-
Notifications
You must be signed in to change notification settings - Fork 0
quick_start_results_json
Yoshio Sugiyama edited this page Mar 4, 2025
·
1 revision
{
"input": {
"scan": {
"id": null,
"type": null,
"started_at": null,
"completed_at": null,
"vulns": [
{
"vuln_id": "CVE-2024-21762",
"description": null,
"score": null,
"severity": null,
"published_date": null,
"last_modified_date": null,
"url": null,
"feed_group": null,
"package": null,
"package_version": null,
"package_name": null,
"package_type": null
},
{
"vuln_id": "GHSA-hh8p-p8mp-gqhm",
"description": null,
"score": null,
"severity": null,
"published_date": null,
"last_modified_date": null,
"url": null,
"feed_group": null,
"package": null,
"package_version": null,
"package_name": null,
"package_type": null
},
{
"vuln_id": "GHSA-3f63-hfp8-52jq",
"description": null,
"score": null,
"severity": null,
"published_date": null,
"last_modified_date": null,
"url": null,
"feed_group": null,
"package": null,
"package_version": null,
"package_name": null,
"package_type": null
}
]
},
"image": {
"name": "nvcr.io/nvidia/morpheus/morpheus",
"tag": "23.11-runtime",
"digest": null,
"platform": null,
"feed_group": null,
"source_info": [
{
"type": "code",
"git_repo": "https://github.com/nv-morpheus/Morpheus.git",
"tag": "v23.11.01",
"include": [
"**/*.cpp",
"**/*.cu",
"**/*.cuh",
"**/*.h",
"**/*.hpp",
"**/*.ipynb",
"**/*.py",
"**/*Dockerfile"
],
"exclude": [
"tests/**/*"
]
},
{
"type": "doc",
"git_repo": "https://github.com/nv-morpheus/Morpheus.git",
"tag": "v23.11.01",
"include": [
"**/*.md",
"docs/**/*.rst"
],
"exclude": [
]
}
],
"sbom_info": {
"_type": "file",
"file_path": "data/sboms/nvcr.io/nvidia/morpheus/morpheus:v23.11.01-runtime.sbom"
}
}
},
"info": {
"vdb": {
"code_vdb_path": ".cache/am_cache/vdb/code/1c0b2fdc470f09d0",
"doc_vdb_path": ".cache/am_cache/vdb/doc/ec778d43a4a66689"
},
"intel": [
{
"vuln_id": "CVE-2024-21762",
"ghsa": {
"ghsa_id": "GHSA-v4hq-m4wr-6pmj",
"cve_id": "CVE-2024-21762",
"summary": "A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0...",
"description": "A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests",
"severity": "critical",
"vulnerabilities": [
],
"cvss": {
"score": 9.8,
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"cwes": [
{
"cwe_id": "CWE-787",
"name": "Out-of-bounds Write"
}
],
"url": "https://api.github.com/advisories/GHSA-v4hq-m4wr-6pmj",
"html_url": "https://github.com/advisories/GHSA-v4hq-m4wr-6pmj",
"type": "unreviewed",
"repository_advisory_url": null,
"source_code_location": "",
"identifiers": [
{
"value": "GHSA-v4hq-m4wr-6pmj",
"type": "GHSA"
},
{
"value": "CVE-2024-21762",
"type": "CVE"
}
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2024-21762",
"https://fortiguard.com/psirt/FG-IR-24-015",
"https://github.com/advisories/GHSA-v4hq-m4wr-6pmj"
],
"published_at": "2024-02-09T09:31:31Z",
"updated_at": "2024-02-09T09:31:40Z",
"github_reviewed_at": null,
"nvd_published_at": "2024-02-09T09:15:08Z",
"withdrawn_at": null,
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 9.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"credits": [
],
"epss": {
"percentage": 0.03347,
"percentile": 0.91374
}
},
"nvd": {
"cve_id": "CVE-2024-21762",
"cve_description": "A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_name": "CWE-787: Out-of-bounds Write (4.16)",
"cwe_description": "The product writes data past the end, or before the beginning, of the intended buffer.",
"cwe_extended_description": null,
"configurations": [
{
"package": "fortiproxy",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "2.0.14",
"versionStartIncluding": "1.0.0",
"versionEndIncluding": null
},
{
"package": "fortiproxy",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "7.0.15",
"versionStartIncluding": "7.0.0",
"versionEndIncluding": null
},
{
"package": "fortiproxy",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "7.2.0",
"versionEndIncluding": null
},
{
"package": "fortiproxy",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "7.4.3",
"versionStartIncluding": "7.4.0",
"versionEndIncluding": null
},
{
"package": "fortios",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "6.0.18",
"versionStartIncluding": "6.0.0",
"versionEndIncluding": null
},
{
"package": "fortios",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "6.2.16",
"versionStartIncluding": "6.2.0",
"versionEndIncluding": null
},
{
"package": "fortios",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "6.4.15",
"versionStartIncluding": "6.4.0",
"versionEndIncluding": null
},
{
"package": "fortios",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "7.0.0",
"versionEndIncluding": null
},
{
"package": "fortios",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.2.0",
"versionEndIncluding": null
},
{
"package": "fortios",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "7.4.3",
"versionStartIncluding": "7.4.0",
"versionEndIncluding": null
}
],
"vendor_names": [
"Fortinet"
]
},
"rhsa": {
"bugzilla": {
"description": null,
"id": null,
"url": null
},
"details": null,
"statement": null,
"package_state": null,
"upstream_fix": null
},
"ubuntu": {
"description": null,
"notes": null,
"priority": null,
"ubuntu_description": null
},
"epss": {
"epss": 0.03347,
"percentile": 0.91437,
"date": "2025-03-02",
"cve": "CVE-2024-21762"
}
},
{
"vuln_id": "GHSA-hh8p-p8mp-gqhm",
"ghsa": {
"ghsa_id": "GHSA-hh8p-p8mp-gqhm",
"cve_id": "CVE-2023-6975",
"summary": "MLFlow Path Traversal Vulnerability",
"description": "A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.",
"severity": "critical",
"vulnerabilities": [
{
"package": {
"ecosystem": "pip",
"name": "mlflow"
},
"vulnerable_version_range": "< 2.9.2",
"first_patched_version": "2.9.2",
"vulnerable_functions": [
]
}
],
"cvss": {
"score": 9.8,
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"cwes": [
{
"cwe_id": "CWE-29",
"name": "Path Traversal: '..filename'"
}
],
"url": "https://api.github.com/advisories/GHSA-hh8p-p8mp-gqhm",
"html_url": "https://github.com/advisories/GHSA-hh8p-p8mp-gqhm",
"type": "reviewed",
"repository_advisory_url": null,
"source_code_location": "https://github.com/mlflow/mlflow",
"identifiers": [
{
"value": "GHSA-hh8p-p8mp-gqhm",
"type": "GHSA"
},
{
"value": "CVE-2023-6975",
"type": "CVE"
}
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2023-6975",
"https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee",
"https://huntr.com/bounties/029a3824-cee3-4cf1-b260-7138aa539b85",
"https://github.com/advisories/GHSA-hh8p-p8mp-gqhm"
],
"published_at": "2023-12-20T06:30:25Z",
"updated_at": "2024-01-02T15:14:39Z",
"github_reviewed_at": "2023-12-20T20:32:39Z",
"nvd_published_at": "2023-12-20T06:15:45Z",
"withdrawn_at": null,
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 9.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"credits": [
],
"epss": {
"percentage": 0.00306,
"percentile": 0.69647
}
},
"nvd": {
"cve_id": "CVE-2023-6975",
"cve_description": "A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_name": "CWE-29: Path Traversal: '\\..\\filename' (4.16)",
"cwe_description": "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\..\\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.",
"cwe_extended_description": "This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.\nThis is similar to CWE-25, except using \"\\\" instead of \"/\". Sometimes a program checks for \"..\\\" at the beginning of the input, so a \"\\..\\\" can bypass that check. It is also useful for bypassing path traversal protection schemes that only assume that the \"/\" separator is valid.",
"configurations": [
{
"package": "mlflow",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": "2.9.2",
"versionStartIncluding": null,
"versionEndIncluding": null
}
],
"vendor_names": [
"Lfprojects"
]
},
"rhsa": {
"bugzilla": {
"description": null,
"id": null,
"url": null
},
"details": null,
"statement": null,
"package_state": null,
"upstream_fix": null
},
"ubuntu": {
"description": null,
"notes": null,
"priority": null,
"ubuntu_description": null
},
"epss": {
"epss": 0.00306,
"percentile": 0.69945,
"date": "2025-03-02",
"cve": "CVE-2023-6975"
}
},
{
"vuln_id": "GHSA-3f63-hfp8-52jq",
"ghsa": {
"ghsa_id": "GHSA-3f63-hfp8-52jq",
"cve_id": "CVE-2023-50447",
"summary": "Arbitrary Code Execution in Pillow",
"description": "Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).",
"severity": "critical",
"vulnerabilities": [
{
"package": {
"ecosystem": "pip",
"name": "Pillow"
},
"vulnerable_version_range": "< 10.2.0",
"first_patched_version": "10.2.0",
"vulnerable_functions": [
]
}
],
"cvss": {
"score": 8.1,
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"cwes": [
{
"cwe_id": "CWE-94",
"name": "Improper Control of Generation of Code ('Code Injection')"
},
{
"cwe_id": "CWE-95",
"name": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
}
],
"url": "https://api.github.com/advisories/GHSA-3f63-hfp8-52jq",
"html_url": "https://github.com/advisories/GHSA-3f63-hfp8-52jq",
"type": "reviewed",
"repository_advisory_url": null,
"source_code_location": "https://github.com/python-pillow/Pillow",
"identifiers": [
{
"value": "GHSA-3f63-hfp8-52jq",
"type": "GHSA"
},
{
"value": "CVE-2023-50447",
"type": "CVE"
}
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2023-50447",
"https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a",
"https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security",
"http://www.openwall.com/lists/oss-security/2024/01/20/1",
"https://github.com/python-pillow/Pillow/releases",
"https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html",
"https://devhub.checkmarx.com/cve-details/CVE-2023-50447",
"https://duartecsantos.github.io/2023-01-02-CVE-2023-50447",
"https://duartecsantos.github.io/2024-01-02-CVE-2023-50447",
"https://github.com/advisories/GHSA-3f63-hfp8-52jq"
],
"published_at": "2024-01-19T21:30:35Z",
"updated_at": "2024-11-18T16:26:35Z",
"github_reviewed_at": "2024-01-22T21:28:18Z",
"nvd_published_at": "2024-01-19T20:15:11Z",
"withdrawn_at": null,
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 8.1
},
"cvss_v4": {
"vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"score": 9.3
}
},
"credits": [
],
"epss": {
"percentage": 0.00122,
"percentile": 0.47727
}
},
"nvd": {
"cve_id": "CVE-2023-50447",
"cve_description": "Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_name": "CWE-94: Improper Control of Generation of Code ('Code Injection') (4.16)",
"cwe_description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.",
"cwe_extended_description": "When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.\nInjection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.",
"configurations": [
{
"package": "pillow",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": null,
"versionStartIncluding": null,
"versionEndIncluding": "10.1.0"
},
{
"package": "debian_linux",
"system": null,
"versionStartExcluding": null,
"versionEndExcluding": null,
"versionStartIncluding": "10.0",
"versionEndIncluding": "10.0"
}
],
"vendor_names": [
"Debian",
"Python"
]
},
"rhsa": {
"bugzilla": {
"description": "pillow: Arbitrary Code Execution via the environment parameter",
"id": "2259479",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259479"
},
"details": [
"Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).",
"A vulnerability was found in Pillow, a popular Python imaging library. The flaw identified in the PIL.ImageMath.eval function enables arbitrary code execution by manipulating the environment parameter."
