cesnimda
17 KiB
17 KiB
SEC-M01 / SEC-M03 — individual advisory dispositions
Scoped assessment complete; broad regression still pending. Every original alias is retained in DISPOSITIONS.json, with affected-range references, installed version, role, function, reachability, fix evidence, confidence, residual scope and exact source/test references. The current source image, real fixtures and limits are documented in dependency remediation.
Original109 =65 previous repairs +44 investigated here. Current original dispositions:99 fixed/version-verified and10 explicitly scoped Not affected. Nine alternate-loader/conversion issues have no verified general upstream fix; numeric55554 has open/conflicting upstream evidence. Their service-scoped exclusions are not global patch claims. The new pytest group is separate:110 tracked groups total.
The actual63-distribution scan returns0records/126requests, with the exact CPU-version PyPI404 retained as INCOMPLETE coverage. OSV exact local-version lookup and official CPU wheel/hash evidence are separate. No scanner suppression or owner risk acceptance occurs. All current decisions must be reconsidered if a named scope falsifier becomes applicable.
| Package / group | Installed | Disposition | Evidence/operation |
|---|---|---|---|
| certifi / GHSA-6q48-6c7w-9gw2 | 2026.10.19 | Fixed and verified | certifi bundles emSign root CAs with compromised intermediate CA keys |
| filelock / CVE-2026-112940 | 4.2.1 | Fixed and verified | ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling |
| filelock / CVE-2026-112913 | 4.2.1 | Fixed and verified | ReadWriteLock Windows SQLite -wal/-journal/-shm handling |
| filelock / CVE-2026-112907 | 4.2.1 | Fixed and verified | SoftFileLock marker open/stale breaking on Windows oplock |
| pillow / GHSA-4558-3h8r-v8xp | 13.0.0 | Fixed and verified | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size |
| pillow / GHSA-8g5g-8vmr-9782 | 13.0.0 | Fixed and verified | Pillow: Heap buffer overflow in ImagingJpegDecode |
| pillow / GHSA-rfgq-q3w2-pmv2 | 13.0.0 | Fixed and verified | Pillow: Image.quantize() with empty palette leaks uninitialized stack memory |
| pillow / GHSA-xvh5-g6gv-559v | 13.0.0 | Fixed and verified | Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags |
| pillow / GHSA-p4wg-p73j-c528 | 13.0.0 | Fixed and verified | Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) |
| pillow / GHSA-65qm-jvmh-6pqg | 13.0.0 | Fixed and verified | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS |
| pillow / GHSA-58r4-6rv3-gfh8 | 13.0.0 | Fixed and verified | Pillow: Out-of-bounds access in _imagingmorph on a zero-width image |
| pillow / GHSA-pchr-8j38-3x4p | 13.0.0 | Fixed and verified | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read |
| pillow / GHSA-q45j-58j2-45rg | 13.0.0 | Fixed and verified | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips |
| pillow / GHSA-462x-pgg6-55fp | 13.0.0 | Fixed and verified | Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) |
| pillow / GHSA-c6hw-5grf-ff96 | 13.0.0 | Fixed and verified | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels |
| pillow / GHSA-vx6w-vv9f-6gvg | 13.0.0 | Fixed and verified | Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit |
| pillow / GHSA-7mwm-ghpf-9vrm | 13.0.0 | Fixed and verified | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform |
| pillow / GHSA-w889-685w-c8fh | 13.0.0 | Fixed and verified | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| pillow / GHSA-j4m9-6w36-pw47 | 13.0.0 | Fixed and verified | Pillow: Invalid free in FreeType glyph rendering when a stroker is active |
| pillow / GHSA-27h8-gf7j-v5hc | 13.0.0 | Fixed and verified | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images |
| pillow / GHSA-fc9g-5qg7-mf45 | 13.0.0 | Fixed and verified | Pillow: Quadratic GIF comment copying during save |
| pillow / GHSA-cp9v-662q-vvx9 | 13.0.0 | Fixed and verified | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 |
