machinelearningexercises's People
machinelearningexercises's Issues
CVE-2020-6816 (Medium) detected in bleach-3.1.0-py2.py3-none-any.whl
CVE-2020-6816 - Medium Severity Vulnerability
Vulnerable Library - bleach-3.1.0-py2.py3-none-any.whl
An easy safelist-based HTML-sanitizing tool.
Library home page: https://files.pythonhosted.org/packages/ab/05/27e1466475e816d3001efb6e0a85a819be17411420494a1e602c36f8299d/bleach-3.1.0-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ bleach-3.1.0-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
Publish Date: 2020-03-24
URL: CVE-2020-6816
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-m6xf-fq7q-8743
Release Date: 2020-03-24
Fix Resolution: bleach - 3.1.2
Step up your Open Source Security Game with WhiteSource here
CVE-2021-28675 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-28675 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
Publish Date: 2021-06-02
URL: CVE-2021-28675
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28675
Release Date: 2021-06-02
Fix Resolution: Pillow - 8.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-10379 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-10379 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
Publish Date: 2020-06-25
URL: CVE-2020-10379
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: python-pillow/Pillow@41b554b
Release Date: 2020-06-25
Fix Resolution: 7.1.0
Step up your Open Source Security Game with WhiteSource here
CVE-2021-27922 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-27922 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
Publish Date: 2021-03-03
URL: CVE-2021-27922
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
Release Date: 2021-03-03
Fix Resolution: Pillow - 8.1.2
Step up your Open Source Security Game with WhiteSource here
CVE-2019-11236 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl
CVE-2019-11236 - Medium Severity Vulnerability
Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
Publish Date: 2019-04-15
URL: CVE-2019-11236
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11236
Release Date: 2019-04-15
Fix Resolution: 1.24.3
Step up your Open Source Security Game with WhiteSource here
Ça va ?
01 est bon
01/
est plutôt bien fait, surtout les régression linéaires sont bien présentées.
CVE-2021-25291 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25291 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
Publish Date: 2021-03-19
URL: CVE-2021-25291
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Date: 2021-01-18
Fix Resolution: 8.1.1
Step up your Open Source Security Game with WhiteSource here
CVE-2020-26215 (Medium) detected in notebook-5.7.8-py2.py3-none-any.whl
CVE-2020-26215 - Medium Severity Vulnerability
Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl
A web-based notebook environment for interactive computing
Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.
Publish Date: 2020-11-18
URL: CVE-2020-26215
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-c7vm-f5p4-8fqh
Release Date: 2020-11-18
Fix Resolution: 6.1.5
Step up your Open Source Security Game with WhiteSource here
02 par contre...
Tu n'as pas vraiment expliqué ce que tu faisais dans 02/
. En outre,
╰ vagrant@ubuntu-xenial:02 $ python gradient_descent_w_scikit.py
Traceback (most recent call last):
File "gradient_descent_w_scikit.py", line 7, in <module>
df = pd.read_csv("exercices/01/Consumo_cerveja.csv")
File "/home/vagrant/venv/lib/python3.5/site-packages/pandas/io/parsers.py", line 702, in parser_f
return _read(filepath_or_buffer, kwds)
File "/home/vagrant/venv/lib/python3.5/site-packages/pandas/io/parsers.py", line 429, in _read
parser = TextFileReader(filepath_or_buffer, **kwds)
File "/home/vagrant/venv/lib/python3.5/site-packages/pandas/io/parsers.py", line 895, in __init__
self._make_engine(self.engine)
File "/home/vagrant/venv/lib/python3.5/site-packages/pandas/io/parsers.py", line 1122, in _make_engine
self._engine = CParserWrapper(self.f, **self.options)
File "/home/vagrant/venv/lib/python3.5/site-packages/pandas/io/parsers.py", line 1853, in __init__
self._reader = parsers.TextReader(src, **kwds)
File "pandas/_libs/parsers.pyx", line 387, in pandas._libs.parsers.TextReader.__cinit__
File "pandas/_libs/parsers.pyx", line 705, in pandas._libs.parsers.TextReader._setup_parser_source
FileNotFoundError: [Errno 2] File b'exercices/01/Consumo_cerveja.csv' does not exist: b'exercices/01/Consumo_cerveja.csv'
╭╴ (master=) [virt]╶╮
╰ 1, vagrant@ubuntu-xenial:02 $
WS-2021-0011 (Medium) detected in bleach-3.1.0-py2.py3-none-any.whl
WS-2021-0011 - Medium Severity Vulnerability
Vulnerable Library - bleach-3.1.0-py2.py3-none-any.whl
An easy safelist-based HTML-sanitizing tool.
