bodnuti

Deterministic checks of Yocto Project & OpenEmbedded patches.

[layerindex-web][PATCH 1/3] requirements.txt: fix djangorestframework and GitPython vulnerabilities

List
yocto-patches
Thread
lore
Author
Tim Orling
Last message
2026-10-24 22:26
Result
clean
Checked against
layerindex-web master
Base
172552843211
GitHub CI
16 runs: 9 passed, 3 failed, 4 skipped

[layerindex-web][PATCH 1/3] requirements.txt: fix djangorestframework and GitPython vulnerabilities

[layerindex-web][PATCH 2/3] Dockerfile: move to Ubuntu noble (24.04)

[layerindex-web][PATCH 3/3] requirements.txt: upgrade Pillow to 13.0.0

Fixes

fixed trivy CVE-2026-114145 requirements.txt:25
GitPython 3.1.62: GitPython: GitPython: arbitrary code execution via improper submodule path validation (fixed in 3.2.1)
fixed trivy CVE-2026-112393 requirements.txt:29
Pillow 12.3.0: Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow ha ... (fixed in 13.0.0)
fixed trivy CVE-2026-112398 requirements.txt:29
Pillow 12.3.0: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix ... (fixed in 13.0.0)
fixed trivy CVE-2026-112403 requirements.txt:29
Pillow 12.3.0: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG dec ... (fixed in 13.0.0)
fixed trivy CVE-2026-112900 requirements.txt:29
Pillow 12.3.0: Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is ... (fixed in 13.0.0)
fixed trivy CVE-2026-96639 requirements.txt:29
Pillow 12.3.0: Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-fr ... (fixed in 13.0.0)
fixed trivy CVE-2026-112390 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing (fixed in 13.0.0)
fixed trivy CVE-2026-112392 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via zero-size images in rank filters (fixed in 13.0.0)
fixed trivy CVE-2026-112397 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (fixed in 13.0.0)
fixed trivy CVE-2026-112399 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of service via crafted APNG image (fixed in 13.0.0)
fixed trivy CVE-2026-112400 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image (fixed in 13.0.0)
fixed trivy CVE-2026-112402 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of service via double free during image transformation (fixed in 13.0.0)
fixed trivy CVE-2026-112404 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding (fixed in 13.0.0)
fixed trivy CVE-2026-112405 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (fixed in 13.0.0)
fixed trivy CVE-2026-112406 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (fixed in 13.0.0)
fixed trivy CVE-2026-112892 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (fixed in 13.0.0)
fixed trivy CVE-2026-112893 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via invalid pointer free during font rendering (fixed in 13.0.0)
fixed trivy CVE-2026-112894 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via crafted multi-frame image conversion (fixed in 13.0.0)
fixed trivy CVE-2026-112895 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of service via crafted PDF during append operations (fixed in 13.0.0)
fixed trivy CVE-2026-112896 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder (fixed in 13.0.0)
fixed trivy CVE-2026-112897 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding (fixed in 13.0.0)
fixed trivy CVE-2026-112902 requirements.txt:29
Pillow 12.3.0: Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags (fixed in 13.0.0)
fixed trivy CVE-2026-96637 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images (fixed in 13.0.0)
fixed trivy CVE-2026-96640 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via duplicate page references in PDF files (fixed in 13.0.0)
fixed trivy CVE-2026-96642 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via negative archive member size in TarIO (fixed in 13.0.0)
fixed trivy CVE-2026-96643 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via repeated EXIF headers (fixed in 13.0.0)
fixed trivy CVE-2026-96644 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser (fixed in 13.0.0)
fixed trivy CVE-2026-96778 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow (fixed in 13.0.0)
fixed trivy GHSA-78g4-xqwv-q3g8 requirements.txt:29
Pillow 12.3.0: Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() (fixed in 13.0.0)
fixed trivy CVE-2026-112391 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (fixed in 13.0.0)
fixed trivy CVE-2026-112394 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Information disclosure via out-of-bounds read in raw decoders (fixed in 13.0.0)
fixed trivy CVE-2026-112395 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Information disclosure via crafted tiled TIFF image (fixed in 13.0.0)
fixed trivy CVE-2026-112396 requirements.txt:29
Pillow 12.3.0: pillow: pillow: arbitrary code execution via heap use-after-free during TIFF encoding (fixed in 13.0.0)
fixed trivy CVE-2026-112401 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via crafted GIF comments (fixed in 13.0.0)
fixed trivy CVE-2026-112891 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via large GIF comments (fixed in 13.0.0)
fixed trivy CVE-2026-112898 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Information disclosure via empty palette quantization (fixed in 13.0.0)
fixed trivy CVE-2026-112899 requirements.txt:29
Pillow 12.3.0: Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit (fixed in 13.0.0)
fixed trivy CVE-2026-112901 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Denial of Service via crafted XBM image header (fixed in 13.0.0)
fixed trivy CVE-2026-114501 requirements.txt:29
Pillow 12.3.0: pillow: Pillow: Information disclosure via improper memory alignment during Arrow export (fixed in 13.0.0)
fixed trivy CVE-2026-96636 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via decompression bomb check bypass in multi-frame images (fixed in 13.0.0)
fixed trivy CVE-2026-96638 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via crafted RLE BMP image (fixed in 13.0.0)
fixed trivy CVE-2026-96641 requirements.txt:29
Pillow 12.3.0: pillow: pillow: Denial of Service via integer overflow in text-width calculation (fixed in 13.0.0)
fixed trivy CVE-2026-114136 requirements.txt:23
djangorestframework 3.18.0: djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (fixed in 3.18.2)
fixed trivy CVE-2026-114137 requirements.txt:23
djangorestframework 3.18.0: djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy (fixed in 3.18.2)
fixed trivy CVE-2026-114138 requirements.txt:23
djangorestframework 3.18.0: djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (fixed in 3.18.2)

patchtest: 30 pass, 0 fail, 6 skip

Text report

GitHub CI

Runs on master-next that carried this series. Each tests every patch on the branch; a failure is shown as this series' only when two runs failed newly carrying it.