],
"statement": "The vulnerability in Pillow's PIL.ImageMath.eval function poses a significant threat due to its potential for arbitrary code execution. Pillow's widespread use in diverse domains makes this flaw particularly impactful, as it could lead to unauthorized access, data breaches, and compromise of entire systems. The complex exploitation method involving Python's dunder methods adds sophistication to potential attacks.",
"package_state": null,
"upstream_fix": null,
"threat_severity": "Important",
"public_date": "2024-01-19T00:00:00Z",
"cvss3": {
"cvss3_base_score": "8.1",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"status": "verified"
},
"cwe": "CWE-77",
"affected_release": [
{
"product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
"release_date": "2024-06-10T00:00:00Z",
"advisory": "RHSA-2024:3781",
"cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
"package": "python3x-pillow-0:10.3.0-1.el8ap"
},
{
"product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
"release_date": "2024-06-10T00:00:00Z",
"advisory": "RHSA-2024:3781",
"cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
"package": "python-pillow-0:10.3.0-1.el9ap"
},
{
"product_name": "Red Hat Enterprise Linux 7",
"release_date": "2024-02-19T00:00:00Z",
"advisory": "RHSA-2024:0857",
"cpe": "cpe:/o:redhat:enterprise_linux:7",
"package": "python-pillow-0:2.0.0-25.gitd1c6db8.el7_9"
},
{
"product_name": "Red Hat Enterprise Linux 8",
"release_date": "2024-02-20T00:00:00Z",
"advisory": "RHSA-2024:0893",
"cpe": "cpe:/a:redhat:enterprise_linux:8",
"package": "python-pillow-0:5.1.1-18.el8_9.1"
},
{
"product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"release_date": "2024-02-29T00:00:00Z",
"advisory": "RHSA-2024:1059",
"cpe": "cpe:/a:redhat:rhel_aus:8.2",
"package": "python-pillow-0:5.1.1-15.el8_2"
},
{
"product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"release_date": "2024-02-29T00:00:00Z",
"advisory": "RHSA-2024:1060",
"cpe": "cpe:/a:redhat:rhel_aus:8.4",
"package": "python-pillow-0:5.1.1-15.el8_4"
},
{
"product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
"release_date": "2024-02-29T00:00:00Z",
"advisory": "RHSA-2024:1060",
"cpe": "cpe:/a:redhat:rhel_tus:8.4",
"package": "python-pillow-0:5.1.1-15.el8_4"
},
{
"product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
"release_date": "2024-02-29T00:00:00Z",
"advisory": "RHSA-2024:1060",
"cpe": "cpe:/a:redhat:rhel_e4s:8.4",
"package": "python-pillow-0:5.1.1-15.el8_4"
},
{
"product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support",
"release_date": "2024-02-29T00:00:00Z",
"advisory": "RHSA-2024:1058",
"cpe": "cpe:/a:redhat:rhel_eus:8.6",
"package": "python-pillow-0:5.1.1-19.el8_6"
},
{
"product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support",
"release_date": "2024-02-08T00:00:00Z",
"advisory": "RHSA-2024:0754",
"cpe": "cpe:/a:redhat:rhel_eus:8.8",
"package": "python-pillow-0:5.1.1-19.el8_8"
}
],
"references": [
"https://www.cve.org/CVERecord?id=CVE-2023-50447\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-50447\nhttp://www.openwall.com/lists/oss-security/2024/01/20/1\nhttps://devhub.checkmarx.com/cve-details/CVE-2023-50447/\nhttps://duartecsantos.github.io/2023-01-02-CVE-2023-50447/\nhttps://github.com/python-pillow/Pillow/releases"
],
"name": "CVE-2023-50447",
"mitigation": {
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"lang": "en:us"
},
"csaw": false
},
"ubuntu": {
"description": "\nPillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution\nvia the environment parameter, a different vulnerability than\nCVE-2022-22817 (which was about the expression parameter).",
"notes": [
],
"priority": "medium",
"ubuntu_description": "",
"bugs": [
"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061172"
],
"codename": null,
"cvss3": 8.1,
"id": "CVE-2023-50447",
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
},
"mitigation": "",
"notices": [
{
"cves_ids": [
"CVE-2023-44271",
"CVE-2023-50447"
],
"description": "It was discovered that Pillow incorrectly handled certain long text\narguments. An attacker could possibly use this issue to cause Pillow to\nconsume resources, leading to a denial of service. This issue only affected\nUbuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)\n\nDuarte Santos discovered that Pillow incorrectly handled the environment\nparameter to PIL.ImageMath.eval. An attacker could possibly use this issue\nto execute arbitrary code. (CVE-2023-50447)\n",
"id": "USN-6618-1",
"instructions": "In general, a standard system update will make all the necessary changes.\n",
"is_hidden": false,
"published": "2024-01-30T15:17:54.445907",
"references": [
],
"release_packages": {
"focal": [
{
"description": "Python Imaging Library",
"is_source": true,
"name": "pillow",
"version": "7.0.0-4ubuntu0.8"
},
{
"is_source": false,
"is_visible": false,
"name": "python-pil-doc",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "7.0.0-4ubuntu0.8",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.8"
},
{
"is_source": false,
"is_visible": true,
"name": "python3-pil",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "7.0.0-4ubuntu0.8",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.8"
},
{
"is_source": false,
"is_visible": false,
"name": "python3-pil.imagetk",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "7.0.0-4ubuntu0.8",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.8"
}
],
"jammy": [
{
"description": "Python Imaging Library",
"is_source": true,
"name": "pillow",
"version": "9.0.1-1ubuntu0.2"
},
{
"is_source": false,
"is_visible": false,
"name": "python-pil-doc",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "9.0.1-1ubuntu0.2",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/9.0.1-1ubuntu0.2"
},
{
"is_source": false,
"is_visible": true,
"name": "python3-pil",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "9.0.1-1ubuntu0.2",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/9.0.1-1ubuntu0.2"
},
{
"is_source": false,
"is_visible": false,
"name": "python3-pil.imagetk",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "9.0.1-1ubuntu0.2",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/9.0.1-1ubuntu0.2"
}
],
"mantic": [
{
"description": "Python Imaging Library",
"is_source": true,
"name": "pillow",
"version": "10.0.0-1ubuntu0.1"
},
{
"is_source": false,
"is_visible": false,
"name": "python-pil-doc",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "10.0.0-1ubuntu0.1",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/10.0.0-1ubuntu0.1"
},
{
"is_source": false,
"is_visible": true,
"name": "python3-pil",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "10.0.0-1ubuntu0.1",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/10.0.0-1ubuntu0.1"
},
{
"is_source": false,
"is_visible": false,
"name": "python3-pil.imagetk",
"pocket": "security",
"source_link": "https://launchpad.net/ubuntu/+source/pillow",
"version": "10.0.0-1ubuntu0.1",
"version_link": "https://launchpad.net/ubuntu/+source/pillow/10.0.0-1ubuntu0.1"
}
]
},
"summary": "Several security issues were fixed in Pillow.\n",
"title": "Pillow vulnerabilities",
"type": "USN"
}
],
"notices_ids": [
"USN-6618-1"
],
"packages": [
{
"debian": "https://tracker.debian.org/pkg/pillow",
"name": "pillow",
"source": "https://ubuntu.com/security/cve?package=pillow",
"statuses": [
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "bionic",
"status": "needs-triage"
},
{
"component": null,
"description": "7.0.0-4ubuntu0.8",
"pocket": "security",
"release_codename": "focal",
"status": "released"
},
{
"component": null,
"description": "9.0.1-1ubuntu0.2",
"pocket": "security",
"release_codename": "jammy",
"status": "released"
},
{
"component": null,
"description": "end of life, was needed",
"pocket": "security",
"release_codename": "lunar",
"status": "ignored"
},
{
"component": null,
"description": "10.0.0-1ubuntu0.1",
"pocket": "security",
"release_codename": "mantic",
"status": "released"
},
{
"component": null,
"description": "10.2.0-1",
"pocket": "security",
"release_codename": "noble",
"status": "released"
},
{
"component": null,
"description": "10.2.0-1",
"pocket": "security",
"release_codename": "oracular",
"status": "released"
},
{
"component": null,
"description": "end of ESM support, was needs-triage",
"pocket": "security",
"release_codename": "trusty",
"status": "ignored"
},
{
"component": null,
"description": "10.2.0-1",
"pocket": "security",
"release_codename": "upstream",
"status": "released"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "xenial",
"status": "needs-triage"
}
],
"ubuntu": "https://packages.ubuntu.com/search?suite=all§ion=all&arch=any&searchon=sourcenames&keywords=pillow"
},
{
"debian": "https://tracker.debian.org/pkg/pillow-python2",
"name": "pillow-python2",
"source": "https://ubuntu.com/security/cve?package=pillow-python2",
"statuses": [
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "bionic",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "focal",