Library home page: https://files.pythonhosted.org/packages/ab/05/27e1466475e816d3001efb6e0a85a819be17411420494a1e602c36f8299d/bleach-3.1.0-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ bleach-3.1.0-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
In Mozilla Bleach before 3.3.0, a mutation XSS in bleach.clean when p, br, style, title, noscript, script, textarea, noframes, iframe, or xmp and either svg or math tags are whitelisted and the keyword argument strip_comments=False.
Publish Date: 2021-02-01
URL: WS-2021-0011
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-vv2x-vrpj-qqpq
Release Date: 2021-02-01
Fix Resolution: bleach - 3.3.0
Step up your Open Source Security Game with WhiteSource here
CVE-2021-25292 (Medium) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25292 - Medium Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
Publish Date: 2021-03-19
URL: CVE-2021-25292
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Date: 2021-01-18
Fix Resolution: 8.1.1
Step up your Open Source Security Game with WhiteSource here
CVE-2020-26137 (Medium) detected in urllib3-1.24.3-py2.py3-none-any.whl, urllib3-1.24.2-py2.py3-none-any.whl
CVE-2020-26137 - Medium Severity Vulnerability
Vulnerable Libraries - urllib3-1.24.3-py2.py3-none-any.whl, urllib3-1.24.2-py2.py3-none-any.whl
urllib3-1.24.3-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/01/11/525b02e4acc0c747de8b6ccdab376331597c569c42ea66ab0a1dbd36eca2/urllib3-1.24.3-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ urllib3-1.24.3-py2.py3-none-any.whl (Vulnerable Library)
urllib3-1.24.2-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Publish Date: 2020-09-30
URL: CVE-2020-26137
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137
Release Date: 2020-09-30
Fix Resolution: 1.25.9
Step up your Open Source Security Game with WhiteSource here
CVE-2020-10378 (Medium) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-10378 - Medium Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
Publish Date: 2020-06-25
URL: CVE-2020-10378
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: python-pillow/Pillow@41b554b
Release Date: 2020-06-25
Fix Resolution: 7.1.0
Step up your Open Source Security Game with WhiteSource here
Action Required: Fix Mend Configuration File - .whitesource
There is an error with this repository's Mend configuration file that needs to be fixed. As a precaution, scans will stop until it is resolved.
Errors:
- Failed to parse configuration file: Killy85/MachineLearningExercises/.whitesource: failed to parse JSON content
08 - Displaying the neurons memory
So what I was trying to achieve was to display the memory inside the neurons during the training of a perceptron
algorithm.
@JeffAbrahamson : Is that something like that you were waiting for? Any ideas on how to enhance it?
You may have to ensure opencv is installed.
CVE-2019-19911 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2019-19911 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Publish Date: 2020-01-05
URL: CVE-2019-19911
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/python-pillow/Pillow/tree/6.2.2
Release Date: 2020-01-05
Fix Resolution: Pillow - 6.2.2
Step up your Open Source Security Game with WhiteSource here
Explique ton code
Suggestion générale : commente ton code et organise en fonction. Utilise pylint.
https://stackoverflow.com/questions/356161/python-coding-standards-best-practices#356238
En outre, utilise quelque chose comme ceci :
def main():
"""...
"""
if __name__ == "__main__":
main()
CVE-2021-28678 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-28678 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Publish Date: 2021-06-02
URL: CVE-2021-28678
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28678
Release Date: 2021-06-02
Fix Resolution: Pillow - 8.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2021-25288 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25288 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
Publish Date: 2021-06-02
URL: CVE-2021-25288
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25288
Release Date: 2021-06-02
Fix Resolution: Pillow - 8.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2021-25293 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25293 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
Publish Date: 2021-03-19
URL: CVE-2021-25293
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Date: 2021-01-18
Fix Resolution: 8.1.1
Step up your Open Source Security Game with WhiteSource here
CVE-2020-35653 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-35653 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
Publish Date: 2021-01-12
URL: CVE-2020-35653
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35653
Release Date: 2021-01-12
Fix Resolution: 8.1.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-6802 (Medium) detected in bleach-3.1.0-py2.py3-none-any.whl
CVE-2020-6802 - Medium Severity Vulnerability
Vulnerable Library - bleach-3.1.0-py2.py3-none-any.whl
An easy safelist-based HTML-sanitizing tool.