| pillow / GHSA-22hg-r758-rrw9 | 13.0.0 | Fixed and verified | Pillow: Infinite loop in MIC n_frames when the embedded TIFF |
| pillow / GHSA-74r2-7ff9-mjj2 | 13.0.0 | Fixed and verified | Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() |
| pillow / GHSA-xgh8-jp6q-p5x8 | 13.0.0 | Fixed and verified | Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes |
| pillow / GHSA-254f-3936-288h | 13.0.0 | Fixed and verified | Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() |
| pillow / GHSA-jg86-v3jv-hrpm | 13.0.0 | Fixed and verified | Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) |
| pillow / GHSA-f2g6-542v-9j58 | 13.0.0 | Fixed and verified | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle |
| pillow / GHSA-5xm2-6676-qcp9 | 13.0.0 | Fixed and verified | Pillow: APNG background disposal allocates full canvas before decompression bomb check |
| pillow / GHSA-gg2r-wvfm-q9rx | 13.0.0 | Fixed and verified | Pillow: MSP RLE decoder expands a tiny file into unbounded memory |
| pillow / GHSA-332p-7hrc-92wf | 13.0.0 | Fixed and verified | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| pillow / GHSA-4rr5-89j8-mwwm | 13.0.0 | Fixed and verified | Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer |
| pillow / GHSA-24rc-8hj2-v98c | 13.0.0 | Fixed and verified | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode |
| pillow / GHSA-4rm8-3hmm-39fg | 13.0.0 | Fixed and verified | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise |
| pillow / GHSA-mrfp-p49p-3hf2 | 13.0.0 | Fixed and verified | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion |
| pillow / GHSA-3j72-p6qg-6xp7 | 13.0.0 | Fixed and verified | Pillow: TarIO negative size field causes infinite CPU-spin loop |
| pillow / GHSA-v9pv-5gc8-w2m6 | 13.0.0 | Fixed and verified | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| pillow / GHSA-g4qv-2jxx-769h | 13.0.0 | Fixed and verified | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time |
| pillow / GHSA-g842-9rc4-69pw | 13.0.0 | Fixed and verified | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS |
| pillow / GHSA-9v9v-9qvf-h2hj | 13.0.0 | Fixed and verified | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) |
| pillow / GHSA-g7cr-3p24-7wf7 | 13.0.0 | Fixed and verified | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer |
| pillow / GHSA-p8hx-v2p6-rp84 | 13.0.0 | Fixed and verified | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) |
| pillow / GHSA-78g4-xqwv-q3g8 | 13.0.0 | Fixed and verified | Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() |
| pillow / GHSA-654x-cwwv-5j9c | 13.0.0 | Fixed and verified | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 |
| pillow / GHSA-5x8w-8jj5-q52h | 13.0.0 | Fixed and verified | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| pypdf / GHSA-5jq2-8x83-x246 | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes/large memory usage when parsing indirect objects |
| pypdf / GHSA-fp3h-c4fm-7vvf | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) |
| pypdf / GHSA-w23x-9jrw-r45c | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage when retrieving alphabetical page labels |
| pypdf / GHSA-v247-6f48-mgcj | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes with large amount of embedded files |
| pypdf / GHSA-jw7q-gvrg-4vj3 | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) |
| pypdf / GHSA-g9cg-prrw-2r8q | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage when parsing font data |
| pypdf / GHSA-qv6h-rv94-w285 | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage when retrieving Roman page labels |
| pypdf / GHSA-php9-fj8v-98fj | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes when generating appearance streams |
| pypdf / GHSA-qfv9-64jg-mh7p | 6.21.2 | Fixed and verified | pypdf: Possible infinite loop in PdfWriter.find_outline_item |
| pypdf / GHSA-7mh2-4gg2-979f | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage for streams with multiple filters |
| pypdf / GHSA-9mx8-4j7g-633p | 6.21.2 | Fixed and verified | pypdf: Possible infinite loop when removing tree items |
| pypdf / GHSA-39mj-jf6j-2qj3 | 6.21.2 | Fixed and verified | pypdf: Possible infinite loop when hitting EOF in standard xref table |
| pypdf / GHSA-5hx5-vpf9-5wcv | 6.21.2 | Fixed and verified | pypdf: Unvalidated JPEG image data loading |
| pypdf / GHSA-cgf9-327m-v77c | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage when parsing content streams |
| pypdf / GHSA-f54x-cmq8-qg57 | 6.21.2 | Fixed and verified | pypdf: Possible large memory usage when parsing arrays and dictionaries |
| pypdf / GHSA-6vvc-x485-93v7 | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes/large memory usage when retrieving form fields |
| pypdf / GHSA-6c7f-9265-g8fw | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes for repeated references to the same missing object |
| pypdf / GHSA-jr96-gvgh-j3r4 | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) |
| pypdf / GHSA-gmh7-3g9r-mjh5 | 6.21.2 | Fixed and verified | pypdf: Possible long runtimes for large xref table header limits |
| setuptools / GHSA-xmj3-9gf7-h52w | 84.1.0 | Fixed and verified | setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description |
| torch / CVE-2025-3001 | 2.13.0+cpu | Fixed and verified | torch.lstm_cell / native LSTM cell tensor validation |
| torch / CVE-2025-3000 | 2.13.0+cpu | Fixed and verified | torch.jit.script compilation |
| torch / CVE-2025-2999 | 2.13.0+cpu | Fixed and verified | torch.nn.utils.rnn.unpack_sequence |
| torch / CVE-2025-2953 | 2.13.0+cpu | Fixed and verified | torch.mkldnn_max_pool2d |
| torch / CVE-2025-46148 | 2.13.0+cpu | Fixed and verified | nn.PairwiseDistance(p=2), eager/Inductor inconsistent result |
| torch / CVE-2025-46149 | 2.13.0+cpu | Fixed and verified | nn.Fold Inductor code generation assertion |
| torch / CVE-2025-46150 | 2.13.0+cpu | Fixed and verified | FractionalMaxPool2d torch.compile correctness |
| torch / CVE-2025-46152 | 2.13.0+cpu | Fixed and verified | bitwise_right_shift boundary shift in Inductor |
| torch / CVE-2025-46153 | 2.13.0+cpu | Fixed and verified | bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d |
| torch / CVE-2025-55551 | 2.13.0+cpu | Fixed and verified | torch.linalg.lu with slicing in Inductor/AOT |
| torch / CVE-2025-55552 | 2.13.0+cpu | Fixed and verified | torch.rot90 and randn_like compiled graph |
| torch / CVE-2025-55553 | 2.13.0+cpu | Fixed and verified | proxy_tensor.py tracing .random_ syntax error |
| torch / CVE-2025-55554 | 2.13.0+cpu | Not affected, with evidence | torch.nan_to_num then long edge-case numeric conversion |
| torch / CVE-2025-55557 | 2.13.0+cpu | Fixed and verified | Inductor compiled cummin Triton NameError |
| torch / CVE-2025-55558 | 2.13.0+cpu | Fixed and verified | Inductor Conv2d/hardshrink/view/mv compiler failure |
| torch / CVE-2025-55560 | 2.13.0+cpu | Fixed and verified | Inductor to_sparse/to_dense lowering |
| torch / CVE-2026-4538 | 2.13.0+cpu | Not affected, with evidence | torch.export.load .pt2 deserialization |
| torch / CVE-2025-3730 | 2.13.0+cpu | Fixed and verified | torch.nn.functional.ctc_loss / native LossCTC |
| torch / CVE-2026-24747 | 2.13.0+cpu | Fixed and verified | torch.load(weights_only=True) unpickler memory corruption |
| transformers / CVE-2025-14929 | 5.10.0 | Not affected, with evidence | X-CLIP checkpoint conversion unsafe deserialization |
| transformers / CVE-2025-2099 | 5.10.0 | Fixed and verified | testing_utils.preprocess_string doctest ReDoS |
| transformers / CVE-2025-14926 | 5.10.0 | Not affected, with evidence | SEW conversion convert_config string eval |
| transformers / CVE-2025-14930 | 5.10.0 | Not affected, with evidence | GLM4 weights parsing unsafe deserialization |
| transformers / CVE-2025-14920 | 5.10.0 | Not affected, with evidence | Perceiver model conversion/deserialization |
| transformers / CVE-2025-14921 | 5.10.0 | Not affected, with evidence | Transformer-XL tokenizer/model pickle deserialization |