"status": "needs-triage"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "jammy",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "lunar",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "mantic",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "noble",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "oracular",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "trusty",
"status": "DNE"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "upstream",
"status": "needs-triage"
},
{
"component": null,
"description": "",
"pocket": "security",
"release_codename": "xenial",
"status": "DNE"
}
],
"ubuntu": "https://packages.ubuntu.com/search?suite=all§ion=all&arch=any&searchon=sourcenames&keywords=pillow-python2"
}
],
"patches": {
"pillow": [
"upstream: https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a",
"upstream: https://github.com/python-pillow/Pillow/commit/0ca3c33c59927e1c7e0c14dbc1eea1dfb2431a80",
"upstream: https://github.com/python-pillow/Pillow/commit/557ba59d13de919d04b3fd4cdef8634f7d4b3348"
],
"pillow-python2": [
]
},
"published": "2024-01-19T20:15:00",
"references": [
"https://duartecsantos.github.io/2023-01-02-CVE-2023-50447/",
"https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#imagemath-eval-restricted-environment-keys",
"https://devhub.checkmarx.com/cve-details/CVE-2023-50447/",
"http://www.openwall.com/lists/oss-security/2024/01/20/1",
"https://ubuntu.com/security/notices/USN-6618-1",
"https://www.cve.org/CVERecord?id=CVE-2023-50447"
],
"status": "active",
"tags": {
},
"updated_at": "2024-07-24T15:57:39.284958+00:00"
},
"epss": {
"epss": 0.00122,
"percentile": 0.47889,
"date": "2025-03-02",
"cve": "CVE-2023-50447"
}
}
],
"sbom": {
"packages": [
{
"name": "Babel",
"version": "2.13.1",
"path": null,
"system": "python"
},
{
"name": "Brotli",
"version": "1.0.9",
"path": null,
"system": "python"
},
{
"name": "Brotli",
"version": "1.1.0",
"path": null,
"system": "python"
},
{
"name": "ConfigArgParse",
"version": "1.5.5",
"path": null,
"system": "python"
},
{
"name": "Flask",
"version": "3.0.0",
"path": null,
"system": "python"
},
{
"name": "GitPython",
"version": "3.1.40",
"path": null,
"system": "python"
},
{
"name": "Jinja2",
"version": "3.1.2",
"path": null,
"system": "python"
},
{
"name": "Mako",
"version": "1.3.0",
"path": null,
"system": "python"
},
{
"name": "Markdown",
"version": "3.5.1",
"path": null,
"system": "python"
},
{
"name": "MarkupSafe",
"version": "2.1.3",
"path": null,
"system": "python"
},
{
"name": "Pillow",
"version": "10.1.0",
"path": null,
"system": "python"
},
{
"name": "PyJWT",
"version": "2.8.0",
"path": null,
"system": "python"
},
{
"name": "PySocks",
"version": "1.7.1",
"path": null,
"system": "python"
},
{
"name": "PyYAML",
"version": "6.0.1",
"path": null,
"system": "python"
},
{
"name": "Pygments",
"version": "2.17.2",
"path": null,
"system": "python"
},
{
"name": "SQLAlchemy",
"version": "2.0.0",
"path": null,
"system": "python"
},
{
"name": "SciPy",
"version": "1.11.4",
"path": null,
"system": "python"
},
{
"name": "Simple",
"version": "Launcher",
"path": null,
"system": "1.1.0.14"
},
{
"name": "Sphinx",
"version": "7.2.6",
"path": null,
"system": "python"
},
{
"name": "Werkzeug",
"version": "3.0.1",
"path": null,
"system": "python"
},
{
"name": "absl-py",
"version": "1.4.0",
"path": null,
"system": "python"
},
{
"name": "adduser",
"version": "3.118ubuntu5",
"path": null,
"system": "deb"
},
{
"name": "alabaster",
"version": "0.7.13",
"path": null,
"system": "python"
},
{
"name": "alembic",
"version": "1.13.0",
"path": null,
"system": "python"
},
{
"name": "anyio",
"version": "3.7.1",
"path": null,
"system": "python"
},
{
"name": "appdirs",
"version": "1.4.4",
"path": null,
"system": "python"
},
{
"name": "apt",
"version": "2.4.11",
"path": null,
"system": "deb"
},
{
"name": "asn1crypto",
"version": "1.5.1",
"path": null,
"system": "python"
},
{
"name": "attrs",
"version": "23.1.0",
"path": null,
"system": "python"
},
{
"name": "base-files",
"version": "12ubuntu4.4",
"path": null,
"system": "deb"
},
{
"name": "base-passwd",
"version": "3.5.52build1",
"path": null,
"system": "deb"
},
{
"name": "bash",
"version": "5.1-6ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "bc",
"version": "1.07.1-3build1",
"path": null,
"system": "deb"
},
{
"name": "beautifulsoup4",
"version": "4.12.2",
"path": null,
"system": "python"
},
{
"name": "betterproto",
"version": "1.2.5",
"path": null,
"system": "python"
},
{
"name": "binutils",
"version": "2.38-4ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "binutils-common",
"version": "2.38-4ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "binutils-x86-64-linux-gnu",
"version": "2.38-4ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "blinker",
"version": "1.7.0",
"path": null,
"system": "python"
},
{
"name": "boa",
"version": "0.16.0",
"path": null,
"system": "python"
},
{
"name": "bokeh",
"version": "2.4.3",
"path": null,
"system": "python"
},
{
"name": "boltons",
"version": "23.0.0",
"path": null,
"system": "python"
},
{
"name": "bsdutils",
"version": "1:2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "build-essential",
"version": "12.9ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "bzip2",
"version": "1.0.8-5build1",
"path": null,
"system": "deb"
},
{
"name": "ca-certificates",
"version": "20230311ubuntu0.22.04.1",
"path": null,
"system": "deb"
},
{
"name": "ca-certificates-java",
"version": "java-archive",
"path": null,
"system": "\u001B[38;2;119;119;119m\u001B[0m"
},
{
"name": "ca-certificates-java",
"version": "20190909ubuntu1.2",
"path": null,
"system": "deb"
},
{
"name": "cachetools",
"version": "5.3.2",
"path": null,
"system": "python"
},
{
"name": "cattrs",
"version": "23.2.3",
"path": null,
"system": "python"
},
{
"name": "certifi",
"version": "2023.11.17",
"path": null,
"system": "python"
},
{
"name": "cffi",
"version": "1.15.1",
"path": null,
"system": "python"
},
{
"name": "cffi",
"version": "1.16.0",
"path": null,
"system": "python"
},
{
"name": "chardet",
"version": "5.2.0",
"path": null,
"system": "python"
},
{
"name": "charset-normalizer",
"version": "3.2.0",
"path": null,
"system": "python"
},
{
"name": "charset-normalizer",
"version": "3.3.2",
"path": null,
"system": "python"
},
{
"name": "click",
"version": "8.1.7",
"path": null,
"system": "python"
},
{
"name": "cloudpickle",
"version": "3.0.0",
"path": null,
"system": "python"
},
{
"name": "colorama",
"version": "0.4.6",
"path": null,
"system": "python"
},
{
"name": "conda",
"version": "23.3.1",
"path": null,
"system": "python"
},
{
"name": "conda-build",
"version": "3.28.1",
"path": null,
"system": "python"
},
{
"name": "conda-libmamba-solver",
"version": "23.3.0",
"path": null,
"system": "python"
},
{
"name": "conda-package-handling",
"version": "2.2.0",
"path": null,
"system": "python"
},
{
"name": "conda_index",
"version": "0.3.0",
"path": null,
"system": "python"
},
{
"name": "conda_package_streaming",
"version": "0.9.0",
"path": null,
"system": "python"
},
{
"name": "configparser",
"version": "5.3.0",
"path": null,
"system": "python"
},
{
"name": "confluent-kafka",
"version": "1.9.2",
"path": null,
"system": "python"
},
{
"name": "contourpy",
"version": "1.2.0",
"path": null,
"system": "python"
},
{
"name": "coreutils",
"version": "8.32-4.1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "cpp",
"version": "4:11.2.0-1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "cpp-11",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "cryptography",
"version": "41.0.3",
"path": null,
"system": "python"
},
{
"name": "cryptography",
"version": "41.0.7",
"path": null,
"system": "python"
},
{
"name": "cubinlinker",
"version": "0.3.0",
"path": null,
"system": "python"
},
{
"name": "cuda-cccl-11-8",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-compat-11-8",
"version": "520.61.05-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-compiler-11-8",
"version": "11.8.0-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-cudart-11-8",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-cudart-dev-11-8",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-cuobjdump-11-8",
"version": "11.8.86-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-cupti-11-8",
"version": "11.8.87-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-cuxxfilt-11-8",
"version": "11.8.86-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-driver-dev-11-8",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-gdb-11-8",
"version": "11.8.86-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-keyring",
"version": "1.1-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-nvcc-11-8",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-nvdisasm-11-8",
"version": "11.8.86-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-nvprune-11-8",
"version": "11.8.86-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-python",
"version": "11.8.3",
"path": null,
"system": "python"
},
{