Library home page: https://files.pythonhosted.org/packages/ab/05/27e1466475e816d3001efb6e0a85a819be17411420494a1e602c36f8299d/bleach-3.1.0-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ bleach-3.1.0-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
Publish Date: 2020-03-24
URL: CVE-2020-6802
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-q65m-pv3f-wr5r
Release Date: 2020-03-08
Fix Resolution: 3.1.1
Step up your Open Source Security Game with WhiteSource here
et puis 03/
╭╴ (master=) [virt]╶╮
╰ vagrant@ubuntu-xenial:03 $ python logistic_regression.py
File "logistic_regression.py", line 61
Precision {precision:.2f}% \n Recall {recall:.2f}% \n F1 measure {f_measure:.2f}%\n Correctness {prct:.2f}%""")
^
SyntaxError: invalid syntax
╭╴ (master=) [virt]╶╮
╰ 1, vagrant@ubuntu-xenial:03 $
CVE-2020-10177 (Medium) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-10177 - Medium Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
Publish Date: 2020-06-25
URL: CVE-2020-10177
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: python-pillow/Pillow@41b554b
Release Date: 2020-06-25
Fix Resolution: 7.1.0
Step up your Open Source Security Game with WhiteSource here
CVE-2019-12760 (High) detected in parso-0.4.0-py2.py3-none-any.whl, parso-0.3.4-py2.py3-none-any.whl
CVE-2019-12760 - High Severity Vulnerability
Vulnerable Libraries - parso-0.4.0-py2.py3-none-any.whl, parso-0.3.4-py2.py3-none-any.whl
parso-0.4.0-py2.py3-none-any.whl
A Python Parser
Library home page: https://files.pythonhosted.org/packages/a7/bd/e2f4753c5fa93932899243b4299011a757ac212e9bc8ddf062f38df4e78b/parso-0.4.0-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ parso-0.4.0-py2.py3-none-any.whl (Vulnerable Library)
parso-0.3.4-py2.py3-none-any.whl
A Python Parser
Library home page: https://files.pythonhosted.org/packages/19/b1/522b2671cc6d134c9d3f5dfc0d02fee07cab848e908d03d2bffea78cca8f/parso-0.3.4-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ parso-0.3.4-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration."
Publish Date: 2019-06-06
URL: CVE-2019-12760
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with WhiteSource here
CVE-2021-25290 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25290 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
Publish Date: 2021-03-19
URL: CVE-2021-25290
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Date: 2021-01-18
Fix Resolution: 8.1.1
Step up your Open Source Security Game with WhiteSource here
CVE-2021-27291 (High) detected in Pygments-2.3.1-py2.py3-none-any.whl
CVE-2021-27291 - High Severity Vulnerability
Vulnerable Library - Pygments-2.3.1-py2.py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/13/e5/6d710c9cf96c31ac82657bcfb441df328b22df8564d58d0c4cd62612674c/Pygments-2.3.1-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ Pygments-2.3.1-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
Publish Date: 2021-03-17
URL: CVE-2021-27291
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/pygments/pygments/releases/tag/2.7.4
Release Date: 2021-03-17
Fix Resolution: Pygments - 2.7.4
Step up your Open Source Security Game with WhiteSource here
CVE-2019-16865 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2019-16865 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Publish Date: 2019-10-04
URL: CVE-2019-16865
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865
Release Date: 2019-10-04
Fix Resolution: 6.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2019-9740 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl
CVE-2019-9740 - Medium Severity Vulnerability
Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
Publish Date: 2019-03-13
URL: CVE-2019-9740
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740
Release Date: 2020-11-02
Fix Resolution: v2.7.17,v3.5.8,v3.6.9,3.7.4,3.7.5
Step up your Open Source Security Game with WhiteSource here
CVE-2020-35654 (High) detected in Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-35654 - High Severity Vulnerability
Vulnerable Library - Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
Publish Date: 2021-01-12
URL: CVE-2020-35654
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35654
Release Date: 2021-01-12
Fix Resolution: 8.1.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-13091 (High) detected in pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-13091 - High Severity Vulnerability
Vulnerable Library - pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl
Powerful data structures for data analysis, time series, and statistics
Library home page: https://files.pythonhosted.org/packages/db/83/7d4008ffc2988066ff37f6a0bb6d7b60822367dcb36ba5e39aa7801fda54/pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.
