{"id":"GHSA-94vc-p8w7-5p49","aliases":[],"status":"published","title":"Bundled libwebp in imagecodecs vulnerable","description":"imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-10-05T00:07:46Z","modified":"2024-11-28T05:41:59Z","fixes":[{"ecosystem":"PyPI","package":"imagecodecs","fixed_in":["2023.9.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"imagecodecs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.9.18"}]}]},{"source":"osv","ecosystem":"PyPI","package":"imagecodecs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.9.18"}]}],"versions":["2018.10.10","2018.10.18","2018.10.22","2018.10.28","2018.10.30","2018.11.8","2018.12.1","2018.12.12","2018.12.16","2019.1.1","2019.1.14","2019.11.18","2019.11.28","2019.11.5","2019.12.31","2019.2.2","2019.2.20","2019.2.22","2019.4.20","2020.1.31","2020.12.24","2020.2.18","2020.5.30","2021.1.11","2021.1.28","2021.11.11","2021.11.20","2021.2.26","2021.3.31","2021.4.28","2021.6.8","2021.7.30","2021.8.26","2022.12.22","2022.12.24","2022.2.22","2022.7.27","2022.7.31","2022.8.8","2022.9.26","2023.1.23","2023.3.16","2023.7.10","2023.7.4","2023.8.12","2023.9.4"]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129","tags":["advisory"]},{"url":"https://github.com/cgohlke/imagecodecs/blob/v2023.9.18/CHANGES.rst","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/imagecodecs/PYSEC-2023-174.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-94vc-p8w7-5p49"},{"url":"https://github.com/cgohlke/imagecodecs","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-94vc-p8w7-5p49","title":"Bundled libwebp in imagecodecs vulnerable","description":"imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.","status":"published","published":"2023-10-05T00:07:46Z","modified":"2023-10-05T00:07:46Z","updated_at":"2026-11-02T14:37:07.641671Z"}],"osv":[{"id":"GHSA-94vc-p8w7-5p49","title":"Bundled libwebp in imagecodecs vulnerable","description":"imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.","status":"published","published":"2023-10-05T00:07:46Z","modified":"2024-11-28T05:41:59.007222Z","updated_at":"2026-11-02T15:46:43.123867Z"}]}}