diff --git a/advisories/github-reviewed/2021/03/GHSA-3wvg-mj6g-m9cv/GHSA-3wvg-mj6g-m9cv.json b/advisories/github-reviewed/2021/03/GHSA-3wvg-mj6g-m9cv/GHSA-3wvg-mj6g-m9cv.json index ec6225cc328..90bb703596f 100644 --- a/advisories/github-reviewed/2021/03/GHSA-3wvg-mj6g-m9cv/GHSA-3wvg-mj6g-m9cv.json +++ b/advisories/github-reviewed/2021/03/GHSA-3wvg-mj6g-m9cv/GHSA-3wvg-mj6g-m9cv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3wvg-mj6g-m9cv", - "modified": "2024-04-03T20:35:13Z", + "modified": "2024-10-08T13:02:18Z", "published": "2021-03-18T19:55:21Z", "aliases": [ "CVE-2021-27922" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -44,6 +48,14 @@ "type": "WEB", "url": "https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-3wvg-mj6g-m9cv" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-41.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/python-pillow/Pillow" diff --git a/advisories/github-reviewed/2021/03/GHSA-f4w8-cv6p-x6r5/GHSA-f4w8-cv6p-x6r5.json b/advisories/github-reviewed/2021/03/GHSA-f4w8-cv6p-x6r5/GHSA-f4w8-cv6p-x6r5.json index 8108f03aa68..33619e9e1b5 100644 --- a/advisories/github-reviewed/2021/03/GHSA-f4w8-cv6p-x6r5/GHSA-f4w8-cv6p-x6r5.json +++ b/advisories/github-reviewed/2021/03/GHSA-f4w8-cv6p-x6r5/GHSA-f4w8-cv6p-x6r5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f4w8-cv6p-x6r5", - "modified": "2024-04-03T20:35:55Z", + "modified": "2024-10-08T13:01:53Z", "published": "2021-03-18T19:55:13Z", "aliases": [ "CVE-2021-27921" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -44,6 +48,14 @@ "type": "WEB", "url": "https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-f4w8-cv6p-x6r5" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-40.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/python-pillow/Pillow" diff --git a/advisories/github-reviewed/2021/11/GHSA-p49h-hjvm-jg3h/GHSA-p49h-hjvm-jg3h.json b/advisories/github-reviewed/2021/11/GHSA-p49h-hjvm-jg3h/GHSA-p49h-hjvm-jg3h.json index 42380567754..1dcd30956d4 100644 --- a/advisories/github-reviewed/2021/11/GHSA-p49h-hjvm-jg3h/GHSA-p49h-hjvm-jg3h.json +++ b/advisories/github-reviewed/2021/11/GHSA-p49h-hjvm-jg3h/GHSA-p49h-hjvm-jg3h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p49h-hjvm-jg3h", - "modified": "2021-11-03T17:28:10Z", + "modified": "2024-10-08T13:03:01Z", "published": "2021-11-03T18:05:04Z", "aliases": [ "CVE-2020-5312" @@ -12,13 +12,17 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "Pillow" + "name": "pillow" }, "ranges": [ { @@ -46,47 +50,7 @@ }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2020:0566" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2020:0578" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2020:0580" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2020:0681" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2020:0683" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2020:0694" - }, - { - "type": "WEB", - "url": "https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml" - }, - { - "type": "PACKAGE", - "url": "https://github.com/python-pillow/Pillow" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P" - }, - { - "type": "WEB", - "url": "https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html" + "url": "https://www.debian.org/security/2020/dsa-4631" }, { "type": "WEB", @@ -94,14 +58,62 @@ }, { "type": "WEB", - "url": "https://www.debian.org/security/2020/dsa-4631" + "url": "https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A" + }, + { + "type": "PACKAGE", + "url": "https://github.com/python-pillow/Pillow" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-p49h-hjvm-jg3h" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2020:0694" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2020:0681" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2020:0580" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2020:0578" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2020:0566" } ], "database_specific": { "cwe_ids": [ "CWE-120" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2021-11-03T17:28:10Z", "nvd_published_at": "2020-01-03T01:15:00Z" diff --git a/advisories/github-reviewed/2021/11/GHSA-vcqg-3p29-xw73/GHSA-vcqg-3p29-xw73.json b/advisories/github-reviewed/2021/11/GHSA-vcqg-3p29-xw73/GHSA-vcqg-3p29-xw73.json index 4ad7ec64595..7ce15453d20 100644 --- a/advisories/github-reviewed/2021/11/GHSA-vcqg-3p29-xw73/GHSA-vcqg-3p29-xw73.json +++ b/advisories/github-reviewed/2021/11/GHSA-vcqg-3p29-xw73/GHSA-vcqg-3p29-xw73.json @@ -1,24 +1,28 @@ { "schema_version": "1.4.0", "id": "GHSA-vcqg-3p29-xw73", - "modified": "2023-01-24T18:07:16Z", + "modified": "2024-10-08T13:03:45Z", "published": "2021-11-03T18:04:41Z", "aliases": [ "CVE-2020-5310" ], "summary": "Integer overflow in Pillow", - "details": "libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.", + "details": "`libImaging/TiffDecode.c` in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "Pillow" + "name": "pillow" }, "ranges": [ { @@ -44,6 +48,14 @@ "type": "WEB", "url": "https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-vcqg-3p29-xw73" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml" + }, { "type": "WEB", "url": "https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml" @@ -73,7 +85,7 @@ "cwe_ids": [ "CWE-190" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2021-11-03T17:23:34Z", "nvd_published_at": "2020-01-03T01:15:00Z" diff --git a/advisories/github-reviewed/2022/05/GHSA-r7rm-8j6h-r933/GHSA-r7rm-8j6h-r933.json b/advisories/github-reviewed/2022/05/GHSA-r7rm-8j6h-r933/GHSA-r7rm-8j6h-r933.json index e33f1d3f153..dac6ece95a0 100644 --- a/advisories/github-reviewed/2022/05/GHSA-r7rm-8j6h-r933/GHSA-r7rm-8j6h-r933.json +++ b/advisories/github-reviewed/2022/05/GHSA-r7rm-8j6h-r933/GHSA-r7rm-8j6h-r933.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r7rm-8j6h-r933", - "modified": "2023-09-05T09:18:49Z", + "modified": "2024-10-08T13:04:08Z", "published": "2022-05-24T17:05:33Z", "aliases": [ "CVE-2020-5311" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [