulnerability","description":"path_getbbox in path.c in Pillow before 9.0.0 improperly initializes\nImagePath.Path. (CVE-2022-22815)\npath_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read\nduring initialization of ImagePath.Path. (CVE-2022-22816)\nPIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary\nexpressions (CVE-2022-22817)\nPillow before 9.0.1 allows attackers to delete files because spaces in\ntemporary pathnames are mishandled. (CVE-2022-24303)\n","status":"published","published":"2022-05-12T10:24:45Z","modified":"2026-04-16T04:42:24.042979703Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"PYSEC-2022-9","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","status":"published","published":"2022-01-10T14:12:00Z","modified":"2023-12-06T01:01:58.105368Z","updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"SUSE-SU-2022:1729-1","title":"Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud","description":"This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:\n\nSecurity fixes included on the update:\n\nardana-barbican:\n\n- Update policies to protect container secret access (SOC-11621)\n- Update policies to protect secret metadata access (SOC-11620)\n\nopenstack-neutron:\n\n- CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).\n\nrubygem-sinatra:\n\n- CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).\n\npython-XStatic-jquery-ui:\n\n- CVE-2021-41182: Fixed XSS in the `altField` option of the Datepicker widget (bsc#1192070)\n- CVE-2021-41183: Fixed XSS in the `of` option of the `.position()` util (bsc#1192073)\n- CVE-2021-41184: Fixed XSS in `*Text` options of the Datepicker widget (bsc#1192075)\n\npython-lxml:\n\n- CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).\n- CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).\n- CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).\n- CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).\n\nopenstack-barbican:\n\n- CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).\n- CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).\n\ngrafana:\n\n- CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).\n\nopenstack-keystone:\n\n- CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).\n\nNon-security fixes included on the update:\n\nChanges in ardana-barbican:\n- Update to version 9.0+git.1644879908.8a641c1:\n  * Update policies to protect container secret access (SOC-11621)\n\n- Update to version 9.0+git.1643052417.9a3348e:\n  * update policies to protect secret metadata access (SOC-11620)\n\nChanges in grafana:\n- Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)\n  * directory traversal vulnerability for .md files \n\n- Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)\n  * Fix Go net/http: limit growth of header canonicalization cache\n\nChanges in openstack-barbican:\n- Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch\n  and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix\n  the legacy policy rules for adding a secret to a container and removing\n  a secret from a container. bsc#1194954,CVE-2022-23452\n\n- Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the\n  legacy policy rules for accessing secret metadata by checking that\n  the user making the request is authenticated for the project that\n  owns the secret. bsc#1194952,CVE-2022-23451\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-14.0.1.dev4:\n  * Add support for yoga\n\n- Update to version group-based-policy-automation-14.0.1.dev3:\n  * Python2/3 compatibility fixes\n\n- Update to version group-based-policy-automation-14.0.1.dev2:\n  * Add support for xena\n\n- Update to version group-based-policy-automation-14.0.1.dev1:\n  * Remove py27 from gate jobs\n  14.0.0\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-14.0.1.dev3:\n  * Add support for yoga\n\n- Update to version group-based-policy-ui-14.0.1.dev2:\n  * Python2/3 compatibility changes\n\n- Update to version group-based-policy-ui-14.0.1.dev1:\n  * Add support for xena\n  14.0.0\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-keystone:\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-keystone:\n- Add patch (0001-Hide-AccountLocked-exception-from-end-users.patch) to fix\n  the problem where AccountLocked exception discloses sensitive information.\n  bsc#1189390,CVE-2021-38155\n\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-14.0.1.dev33:\n  * Populate network mtu for erspan\n\n- Update to version group-based-policy-14.0.1.dev32:\n  * ERSPAN config error when Openstack port is created in a different project than network it belongs to\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev31:\n  * Python2/3 compatibility fixes\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev29:\n  * Fix oslo\\_i18n usage\n\n- Update to version group-based-policy-14.0.1.dev27:\n  * Update mechanism\\_driver cache\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev26:\n  * Add support for xena\n\n- Update to version group-based-policy-14.0.1.dev24:\n  * update\\_floatingip\\_status\\_while\\_deleting\\_the\\_vm\n\n- Update to version group-based-policy-14.0.1.dev22:\n  * Updating host id by appending pid in existing host id\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev20:\n  * Revert 'Add workaround to get\\_subnets'\n\nChanges in python-lxml:\n- Fix bsc#1179534 (CVE-2020-27783)\n  mXSS due to the use of improper parser \n  Patch files: 0001-CVE-2020-27783.patch 0002-CVE-2020-27783.patch\n- Fix bsc#1118088 (CVE-2018-19787)\n  lxml/html/clean.py in the lxml.html.clean module does not remove\n  javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks\n  Patch file: 0001-CVE-2018-19787.patch\n- Fix bsc#1184177 (CVE-2021-28957)\n  missing input sanitization for formaction HTML5 attributes may lead to XSS\n  Patch file: 0001-CVE-2021-28957.patch\n- Fix bsc#1193752 (CVE-2021-43818)\n  Cleaner: Remove SVG image data URLs since they can embed script content.