"name": "cuda-toolkit-11-8-config-common",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-toolkit-11-config-common",
"version": "11.8.89-1",
"path": null,
"system": "deb"
},
{
"name": "cuda-toolkit-config-common",
"version": "12.3.101-1",
"path": null,
"system": "deb"
},
{
"name": "cudf",
"version": "23.6.1",
"path": null,
"system": "python"
},
{
"name": "cudf-kafka",
"version": "23.6.1",
"path": null,
"system": "python"
},
{
"name": "cupy",
"version": "12.2.0",
"path": null,
"system": "python"
},
{
"name": "curl",
"version": "7.81.0-1ubuntu1.15",
"path": null,
"system": "deb"
},
{
"name": "cycler",
"version": "0.12.1",
"path": null,
"system": "python"
},
{
"name": "cytoolz",
"version": "0.12.2",
"path": null,
"system": "python"
},
{
"name": "dash",
"version": "0.5.11+git20210903+057cd650a4ed-3build1",
"path": null,
"system": "deb"
},
{
"name": "dask",
"version": "2023.3.2",
"path": null,
"system": "python"
},
{
"name": "dask-cuda",
"version": "23.6.0",
"path": null,
"system": "python"
},
{
"name": "dask-cudf",
"version": "23.6.1",
"path": null,
"system": "python"
},
{
"name": "databricks-cli",
"version": "0.18.0",
"path": null,
"system": "python"
},
{
"name": "dataclasses",
"version": "0.8",
"path": null,
"system": "python"
},
{
"name": "datacompy",
"version": "0.8.4",
"path": null,
"system": "python"
},
{
"name": "debconf",
"version": "1.5.79ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "debianutils",
"version": "5.5-1ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "diffutils",
"version": "1:3.8-0ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "dill",
"version": "0.3.7",
"path": null,
"system": "python"
},
{
"name": "dirmngr",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "distributed",
"version": "2023.3.2.1",
"path": null,
"system": "python"
},
{
"name": "docker",
"version": "5.0.3",
"path": null,
"system": "python"
},
{
"name": "docker-pycreds",
"version": "0.4.0",
"path": null,
"system": "python"
},
{
"name": "docutils",
"version": "0.20.1",
"path": null,
"system": "python"
},
{
"name": "dpkg",
"version": "1.21.1ubuntu2.2",
"path": null,
"system": "deb"
},
{
"name": "dpkg-dev",
"version": "1.21.1ubuntu2.2",
"path": null,
"system": "deb"
},
{
"name": "e2fsprogs",
"version": "1.46.5-2ubuntu1.1",
"path": null,
"system": "deb"
},
{
"name": "entrypoints",
"version": "0.4",
"path": null,
"system": "python"
},
{
"name": "exceptiongroup",
"version": "1.2.0",
"path": null,
"system": "python"
},
{
"name": "fastrlock",
"version": "0.8.2",
"path": null,
"system": "python"
},
{
"name": "filelock",
"version": "3.13.1",
"path": null,
"system": "python"
},
{
"name": "findutils",
"version": "4.8.0-1ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "fontconfig-config",
"version": "2.13.1-4.2ubuntu5",
"path": null,
"system": "deb"
},
{
"name": "fonts-dejavu-core",
"version": "2.37-2build1",
"path": null,
"system": "deb"
},
{
"name": "fonttools",
"version": "4.46.0",
"path": null,
"system": "python"
},
{
"name": "fsspec",
"version": "2023.12.1",
"path": null,
"system": "python"
},
{
"name": "g++",
"version": "4:11.2.0-1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "g++-11",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "gcc",
"version": "4:11.2.0-1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "gcc-11",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "gcc-11-base",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "gcc-12-base",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "gitdb",
"version": "4.0.11",
"path": null,
"system": "python"
},
{
"name": "gmpy2",
"version": "2.1.2",
"path": null,
"system": "python"
},
{
"name": "gnupg",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gnupg-l10n",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gnupg-utils",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gnupg2",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "googleapis-common-protos",
"version": "1.61.0",
"path": null,
"system": "python"
},
{
"name": "gpg",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gpg-agent",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gpg-wks-client",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gpg-wks-server",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gpgconf",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gpgsm",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "gpgv",
"version": "2.2.27-3ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "greenlet",
"version": "3.0.1",
"path": null,
"system": "python"
},
{
"name": "grep",
"version": "3.7-1build1",
"path": null,
"system": "deb"
},
{
"name": "grpcio",
"version": "1.54.2",
"path": null,
"system": "python"
},
{
"name": "grpclib",
"version": "0.4.6",
"path": null,
"system": "python"
},
{
"name": "gunicorn",
"version": "21.2.0",
"path": null,
"system": "python"
},
{
"name": "gzip",
"version": "1.10-4ubuntu4.1",
"path": null,
"system": "deb"
},
{
"name": "h2",
"version": "4.1.0",
"path": null,
"system": "python"
},
{
"name": "hostname",
"version": "3.23ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "hpack",
"version": "4.0.0",
"path": null,
"system": "python"
},
{
"name": "hyperframe",
"version": "6.0.1",
"path": null,
"system": "python"
},
{
"name": "idna",
"version": "3.4",
"path": null,
"system": "python"
},
{
"name": "idna",
"version": "3.6",
"path": null,
"system": "python"
},
{
"name": "imagesize",
"version": "1.4.1",
"path": null,
"system": "python"
},
{
"name": "importlib-metadata",
"version": "7.0.0",
"path": null,
"system": "python"
},
{
"name": "importlib-resources",
"version": "6.1.1",
"path": null,
"system": "python"
},
{
"name": "init-system-helpers",
"version": "1.62",
"path": null,
"system": "deb"
},
{
"name": "itsdangerous",
"version": "2.1.2",
"path": null,
"system": "python"
},
{
"name": "java-common",
"version": "0.72build2",
"path": null,
"system": "deb"
},
{
"name": "joblib",
"version": "1.3.2",
"path": null,
"system": "python"
},
{
"name": "jq",
"version": "1.6-2.1ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "jrt-fs",
"version": "11.0.21",
"path": null,
"system": "java-archive"
},
{
"name": "js",
"version": "1.0.0",
"path": null,
"system": "npm"
},
{
"name": "json5",
"version": "0.9.14",
"path": null,
"system": "python"
},
{
"name": "jsonpatch",
"version": "1.32",
"path": null,
"system": "python"
},
{
"name": "jsonpointer",
"version": "2.0",
"path": null,
"system": "python"
},
{
"name": "jsonschema",
"version": "4.20.0",
"path": null,
"system": "python"
},
{
"name": "jsonschema-specifications",
"version": "2023.11.2",
"path": null,
"system": "python"
},
{
"name": "jupyter_client",
"version": "8.6.0",
"path": null,
"system": "python"
},
{
"name": "jupyter_core",
"version": "5.5.0",
"path": null,
"system": "python"
},
{
"name": "kiwisolver",
"version": "1.4.5",
"path": null,
"system": "python"
},
{
"name": "libacl1",
"version": "2.3.1-1",
"path": null,
"system": "deb"
},
{
"name": "libapt-pkg6.0",
"version": "2.4.11",
"path": null,
"system": "deb"
},
{
"name": "libarchive-c",
"version": "5.0",
"path": null,
"system": "python"
},
{
"name": "libasan6",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libasound2",
"version": "1.2.6.1-1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libasound2-data",
"version": "1.2.6.1-1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libassuan0",
"version": "2.5.5-1build1",
"path": null,
"system": "deb"
},
{
"name": "libatomic1",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libattr1",
"version": "1:2.5.1-1build1",
"path": null,
"system": "deb"
},
{
"name": "libaudit-common",
"version": "1:3.0.7-1build1",
"path": null,
"system": "deb"
},
{
"name": "libaudit1",
"version": "1:3.0.7-1build1",
"path": null,
"system": "deb"
},
{
"name": "libavahi-client3",
"version": "0.8-5ubuntu5.2",
"path": null,
"system": "deb"
},
{
"name": "libavahi-common-data",
"version": "0.8-5ubuntu5.2",
"path": null,
"system": "deb"
},
{
"name": "libavahi-common3",
"version": "0.8-5ubuntu5.2",
"path": null,
"system": "deb"
},
{
"name": "libbinutils",
"version": "2.38-4ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libblkid1",
"version": "2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libbrotli1",
"version": "1.0.9-2build6",
"path": null,
"system": "deb"
},
{
"name": "libbsd0",
"version": "0.11.5-1",
"path": null,
"system": "deb"
},
{
"name": "libbz2-1.0",
"version": "1.0.8-5build1",
"path": null,
"system": "deb"
},
{
"name": "libc-bin",
"version": "2.35-0ubuntu3.5",
"path": null,
"system": "deb"
},
{
"name": "libc-dev-bin",
"version": "2.35-0ubuntu3.5",
"path": null,
"system": "deb"
},
{
"name": "libc6",
"version": "2.35-0ubuntu3.5",
"path": null,
"system": "deb"
},
{
"name": "libc6-dev",
"version": "2.35-0ubuntu3.5",
"path": null,
"system": "deb"
},
{
"name": "libcap-ng0",
"version": "0.7.9-2.2build3",
"path": null,
"system": "deb"
},
{
"name": "libcap2",
"version": "1:2.44-1ubuntu0.22.04.1",
"path": null,
"system": "deb"
},
{
"name": "libcbor0.8",
"version": "0.8.0-2ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libcc1-0",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libcom-err2",
"version": "1.46.5-2ubuntu1.1",
"path": null,
"system": "deb"
},
{
"name": "libcrypt-dev",
"version": "1:4.4.27-1",
"path": null,
"system": "deb"
},
{
"name": "libcrypt1",
"version": "1:4.4.27-1",
"path": null,
"system": "deb"
},
{
"name": "libctf-nobfd0",
"version": "2.38-4ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libctf0",
"version": "2.38-4ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libcublas-11-8",
"version": "11.11.3.6-1",
"path": null,
"system": "deb"
},
{
"name": "libcufft-11-8",
"version": "10.9.0.58-1",
"path": null,
"system": "deb"
},
{
"name": "libcups2",
"version": "2.4.1op1-1ubuntu4.7",
"path": null,
"system": "deb"
},
{
"name": "libcurand-11-8",
"version": "10.3.0.86-1",
"path": null,
"system": "deb"
},
{
"name": "libcurl4",
"version": "7.81.0-1ubuntu1.15",
"path": null,
"system": "deb"
},
{
"name": "libcusolver-11-8",
"version": "11.4.1.48-1",
"path": null,
"system": "deb"
},
{
"name": "libdb5.3",
"version": "5.3.28+dfsg1-0.8ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libdbus-1-3",
"version": "1.12.20-2ubuntu4.1",
"path": null,
"system": "deb"
},
{
"name": "libdebconfclient0",
"version": "0.261ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libdpkg-perl",
"version": "1.21.1ubuntu2.2",
"path": null,
"system": "deb"
},
{
"name": "libedit2",
"version": "3.1-20210910-1build1",
"path": null,
"system": "deb"
},
{
"name": "libexpat1",
"version": "2.4.7-1ubuntu0.2",
"path": null,
"system": "deb"
},
{
"name": "libext2fs2",
"version": "1.46.5-2ubuntu1.1",
"path": null,
"system": "deb"
},
{
"name": "libffi8",
"version": "3.4.2-4",
"path": null,
"system": "deb"
},
{
"name": "libfido2-1",
"version": "1.10.0-1",
"path": null,
"system": "deb"
},
{
"name": "libfontconfig1",
"version": "2.13.1-4.2ubuntu5",
"path": null,
"system": "deb"
},
{
"name": "libfreetype6",
"version": "2.11.1+dfsg-1ubuntu0.2",
"path": null,
"system": "deb"
},
{
"name": "libgcc-11-dev",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libgcc-s1",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libgcrypt20",
"version": "1.9.4-3ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libgdbm-compat4",
"version": "1.23-1",
"path": null,
"system": "deb"
},
{
"name": "libgdbm6",
"version": "1.23-1",
"path": null,
"system": "deb"
},
{
"name": "libglib2.0-0",
"version": "2.72.4-0ubuntu2.2",
"path": null,
"system": "deb"
},
{
"name": "libgmp10",
"version": "2:6.2.1+dfsg-3ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libgnutls30",
"version": "3.7.3-4ubuntu1.3",
"path": null,
"system": "deb"
},
{
"name": "libgomp1",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libgpg-error0",
"version": "1.43-3",
"path": null,
"system": "deb"
},
{
"name": "libgraphite2-3",
"version": "1.3.14-1build2",
"path": null,
"system": "deb"
},
{
"name": "libgssapi-krb5-2",
"version": "1.19.2-2ubuntu0.3",
"path": null,
"system": "deb"
},
{
"name": "libharfbuzz0b",
"version": "2.7.4-1ubuntu3.1",
"path": null,
"system": "deb"
},
{
"name": "libhogweed6",
"version": "3.7.3-1build2",
"path": null,
"system": "deb"
},
{
"name": "libidn2-0",
"version": "2.3.2-2build1",
"path": null,
"system": "deb"
},
{
"name": "libisl23",
"version": "0.24-2build1",
"path": null,
"system": "deb"
},
{
"name": "libitm1",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libjpeg-turbo8",
"version": "2.1.2-0ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libjpeg8",
"version": "8c-2ubuntu10",
"path": null,
"system": "deb"
},
{
"name": "libjq1",
"version": "1.6-2.1ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libk5crypto3",
"version": "1.19.2-2ubuntu0.3",
"path": null,
"system": "deb"
},
{
"name": "libkeyutils1",
"version": "1.6.1-2ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libkrb5-3",
"version": "1.19.2-2ubuntu0.3",
"path": null,
"system": "deb"
},
{
"name": "libkrb5support0",
"version": "1.19.2-2ubuntu0.3",
"path": null,
"system": "deb"
},
{
"name": "libksba8",
"version": "1.6.0-2ubuntu0.2",
"path": null,
"system": "deb"
},
{
"name": "liblcms2-2",
"version": "2.12~rc1-2build2",
"path": null,
"system": "deb"
},
{
"name": "libldap-2.5-0",
"version": "2.5.16+dfsg-0ubuntu0.22.04.1",
"path": null,
"system": "deb"
},
{
"name": "liblsan0",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "liblz4-1",
"version": "1.9.3-2build2",
"path": null,
"system": "deb"
},
{
"name": "liblzma5",
"version": "5.2.5-2ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libmambapy",
"version": "1.5.0",
"path": null,
"system": "python"
},
{
"name": "libmd0",
"version": "1.0.4-1build1",
"path": null,
"system": "deb"
},
{
"name": "libmount1",
"version": "2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libmpc3",
"version": "1.2.1-2build1",
"path": null,
"system": "deb"
},
{
"name": "libmpfr6",
"version": "4.1.0-3build3",
"path": null,
"system": "deb"
},
{
"name": "libncurses6",
"version": "6.3-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libncursesw6",
"version": "6.3-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libnettle8",
"version": "3.7.3-1build2",
"path": null,
"system": "deb"
},
{
"name": "libnghttp2-14",
"version": "1.43.0-1ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libnpth0",
"version": "1.6-3build2",
"path": null,
"system": "deb"
},
{
"name": "libnsl-dev",
"version": "1.3.0-2build2",
"path": null,
"system": "deb"
},
{
"name": "libnsl2",
"version": "1.3.0-2build2",
"path": null,
"system": "deb"
},
{
"name": "libnspr4",
"version": "2:4.32-3build1",
"path": null,
"system": "deb"
},
{
"name": "libnss3",
"version": "2:3.68.2-0ubuntu1.2",
"path": null,
"system": "deb"
},
{
"name": "libnuma1",
"version": "2.0.14-3ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "libonig5",
"version": "6.9.7.1-2build1",
"path": null,
"system": "deb"
},
{
"name": "libp11-kit0",
"version": "0.24.0-6build1",
"path": null,
"system": "deb"
},
{
"name": "libpam-modules",
"version": "1.4.0-11ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libpam-modules-bin",
"version": "1.4.0-11ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libpam-runtime",
"version": "1.4.0-11ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libpam0g",
"version": "1.4.0-11ubuntu2.3",
"path": null,
"system": "deb"
},
{
"name": "libpcre2-8-0",
"version": "10.39-3ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libpcre3",
"version": "2:8.39-13ubuntu0.22.04.1",
"path": null,
"system": "deb"
},
{
"name": "libpcsclite1",
"version": "1.9.5-3ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "libperl5.34",
"version": "5.34.0-3ubuntu1.3",
"path": null,
"system": "deb"
},
{
"name": "libpng16-16",
"version": "1.6.37-3build5",
"path": null,
"system": "deb"
},
{
"name": "libprocps8",
"version": "2:3.3.17-6ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "libpsl5",
"version": "0.21.0-1.2build2",
"path": null,
"system": "deb"
},
{
"name": "libquadmath0",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libreadline8",
"version": "8.1.2-1",
"path": null,
"system": "deb"
},
{
"name": "librtmp1",
"version": "2.4+20151223.gitfa8646d.1-2build4",
"path": null,
"system": "deb"
},
{
"name": "libsasl2-2",
"version": "2.1.27+dfsg2-3ubuntu1.2",
"path": null,
"system": "deb"
},
{
"name": "libsasl2-modules-db",
"version": "2.1.27+dfsg2-3ubuntu1.2",
"path": null,
"system": "deb"
},
{
"name": "libseccomp2",
"version": "2.5.3-2ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "libselinux1",
"version": "3.3-1build2",
"path": null,
"system": "deb"
},
{
"name": "libsemanage-common",
"version": "3.3-1build2",
"path": null,
"system": "deb"
},
{
"name": "libsemanage2",
"version": "3.3-1build2",
"path": null,
"system": "deb"
},
{
"name": "libsepol2",
"version": "3.3-1build1",
"path": null,
"system": "deb"
},
{
"name": "libsmartcols1",
"version": "2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libsqlite3-0",
"version": "3.37.2-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libss2",
"version": "1.46.5-2ubuntu1.1",
"path": null,
"system": "deb"
},
{
"name": "libssh-4",
"version": "0.9.6-2ubuntu0.22.04.1",
"path": null,
"system": "deb"
},
{
"name": "libssl3",
"version": "3.0.2-0ubuntu1.12",
"path": null,
"system": "deb"
},
{
"name": "libstdc++-11-dev",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libstdc++6",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libsystemd0",
"version": "249.11-0ubuntu3.11",
"path": null,
"system": "deb"
},
{
"name": "libtasn1-6",
"version": "4.18.0-4build1",
"path": null,
"system": "deb"
},
{
"name": "libtinfo6",
"version": "6.3-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libtirpc-common",
"version": "1.3.2-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libtirpc-dev",
"version": "1.3.2-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libtirpc3",
"version": "1.3.2-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "libtsan0",
"version": "11.4.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libubsan1",
"version": "12.3.0-1ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "libudev1",
"version": "249.11-0ubuntu3.11",
"path": null,
"system": "deb"
},
{
"name": "libunistring2",
"version": "1.0-1",
"path": null,
"system": "deb"
},
{
"name": "libuuid1",
"version": "2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "libxxhash0",
"version": "0.8.1-1",
"path": null,
"system": "deb"
},
{
"name": "libzstd1",
"version": "1.4.8+dfsg-3build1",
"path": null,
"system": "deb"
},
{
"name": "linux-libc-dev",
"version": "5.15.0-89.99",
"path": null,
"system": "deb"
},
{
"name": "llvmlite",
"version": "0.41.1",
"path": null,
"system": "python"
},
{
"name": "locket",
"version": "1.0.0",
"path": null,
"system": "python"
},
{
"name": "login",
"version": "1:4.8.1-2ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "logsave",
"version": "1.46.5-2ubuntu1.1",
"path": null,
"system": "deb"
},
{
"name": "lsb-base",
"version": "11.1.0ubuntu4",
"path": null,
"system": "deb"
},
{
"name": "lto-disabled-list",
"version": "24",
"path": null,
"system": "deb"
},
{
"name": "lz4",
"version": "4.3.2",
"path": null,
"system": "python"
},
{
"name": "make",
"version": "4.3-4.1build1",
"path": null,
"system": "deb"
},
{
"name": "mamba",
"version": "1.5.0",
"path": null,
"system": "python"
},
{
"name": "markdown-it-py",
"version": "3.0.0",
"path": null,
"system": "python"
},
{
"name": "matplotlib",
"version": "3.8.2",
"path": null,
"system": "python"
},
{
"name": "mawk",
"version": "1.3.4.20200120-3",
"path": null,
"system": "deb"
},
{
"name": "mdurl",
"version": "0.1.0",
"path": null,
"system": "python"
},
{
"name": "menuinst",
"version": "2.0.0",
"path": null,
"system": "python"
},
{
"name": "merlin-core",
"version": "23.6.0",
"path": null,
"system": "python"
},
{
"name": "merlin-dataloader",
"version": "23.6.0",
"path": null,
"system": "python"
},
{
"name": "mlflow",
"version": "2.9.1",
"path": null,
"system": "python"
},
{
"name": "more-itertools",
"version": "10.1.0",
"path": null,
"system": "python"
},
{
"name": "morpheus",
"version": "23.11.1",
"path": null,
"system": "python"
},
{
"name": "mount",
"version": "2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "mpmath",
"version": "1.3.0",
"path": null,
"system": "python"
},
{
"name": "mrc",
"version": "23.11.0",
"path": null,
"system": "python"
},
{
"name": "msgpack",
"version": "1.0.7",
"path": null,
"system": "python"
},
{
"name": "multidict",
"version": "6.0.4",
"path": null,
"system": "python"
},
{
"name": "munkres",
"version": "1.1.4",
"path": null,
"system": "python"
},
{
"name": "nb-conda-kernels",
"version": "2.3.1",
"path": null,
"system": "python"
},
{
"name": "ncurses-base",
"version": "6.3-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "ncurses-bin",
"version": "6.3-2ubuntu0.1",
"path": null,
"system": "deb"
},
{
"name": "networkx",
"version": "3.2",
"path": null,
"system": "python"
},
{
"name": "npy-append-array",
"version": "0.9.16",
"path": null,
"system": "python"
},
{
"name": "numba",
"version": "0.58.1",
"path": null,
"system": "python"
},
{
"name": "numpy",
"version": "1.26.2",
"path": null,
"system": "python"
},
{
"name": "numpydoc",
"version": "1.4.0",
"path": null,
"system": "python"
},
{
"name": "nvtabular",
"version": "23.6.0",
"path": null,
"system": "python"
},
{
"name": "nvtx",
"version": "0.2.8",
"path": null,
"system": "python"
},
{
"name": "oauthlib",
"version": "3.2.2",
"path": null,
"system": "python"
},
{
"name": "openjdk-11-jre-headless",
"version": "11.0.21+9-0ubuntu1~22.04",
"path": null,
"system": "deb"
},
{
"name": "openssh-client",
"version": "1:8.9p1-3ubuntu0.4",
"path": null,
"system": "deb"
},
{
"name": "openssl",
"version": "3.0.2-0ubuntu1.12",
"path": null,
"system": "deb"
},
{
"name": "openssl",
"version": "3.2.0",
"path": null,
"system": "binary"
},
{
"name": "ordered-set",
"version": "4.1.0",
"path": null,
"system": "python"
},
{
"name": "packaging",
"version": "23.1",
"path": null,
"system": "python"
},
{
"name": "packaging",
"version": "23.2",
"path": null,
"system": "python"
},
{
"name": "pandas",
"version": "1.3.5",
"path": null,
"system": "python"
},
{
"name": "partd",
"version": "1.4.1",
"path": null,
"system": "python"
},
{
"name": "passwd",
"version": "1:4.8.1-2ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "patch",
"version": "2.7.6-7build2",
"path": null,
"system": "deb"
},
{
"name": "perl",
"version": "5.34.0-3ubuntu1.3",
"path": null,
"system": "deb"
},
{
"name": "perl-base",
"version": "5.34.0-3ubuntu1.3",
"path": null,
"system": "deb"
},
{
"name": "perl-modules-5.34",
"version": "5.34.0-3ubuntu1.3",
"path": null,
"system": "deb"
},
{
"name": "pinentry-curses",
"version": "1.1.1-1build2",
"path": null,
"system": "deb"
},
{
"name": "pip",
"version": "23.3.1",
"path": null,
"system": "python"
},
{
"name": "pkg-config",
"version": "0.29.2-1ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "pkginfo",
"version": "1.9.6",
"path": null,
"system": "python"
},
{
"name": "pkgutil_resolve_name",
"version": "1.3.10",
"path": null,
"system": "python"
},
{
"name": "platformdirs",
"version": "4.1.0",
"path": null,
"system": "python"
},
{
"name": "pluggy",
"version": "1.0.0",
"path": null,
"system": "python"
},
{
"name": "pluggy",
"version": "1.3.0",
"path": null,
"system": "python"
},
{
"name": "procps",
"version": "2:3.3.17-6ubuntu2.1",
"path": null,
"system": "deb"
},
{
"name": "prometheus-client",
"version": "0.19.0",
"path": null,
"system": "python"
},
{
"name": "prometheus-flask-exporter",
"version": "0.23.0",
"path": null,
"system": "python"
},
{
"name": "prompt-toolkit",
"version": "3.0.41",
"path": null,
"system": "python"
},
{
"name": "protobuf",
"version": "4.21.12",
"path": null,
"system": "python"
},
{
"name": "psutil",
"version": "5.9.5",
"path": null,
"system": "python"
},
{
"name": "ptxcompiler",
"version": "0.8.1",
"path": null,
"system": "python"
},
{
"name": "pyOpenSSL",
"version": "23.2.0",
"path": null,
"system": "python"
},
{
"name": "pyOpenSSL",
"version": "23.3.0",
"path": null,
"system": "python"
},
{
"name": "pyarrow",
"version": "11.0.0",
"path": null,
"system": "python"
},
{
"name": "pyarrow-hotfix",
"version": "0.6",
"path": null,
"system": "python"
},
{
"name": "pycosat",
"version": "0.6.4",
"path": null,
"system": "python"
},
{
"name": "pycparser",
"version": "2.21",
"path": null,
"system": "python"
},
{
"name": "pynvml",
"version": "11.4.1",
"path": null,
"system": "python"
},
{
"name": "pyparsing",
"version": "3.1.1",
"path": null,
"system": "python"
},
{
"name": "python",
"version": "3.10.12",
"path": null,
"system": "binary"
},
{
"name": "python",
"version": "3.10.13",
"path": null,
"system": "binary"
},
{
"name": "python-dateutil",
"version": "2.8.2",
"path": null,
"system": "python"
},
{
"name": "python-rapidjson",
"version": "1.13",
"path": null,
"system": "python"
},
{
"name": "pytz",
"version": "2023.3.post1",
"path": null,
"system": "python"
},
{
"name": "pyzmq",
"version": "25.1.2",
"path": null,
"system": "python"
},
{
"name": "querystring-parser",
"version": "1.2.4",
"path": null,
"system": "python"
},
{
"name": "readline-common",
"version": "8.1.2-1",
"path": null,
"system": "deb"
},
{
"name": "referencing",
"version": "0.31.1",
"path": null,
"system": "python"
},
{
"name": "requests",
"version": "2.31.0",
"path": null,
"system": "python"
},
{
"name": "requests-cache",
"version": "1.1.1",
"path": null,
"system": "python"
},
{
"name": "rich",
"version": "13.7.0",
"path": null,
"system": "python"
},
{
"name": "rmm",
"version": "23.6.0",
"path": null,
"system": "python"
},
{
"name": "rpcsvc-proto",
"version": "1.4.2-0ubuntu6",
"path": null,
"system": "deb"
},
{
"name": "rpds-py",
"version": "0.13.2",
"path": null,
"system": "python"
},
{
"name": "ruamel.yaml",
"version": "0.17.32",
"path": null,
"system": "python"
},
{
"name": "ruamel.yaml.clib",
"version": "0.2.7",
"path": null,
"system": "python"
},
{
"name": "scikit-learn",
"version": "1.2.2",
"path": null,
"system": "python"
},
{
"name": "sed",
"version": "4.8-1ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "sensible-utils",
"version": "0.0.17",
"path": null,
"system": "deb"
},
{
"name": "setuptools",
"version": "59.8.0",
"path": null,
"system": "python"
},
{
"name": "setuptools",
"version": "68.1.2",
"path": null,
"system": "python"
},
{
"name": "six",
"version": "1.16.0",
"path": null,
"system": "python"
},
{
"name": "smmap",
"version": "5.0.0",
"path": null,
"system": "python"
},
{
"name": "sniffio",
"version": "1.3.0",
"path": null,
"system": "python"
},
{
"name": "snowballstemmer",
"version": "2.2.0",
"path": null,
"system": "python"
},
{
"name": "sortedcontainers",
"version": "2.4.0",
"path": null,
"system": "python"
},
{
"name": "soupsieve",
"version": "2.5",
"path": null,
"system": "python"
},
{
"name": "sphinxcontrib-applehelp",
"version": "1.0.7",
"path": null,
"system": "python"
},
{
"name": "sphinxcontrib-devhelp",
"version": "1.0.5",
"path": null,
"system": "python"
},
