[
  {
    "aliases": [
      "GHSA-4fx9-vc88-q2xc"
    ],
    "summary": "Infinite loop in Pillow",
    "affected_packages": [
      {
        "package": {
          "type": "pypi",
          "namespace": null,
          "name": "pillow",
          "version": null,
          "qualifiers": null,
          "subpath": null
        },
        "affected_version_range": "vers:pypi/<9.0.0",
        "fixed_version": "9.0.0"
      }
    ],
    "references": [
      {
        "reference_id": "",
        "url": "https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file",
        "severities": []
      },
      {
        "reference_id": "GHSA-4fx9-vc88-q2xc",
        "url": "https://github.com/advisories/GHSA-4fx9-vc88-q2xc",
        "severities": [
          {
            "system": "cvssv3.1_qr",
            "value": "LOW"
          }
        ]
      }
    ],
    "date_published": "2022-03-11T23:39:27+00:00"
  },
  {
    "aliases": [
      "CVE-2022-22817",
      "GHSA-8vj2-vxx3-667w"
    ],
    "summary": "Arbitrary expression injection in Pillow",
    "affected_packages": [
      {
        "package": {
          "type": "pypi",
          "namespace": null,
          "name": "pillow",
          "version": null,
          "qualifiers": null,
          "subpath": null
        },
        "affected_version_range": "vers:pypi/<9.0.1",
        "fixed_version": null
      }
    ],
    "references": [
      {
        "reference_id": "CVE-2022-22817",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22817",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://www.debian.org/security/2022/dsa-5053",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security",
        "severities": []
      },
      {
        "reference_id": "GHSA-8vj2-vxx3-667w",
        "url": "https://github.com/advisories/GHSA-8vj2-vxx3-667w",
        "severities": [
          {
            "system": "cvssv3.1_qr",
            "value": "CRITICAL"
          }
        ]
      }
    ],
    "date_published": "2022-01-12T20:07:33+00:00"
  },
  {
    "aliases": [
      "CVE-2022-24303",
      "GHSA-9j59-75qj-795w"
    ],
    "summary": "Path traversal in Pillow",
    "affected_packages": [
      {
        "package": {
          "type": "pypi",
          "namespace": null,
          "name": "pillow",
          "version": null,
          "qualifiers": null,
          "subpath": null
        },
        "affected_version_range": "vers:pypi/<9.0.1",
        "fixed_version": null
      }
    ],
    "references": [
      {
        "reference_id": "CVE-2022-24303",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24303",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security",
        "severities": []
      },
      {
        "reference_id": "GHSA-9j59-75qj-795w",
        "url": "https://github.com/advisories/GHSA-9j59-75qj-795w",
        "severities": [
          {
            "system": "cvssv3.1_qr",
            "value": "MODERATE"
          }
        ]
      }
    ],
    "date_published": "2022-03-11T23:10:32+00:00"
  },
  {
    "aliases": [
      "CVE-2022-23578",
      "GHSA-8r7c-3cm2-3h8f"
    ],
    "summary": "Memory leak in Tensorflow",
    "affected_packages": [
      {
        "package": {
          "type": "pypi",
          "namespace": null,
          "name": "tensorflow",
          "version": null,
          "qualifiers": null,
          "subpath": null
        },
        "affected_version_range": "vers:pypi/<2.5.3",
        "fixed_version": null
      }
    ],
    "references": [
      {
        "reference_id": "GHSA-8r7c-3cm2-3h8f",
        "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8r7c-3cm2-3h8f",
        "severities": [
          {
            "system": "cvssv3.1_qr",
            "value": "MODERATE"
          }
        ]
      },
      {
        "reference_id": "",
        "url": "https://github.com/tensorflow/tensorflow/commit/c79ccba517dbb1a0ccb9b01ee3bd2a63748b60dd",
        "severities": []
      },
      {
        "reference_id": "",
        "url": "https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/common_runtime/immutable_executor_state.cc#L84-L262",
        "severities": []
      },
      {
        "reference_id": "CVE-2022-23578",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23578",
        "severities": []
      },
      {
        "reference_id": "GHSA-8r7c-3cm2-3h8f",
        "url": "https://github.com/advisories/GHSA-8r7c-3cm2-3h8f",
        "severities": [
          {
            "system": "cvssv3.1_qr",
            "value": "MODERATE"
          }
        ]
      }
    ],
    "date_published": "2022-02-10T00:33:13+00:00"
  }
]