| transformers / CVE-2025-14924 | 5.10.0 | Not affected, with evidence | megatron_gpt2 checkpoint conversion deserialization |
| transformers / CVE-2025-14927 | 5.10.0 | Not affected, with evidence | SEW-D convert_config eval |
| transformers / CVE-2025-14928 | 5.10.0 | Not affected, with evidence | HuBERT convert_config eval |
| transformers / CVE-2025-3933 | 5.10.0 | Fixed and verified | DonutProcessor.token2json ReDoS |
| transformers / CVE-2025-6638 | 5.10.0 | Fixed and verified | MarianTokenizer.remove_language_code ReDoS |
| transformers / CVE-2025-3264 | 5.10.0 | Fixed and verified | dynamic_module_utils.get_imports Python-source regex |
| transformers / CVE-2025-1194 | 5.10.0 | Fixed and verified | SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS |
| transformers / CVE-2025-3777 | 5.10.0 | Fixed and verified | image_utils video URL username validation |
| transformers / CVE-2025-6051 | 5.10.0 | Fixed and verified | CLVP EnglishNormalizer.normalize_numbers ReDoS |
| transformers / CVE-2025-6921 | 5.10.0 | Fixed and verified | AdamWeightDecay._do_use_weight_decay user regex |
| transformers / CVE-2025-3263 | 5.10.0 | Fixed and verified | configuration_utils.get_configuration_file ReDoS |
| transformers / CVE-2025-5197 | 5.10.0 | Fixed and verified | convert_tf_weight_name_to_pt_weight_name ReDoS |
| transformers / CVE-2026-1839 | 5.10.0 | Fixed and verified | Trainer._load_rng_state unsafe torch.load |
| transformers / CVE-2026-4372 | 5.10.0 | Fixed and verified | model initialization config attention-kernel code loading |
| transformers / CVE-2026-5241 | 5.10.0 | Fixed and verified | LightGlue nested AutoConfig remote-code override |
| transformers / CVE-2026-9856 | 5.10.0 | Fixed and verified | tokenizer/Processor save_pretrained chat_template traversal |
| urllib3 / GHSA-vxq7-64xx-v4gw | 2.8.0 | Fixed and verified | urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory |
| urllib3 / GHSA-gh4c-6fx4-qh6g | 2.8.0 | Fixed and verified | urllib3: Chunked Deflate streaming can enter an infinite loop |
| urllib3 / GHSA-8988-9cw3-xx77 | 2.8.0 | Fixed and verified | urllib3: HTTPS proxy TLS configuration may be ignored or overridden |
Additional test group: pytest GHSA-6w46-j5rx-g56g/CVE-2025-71176 —8.3.5→9.0.3, fixed/version-verified with59-case successor and fresh installed audit. It is not silently merged into the original109.
Production cache ownership/migration, base/native package supply chain, full trained checkpoint, GPU, C11/AI semantics, genuine manual/device/provider evidence and production recovery remain independent qualifications. Actual API-level cancellation of full-model inference is not established by the bounded qualification worker.
Final25October2026 qualification
All109 original groups retain individual dispositions:65 previously addressed plus44 assessed here produce99 fixed/version-verified and10 narrowly not affected within the actual Jobjakt path. One separately tracked pytest group is fixed at9.0.3. No upstream vulnerability is declared globally fixed merely because its path is unused.
The actual source image with exact55 runtime/61 test pins passes59 sidecar cases and both real BART formats,9 integrity/lock cases, synthetic parser/OCR and HTTP startup. The original trained DistilBART checkpoint also passes actual offline repository-cache loading,1024-token processing, finite logits, generation and auth/repeat-cache contracts under Torch2.13/Transformers5.10. Its pinned1,222,317,369bytes match SHA2563bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea.
Final installed review covers63 distributions/126 queries and0 advisory records, with the retained vendor PyPI404 for torch2.13.0+cpu. The scanner therefore remains INCOMPLETE; conditional scoped security qualification uses separate official wheel/vendor/current-source and real-model evidence. This is not a clean two-provider scan, image-wide/stdlib audit, semantic AI approval or production deployment. See validation.json, verdicts.json and the final qualification hashes in DISPOSITIONS.json.