{
"name": "sphinxcontrib-htmlhelp",
"version": "2.0.4",
"path": null,
"system": "python"
},
{
"name": "sphinxcontrib-jsmath",
"version": "1.0.1",
"path": null,
"system": "python"
},
{
"name": "sphinxcontrib-qthelp",
"version": "1.0.6",
"path": null,
"system": "python"
},
{
"name": "sphinxcontrib-serializinghtml",
"version": "1.1.9",
"path": null,
"system": "python"
},
{
"name": "sqlparse",
"version": "0.4.4",
"path": null,
"system": "python"
},
{
"name": "stringcase",
"version": "1.2.0",
"path": null,
"system": "python"
},
{
"name": "sympy",
"version": "1.12",
"path": null,
"system": "python"
},
{
"name": "sysvinit-utils",
"version": "3.01-1ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "tabulate",
"version": "0.9.0",
"path": null,
"system": "python"
},
{
"name": "tar",
"version": "1.34+dfsg-1ubuntu0.1.22.04.1",
"path": null,
"system": "deb"
},
{
"name": "tblib",
"version": "2.0.0",
"path": null,
"system": "python"
},
{
"name": "tensorflow-metadata",
"version": "1.13.1",
"path": null,
"system": "python"
},
{
"name": "threadpoolctl",
"version": "3.2.0",
"path": null,
"system": "python"
},
{
"name": "tomli",
"version": "2.0.1",
"path": null,
"system": "python"
},
{
"name": "toolz",
"version": "0.12.0",
"path": null,
"system": "python"
},
{
"name": "torch",
"version": "2.0.1",
"path": null,
"system": "python"
},
{
"name": "tornado",
"version": "6.3.3",
"path": null,
"system": "python"
},
{
"name": "tqdm",
"version": "4.66.1",
"path": null,
"system": "python"
},
{
"name": "traitlets",
"version": "5.14.0",
"path": null,
"system": "python"
},
{
"name": "triton",
"version": "2.0.0",
"path": null,
"system": "python"
},
{
"name": "tritonclient",
"version": "2.26.0",
"path": null,
"system": "python"
},
{
"name": "typing-utils",
"version": "0.1.0",
"path": null,
"system": "python"
},
{
"name": "typing_extensions",
"version": "4.8.0",
"path": null,
"system": "python"
},
{
"name": "ubuntu-keyring",
"version": "2021.03.26",
"path": null,
"system": "deb"
},
{
"name": "ucf",
"version": "3.0043",
"path": null,
"system": "deb"
},
{
"name": "ujson",
"version": "5.8.0",
"path": null,
"system": "python"
},
{
"name": "unicodedata2",
"version": "15.1.0",
"path": null,
"system": "python"
},
{
"name": "unzip",
"version": "6.0-26ubuntu3.1",
"path": null,
"system": "deb"
},
{
"name": "url-normalize",
"version": "1.4.3",
"path": null,
"system": "python"
},
{
"name": "urllib3",
"version": "2.0.4",
"path": null,
"system": "python"
},
{
"name": "urllib3",
"version": "2.1.0",
"path": null,
"system": "python"
},
{
"name": "usrmerge",
"version": "25ubuntu2",
"path": null,
"system": "deb"
},
{
"name": "util-linux",
"version": "2.37.2-4ubuntu3",
"path": null,
"system": "deb"
},
{
"name": "watchdog",
"version": "2.1.9",
"path": null,
"system": "python"
},
{
"name": "watchgod",
"version": "0.8.2",
"path": null,
"system": "python"
},
{
"name": "wcwidth",
"version": "0.2.12",
"path": null,
"system": "python"
},
{
"name": "websocket-client",
"version": "1.7.0",
"path": null,
"system": "python"
},
{
"name": "websockets",
"version": "12.0",
"path": null,
"system": "python"
},
{
"name": "wget",
"version": "1.21.2-2ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "wheel",
"version": "0.41.2",
"path": null,
"system": "python"
},
{
"name": "wheel",
"version": "0.42.0",
"path": null,
"system": "python"
},
{
"name": "xz-utils",
"version": "5.2.5-2ubuntu1",
"path": null,
"system": "deb"
},
{
"name": "zict",
"version": "3.0.0",
"path": null,
"system": "python"
},
{
"name": "zip",
"version": "3.0-12build2",
"path": null,
"system": "deb"
},
{
"name": "zipp",
"version": "3.17.0",
"path": null,
"system": "python"
},
{
"name": "zlib1g",
"version": "1:1.2.11.dfsg-2ubuntu9.2",
"path": null,
"system": "deb"
},
{
"name": "zstandard",
"version": "0.19.0",
"path": null,
"system": "python"
}
]
},
"vulnerable_dependencies": [
{
"vuln_id": "CVE-2024-21762",
"vuln_package_intel_sources": [
"nvd"
],
"vulnerable_sbom_packages": [
]
},
{
"vuln_id": "GHSA-hh8p-p8mp-gqhm",
"vuln_package_intel_sources": [
"ghsa",
"nvd"
],
"vulnerable_sbom_packages": [
{
"name": "mlflow",
"version": "2.9.1",
"vulnerable_dependency_package": {
"system": "PYPI",
"name": "mlflow",
"version": "2.9.1",
"relation": "SELF"
}
},
{
"name": "mlflow",
"version": "2.9.1",
"vulnerable_dependency_package": {
"system": "PYPI",
"name": "mlflow",
"version": "2.9.1",
"relation": "SELF"
}
}
]
},
{
"vuln_id": "GHSA-3f63-hfp8-52jq",
"vuln_package_intel_sources": [
"ghsa",
"nvd",
"ubuntu",
"rhsa"
],
"vulnerable_sbom_packages": [
{
"name": "pillow",
"version": "10.1.0",
"vulnerable_dependency_package": {
"system": "PYPI",
"name": "pillow",
"version": "10.1.0",
"relation": "SELF"
}
},
{
"name": "pillow",
"version": "10.1.0",
"vulnerable_dependency_package": {
"system": "PYPI",
"name": "pillow",
"version": "10.1.0",
"relation": "SELF"
}
}
]
}
]
},
"output": [
{
"vuln_id": "CVE-2024-21762",
"checklist": [
{
"input": "Check SBOM and dependencies for vulnerability.",
"response": "The VulnerableDependencyChecker did not find any vulnerable packages or dependencies in the SBOM.",
"intermediate_steps": null
}
],
"summary": "The VulnerableDependencyChecker did not find any vulnerable packages or dependencies in the SBOM.",
"justification": {
"label": "code_not_present",
"reason": "No vulnerable packages or dependencies were detected in the SBOM.",
"status": "FALSE"
}
},
{
"vuln_id": "GHSA-hh8p-p8mp-gqhm",
"checklist": [
{
"input": "Assess Input Validation for Path Construction: Evaluate how the application constructs pathnames using external input. Check if the code properly neutralizes '\\..\filename' sequences to prevent path traversal attacks. Focus on areas where user input is used to build file paths or access directories.",
"response": "To assess the input validation for path construction in the Docker container properly, it's essential to ensure that the application follows best practices for preventing path traversal attacks. This includes sanitizing user input, using canonical paths, and avoiding direct use of user input in file path constructions without proper validation and normalization. Given the lack of specific details from the code and developer guide, the application should be reviewed against these security principles to evaluate its vulnerability to path traversal attacks.",
"intermediate_steps": null
},
{
"input": "Review File System Access Controls: Investigate the file system access controls and permissions within the container. Determine if an attacker could exploit the path traversal vulnerability to access sensitive files or directories outside of the intended restricted directory.",
"response": "The Docker container under investigation may be vulnerable to path traversal attacks due to its access to the host OS's Docker socket file and the automatic mounting of the current working directory to `/workspace`. Additionally, the presence of known vulnerabilities such as CVE-2019-5736, CVE-2022-0847, and the \"Leaky Vessels\" set of container escape vulnerabilities affecting runC and BuildKit increases the risk of exploitation. To mitigate these risks, it is essential to ensure proper container configuration, secrets management, and secure networking. A security audit or vulnerability scan should be performed to identify any potential weaknesses and apply necessary patches or fixes to prevent exploitation.",
"intermediate_steps": null
},
{
"input": "Inspect Error Handling and Logging: Examine how the application handles errors related to file system access and path construction. Ensure that error messages do not reveal sensitive information about the file system or application internals, which could aid an attacker in exploiting the vulnerability.",
"response": "The application's error handling and logging mechanisms for file system access and path construction errors are not fully specified in the provided context. However, based on best practices for secure error handling and logging in Docker containers, it is recommended to implement try-catch blocks, health checks, and proper logging configurations to prevent revealing sensitive information about the file system or application internals. To ensure the security of the Docker container, it is suggested to follow Docker logging best practices, such as using logging drivers, log rotation, and centralized logging, and to be mindful of shared storage or volumes. Additionally, using minimal base images, rebuilding images often, and excluding unnecessary files with .dockerignore can help prevent common Docker container security issues.",
"intermediate_steps": null
},
{
"input": "Evaluate Potential for Command Execution: Given that this vulnerability could lead to command execution, assess the application's use of system calls or command execution functions. Determine if an attacker could leverage the path traversal vulnerability to execute arbitrary commands on the vulnerable machine.",