\n  Reported as GHSL-2021-1037 and GHSL-2021-1038 \n  Patch files 0001-CVE-2021-43818.patch 0002-CVE-2021-43818.patch\n\nChanges in openstack-neutron-doc:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Remove cve-2021-40085-stable-rocky.patch (merged upstream)\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Add cve-2021-40085-stable-rocky.patch (bsc#1189794, CVE-2021-40085) \n  * Remove dhcp_extra_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in python-Pillow:\n- Add 030-CVE-2022-22817.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22817, bsc#1194521 \n   * test from upstream updated for python2\n\n- Add 028-CVE-2022-22815.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22815, bsc#1194552\n- Add 029-CVE-2022-22816.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22816, bsc#1194551\n\nChanges in python-XStatic-jquery-ui:\n- Update to version 1.13.0.1 (bsc#1192070, CVE-2021-41182, bsc#1192073,\n  CVE-2021-41184, bsc#1192075,  CVE-2021-41183)\n    * Fix XSS in the altField option of the Datepicker widget \n     (CVE-2021-41182)\n    * Fix XSS in *Text options of the Datepicker widget\n     (CVE-2021-41183)\n    * Fix XSS in the of option of the .position() util\n      (CVE-2021-41184)\n    * Drop support for Query 1.7\n    * Accordion: allow function parameter for selecting header\n      elements\n    * Datepicker: add optional onUpdateDatepicker callback\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20220413:\n  * Update release notes to indicate support for SES7\n- Update to version 9.20220112:\n  * Add reference to keystone bcrypt issue to known limitations (bsc#1186380)\n\nChanges in rubygem-sinatra:\n- Add CVE-2022-29970.patch (bsc#1199138, CVE-2022-29970)\n\n  ","status":"published","published":"2022-05-18T14:55:52Z","modified":"2026-02-04T03:56:30.500919Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2024:1673-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)\n- Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)\n- Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)\n- Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)\n- Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)\n- Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)\n- Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)\n- Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)\n- OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)\n","status":"published","published":"2024-05-17T07:30:17Z","modified":"2026-02-04T02:30:30.558488Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1673-2","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)\n- Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)\n- Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)\n- Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)\n- Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)\n- Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)\n- Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)\n- Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)\n- OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)\n","status":"published","published":"2024-06-13T09:22:50Z","modified":"2026-02-04T02:21:47.288276Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-5227-1","title":"pillow vulnerabilities","description":"It was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to hang, resulting in a denial\nof service. (CVE-2021-23437)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 21.04. (CVE-2021-34552)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2022-22815)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service. (CVE-2022-22816)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2022-22817)\n","status":"published","published":"2022-01-13T13:26:09Z","modified":"2026-04-27T16:20:57.391935Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5227-2","title":"pillow vulnerabilities","description":"USN-5227-1 fixed several vulnerabilities in Pillow. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to hang, resulting in a denial\n of service. (CVE-2021-23437)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\n Ubuntu 21.04. (CVE-2021-34552)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service, or possibly execute arbitrary code. (CVE-2022-22815)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service. (CVE-2022-22816)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service, or possibly execute arbitrary code. (CVE-2022-22817)\n","status":"published","published":"2022-01-17T13:14:11Z","modified":"2026-06-29T13:49:35.559949571Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}