Publish Date: 2020-05-15
URL: CVE-2020-13091
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with WhiteSource here
CVE-2021-25287 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25287 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
Publish Date: 2021-06-02
URL: CVE-2021-25287
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25287
Release Date: 2021-06-02
Fix Resolution: Pillow - 8.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2021-27923 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-27923 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Publish Date: 2021-03-03
URL: CVE-2021-27923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
Release Date: 2021-03-03
Fix Resolution: Pillow - 8.1.2
Step up your Open Source Security Game with WhiteSource here
CVE-2020-11538 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-11538 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Publish Date: 2020-06-25
URL: CVE-2020-11538
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: python-pillow/Pillow@41b554b
Release Date: 2020-06-25
Fix Resolution: 7.1.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-35655 (Medium) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-35655 - Medium Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
Publish Date: 2021-01-12
URL: CVE-2020-35655
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35655
Release Date: 2021-01-12
Fix Resolution: 8.1.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-13757 (High) detected in rsa-4.0-py2.py3-none-any.whl
CVE-2020-13757 - High Severity Vulnerability
Vulnerable Library - rsa-4.0-py2.py3-none-any.whl
Pure-Python RSA implementation
Library home page: https://files.pythonhosted.org/packages/02/e5/38518af393f7c214357079ce67a317307936896e961e35450b70fad2a9cf/rsa-4.0-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ rsa-4.0-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
Publish Date: 2020-06-01
URL: CVE-2020-13757
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: sybrenstuvel/python-rsa@3283b12
Release Date: 2020-06-01
Fix Resolution: rsa - 4.1
Step up your Open Source Security Game with WhiteSource here
CVE-2021-20270 (High) detected in Pygments-2.3.1-py2.py3-none-any.whl
CVE-2021-20270 - High Severity Vulnerability
Vulnerable Library - Pygments-2.3.1-py2.py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/13/e5/6d710c9cf96c31ac82657bcfb441df328b22df8564d58d0c4cd62612674c/Pygments-2.3.1-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ Pygments-2.3.1-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Publish Date: 2021-03-23
URL: CVE-2021-20270
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-9w8r-397f-prfh
Release Date: 2021-03-23
Fix Resolution: Pygments - 20.12.3
Step up your Open Source Security Game with WhiteSource here
CVE-2021-28676 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-28676 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Publish Date: 2021-06-02
URL: CVE-2021-28676
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28676
Release Date: 2021-06-02
Fix Resolution: Pillow - 8.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-5310 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-5310 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
Publish Date: 2020-01-03
URL: CVE-2020-5310
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5310
Release Date: 2020-01-03
Fix Resolution: Pillow - 6.2.2
Step up your Open Source Security Game with WhiteSource here
CVE-2021-27921 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-27921 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
Publish Date: 2021-03-03
URL: CVE-2021-27921
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
Release Date: 2021-03-03
Fix Resolution: Pillow - 8.1.2
Step up your Open Source Security Game with WhiteSource here
CVE-2020-10994 (Medium) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-10994 - Medium Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
Publish Date: 2020-06-25
URL: CVE-2020-10994
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: python-pillow/Pillow@41b554b
Release Date: 2020-06-25
Fix Resolution: 7.1.0
Step up your Open Source Security Game with WhiteSource here
Action Required: Fix WhiteSource Configuration File - .whitesource
There is an error with this repository's WhiteSource configuration file that needs to be fixed. As a precaution, scans will stop until it is resolved.
Errors:
- Failed to parse configuration file: Killy85/MachineLearningExercises/.whitesource: Expected a com.google.gson.JsonObject but was com.google.gson.JsonPrimitive
CVE-2021-28677 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-28677 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Publish Date: 2021-06-02
URL: CVE-2021-28677
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28677
Release Date: 2021-06-02
Fix Resolution: Pillow - 8.2.0
Step up your Open Source Security Game with WhiteSource here
CVE-2020-5313 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-5313 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
Publish Date: 2020-01-03
URL: CVE-2020-5313
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313
Release Date: 2020-01-03
Fix Resolution: Pillow - 6.2.2
Step up your Open Source Security Game with WhiteSource here
CVE-2020-25658 (Medium) detected in rsa-4.0-py2.py3-none-any.whl
CVE-2020-25658 - Medium Severity Vulnerability
Vulnerable Library - rsa-4.0-py2.py3-none-any.whl
Pure-Python RSA implementation
Library home page: https://files.pythonhosted.org/packages/02/e5/38518af393f7c214357079ce67a317307936896e961e35450b70fad2a9cf/rsa-4.0-py2.py3-none-any.whl
Dependency Hierarchy:
- ❌ rsa-4.0-py2.py3-none-any.whl (Vulnerable Library)
Vulnerability Details
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
Publish Date: 2020-11-12
URL: CVE-2020-25658
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-xrx6-fmxq-rjj2
Release Date: 2020-11-12
Fix Resolution: rsa - 4.7
Step up your Open Source Security Game with WhiteSource here
CVE-2020-5311 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-5311 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
Publish Date: 2020-01-03
URL: CVE-2020-5311
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5311
Release Date: 2020-01-03
Fix Resolution: Pillow - 6.2.2
Step up your Open Source Security Game with WhiteSource here
CVE-2021-25289 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2021-25289 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
Publish Date: 2021-03-19
URL: CVE-2021-25289
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Date: 2021-01-18
Fix Resolution: 8.1.1
Step up your Open Source Security Game with WhiteSource here
CVE-2020-5312 (High) detected in Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
CVE-2020-5312 - High Severity Vulnerability
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy:
- ❌ Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Vulnerability Details
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
Publish Date: 2020-01-03
URL: CVE-2020-5312
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312
Release Date: 2020-01-03
Fix Resolution: Pillow - 6.2.2
Step up your Open Source Security Game with WhiteSource here
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.