"response": "The Docker container's configuration and functionality, including its access to the Docker socket file and ability to launch other containers, introduce potential risks for command execution exploits, especially if an attacker can gain access to the container or execute commands within it. However, the likelihood and impact of such exploits depend on factors such as the container's configuration, user permissions, and the security measures in place on the host system. A detailed analysis of the container's setup and security controls is necessary to fully assess the potential for command execution.",
"intermediate_steps": null
},
{
"input": "Analyze Data and Model Information Exposure: Consider the potential impact of an attacker gaining access to data and models information. Evaluate the sensitivity of this information and the potential consequences of its exposure, such as intellectual property theft or unauthorized access to sensitive data.",
"response": "The potential impact of an attacker gaining access to data and models information in the Docker container is significant, as it could result in intellectual property theft, unauthorized access to sensitive data, and reputational damage. The pre-trained models used by the Docker container are likely to contain proprietary information or algorithms, and their exposure could result in significant financial losses. Additionally, the Docker container's use of the Morpheus repository and the Triton server introduces potential vulnerabilities that could be exploited by an attacker to gain access to the models. Therefore, it is essential to implement robust security measures to protect the data and models information, including encryption, access controls, and regular vulnerability assessments.",
"intermediate_steps": null
}
],
"summary": "The CVE is exploitable. Based on the provided Checklist and Findings, definitive answers indicate that the Docker container may be vulnerable to path traversal attacks due to its access to the host OS's Docker socket file and the automatic mounting of the current working directory to `/workspace` (Checklist Item 2). Additionally, the container's configuration and functionality introduce potential risks for command execution exploits (Checklist Item 4), and the potential impact of an attacker gaining access to data and models information is significant, including intellectual property theft and unauthorized access to sensitive data (Checklist Item 5). These findings suggest that the CVE poses a notable risk and requires attention to mitigate potential exploitation.",
"justification": {
"label": "vulnerable",
"reason": "The analysis indicates that the Docker container is susceptible to path traversal attacks and command execution exploits due to its configuration and access to sensitive areas, suggesting a direct vulnerability to the CVE that necessitates patching or mitigation.",
"status": "TRUE"
}
},
{
"vuln_id": "GHSA-3f63-hfp8-52jq",
"checklist": [
{
"input": "Assess Usage of PIL.ImageMath.eval: Review the application code within the container to check if the PIL.ImageMath.eval function is being used, particularly with the environment parameter. This function is the specific target of the vulnerability.",
"response": "The Docker container under investigation does not appear to use PIL.ImageMath.eval directly, based on the provided code and context. However, due to the container's involvement in machine learning and deep learning tasks, particularly with the use of NVIDIA Triton Inference Server, it's possible that image processing tasks could be performed, potentially utilizing related libraries or functions. Further investigation into the container's specific use cases and dependencies would be necessary to conclusively determine the relevance of PIL.ImageMath.eval to the container's vulnerability profile.",
"intermediate_steps": null
},
{
"input": "Evaluate Input Handling for Environment Parameter: Does the application using PIL.ImageMath.eval process potentially untrusted input data that could include crafted environment parameters designed to exploit this vulnerability? Evaluate how the application handles and sanitizes inputs to this function.",
"response": "The application does not use the PIL library or the ImageMath.eval function, which reduces the risk of exploitation related to the PIL.ImageMath.eval function. However, the application handles environment parameters, which could potentially be used to exploit other vulnerabilities. The container uses environment variables to customize its behavior, but it is unclear how these environment variables are sanitized and validated to prevent potential exploits. Therefore, it is recommended to investigate how the application uses these environment variables and ensure that they are properly sanitized and validated to prevent potential exploits.",
"intermediate_steps": null
},
{
"input": "Review Control of Code Generation: Assess the application's control over the generation of code, especially in relation to the PIL.ImageMath.eval function. Since the CVE involves improper control of code generation, are there any measures in place to prevent arbitrary code execution through this function?",
"response": "The Docker container may be vulnerable to arbitrary code execution through the PIL.ImageMath.eval function if it uses the PIL library, as this function has been associated with several vulnerabilities related to improper control of code generation. However, without direct evidence of the library's use within the container or specific security measures in place, it's crucial to conduct a thorough review of the container's code and dependencies to assess its actual vulnerability to such attacks. Recommendations would include ensuring the container does not use vulnerable versions of the PIL library, implementing strict input validation and sanitization for any user-controlled data that could be passed to the PIL.ImageMath.eval function, and considering alternative, safer methods for image processing that do not involve evaluating arbitrary expressions.",
"intermediate_steps": null
},
{
"input": "Inspect Environment Parameter Handling: Investigate how the environment parameter is handled within the PIL.ImageMath.eval function calls. Are there any potential paths for an attacker to manipulate this parameter and achieve arbitrary code execution?",
"response": "There is a known vulnerability in the PIL library, specifically in the ImageMath.eval function, that could allow for arbitrary code execution via the environment parameter. The vulnerability is present in Pillow versions up to 10.1.0. To fix this vulnerability, it is recommended to upgrade Pillow to version 10.2 or later. However, without more information about the Docker container's dependencies and code, it's unclear if the container is using a vulnerable version of Pillow or if the ImageMath.eval function is being used in a way that could allow an attacker to manipulate the environment parameter.",
"intermediate_steps": null
},
{
"input": "Analyze Potential for Code Injection: Given the nature of the vulnerability as a code injection issue, analyze the application's potential exposure to such attacks. Consider the flow of data into the PIL.ImageMath.eval function and whether an attacker could inject malicious code through the environment parameter.",
"response": "The Docker container may be exposed to code injection attacks if it uses a version of Pillow that is vulnerable to known issues such as CVE-2022-22817 or CVE-2023-50447. To determine the version of Pillow used, you can use the `docker exec` command to enter the container and then use `python -c \"import PIL; print(PIL.__version__)\"` to check the Pillow version. If Pillow is not installed, this command will raise an `ImportError`. It is recommended to upgrade the Pillow version to a secure one to prevent code injection attacks.",
"intermediate_steps": null
}
],
"summary": "The CVE is not exploitable based on the provided checklist items with definitive answers. Checklist Item 2 provides a clear answer, stating that the application does not use the PIL library or the ImageMath.eval function, which reduces the risk of exploitation related to this vulnerability. Additionally, Checklist Item 4 provides a definitive recommendation to upgrade Pillow to version 10.2 or later to fix the vulnerability, but it does not confirm that the container is using a vulnerable version of Pillow. Since the application does not use the PIL library or the ImageMath.eval function, the risk of exploitation is reduced, indicating that the CVE is not exploitable based on the available information.",
"justification": {
"label": "code_not_reachable",
"reason": "The application is not exploitable because it does not use the PIL library or the ImageMath.eval function, which are necessary for the vulnerability to be exploited, thus the vulnerable code is not executed during runtime.",
"status": "FALSE"
}
}
]
}