GHSA-j7hp-h8jx-5ppr
HighKEVAdvisory
Published 12 Sept 2023In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.8
- base score, highest
- EPSS
- 1.000
- 100th percentile
- CISA KEV
- Listed
- since 13 Sept 2023
- Charts affected
- 74
- of 17,781 indexed, latest versions
- Container images
- 74
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
libwebp: OOB write in BuildHuffmanTable
Carried by container images the latest versions of 74 of 17,781 indexed charts deploy, on 74 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pillowpypi | 2.6.1, 4.3.0, 5.0.0, 5.1.0+21 more | 10.0.1 | 68 |
| SkiaSharpnuget | 2.80.2, 2.88.1-preview.71, 2.88.2, 2.88.3 | 2.88.6 | 6 |
- OSV records
- GHSA-j7hp-h8jx-5pprPYSEC-2026-1794
- Also known as
- A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, RUSTSEC-2023-0060, RUSTSEC-2023-0061
Charts affected
74 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| beetsgeek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 1,150 |
| delugegeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 13,551 |
| embygeek-cookbookVerified publisher | 3.4.2 | 1 of 1See more | 8,545 |
| jellyfingeek-cookbookVerified publisher | 9.5.3 | 1 of 1See more | 1,381 |
| mylargeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 1,423 |
| pyloadgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 1,236 |
| seafilegeek-cookbookVerified publisher | 3.2.0 | 1 of 1See more | 24,293 |
| weblatehelm-charts-nr | 0.3.2 | 1 of 3See more | 7,984 |
| erpnextimprowisedVerified publisher | 3.3.0 | 1 of 3See more | 6,501 |
| twitch-channel-points-minerjacobcolvinVerified publisher | 0.1.0 | 1 of 1See more | 1,088 |
| deconzjanip81-helm-chartsVerified publisher | 0.1.1 | 1 of 1See more | 10,780 |
| frigatek8s-home-lab-repo | 9.1.1 | 1 of 1See more | 2,370 |
| exposureloglsst-sqre | 0.2.1 | 1 of 1See more | 2,078 |
| mlflowmondata-helm-chartsVerified publisher | 0.2.3 | 1 of 1See more | 3,811 |
| face-recognitionmoreillonVerified publisher | 0.2.4 | 1 of 3See more | 8,556 |
| mlflowncsaVerified publisher | 1.2.1 | 1 of 4See more | 5,456 |
| polyglotncsaVerified publisher | 0.1.1 | 1 of 18See more | 55,726 |
| splashntppoolVerified publisher | 1.0.4 | 1 of 1See more | 27,633 |
| seafilephybros-helm-charts | 4.0.1 | 1 of 1See more | 22,084 |
| cupsr2dlan-helm-chartsVerified publisher | 0.1.0 | 1 of 1See more | 7,685 |
| weblateslamdev | 0.0.11 | 1 of 2See more | 8,694 |
| frigatesmarthallVerified publisher | 1.0.6 | 1 of 1See more | 2,243 |
| krokiteochenglim | 1.0.1 | 1 of 5See more | 8,715 |
| synapsetranhailongVerified publisher | 0.1.0 | 1 of 2See more | 3,164 |
Container images carrying it
74 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dpage/ | 781369df9994 | pillow | 10.0.1 | 3 |
| blakeblackshear/ | 8330b0a265b8 | pillow | 10.0.1 | 2 |
| weblate/ | 69c160d37a3c | pillow | 10.0.1 | 2 |
| allegroai/ | fca885e8cfc6 | pillow | 10.0.1 | 1 |
| allegroai/ | c58d9da7bdf8 | pillow | 10.0.1 | 1 |
| anujdatar/ | 685df04a643b | pillow | 10.0.1 | 1 |
| apache/ | 975ab033580d | pillow | 10.0.1 | 1 |
| apsl/ | 51e2de5c2c70 | pillow | 10.0.1 | 1 |
| assistiot/ | b1dbe4d62a03 | pillow | 10.0.1 | 1 |
| blakeblackshear/ | ae269270ad9e | pillow | 10.0.1 | 1 |
| buntha/ | 154542cc3083 | pillow | 10.0.1 | 1 |
| camerahub/ | a5af37dd6e1b | pillow | 10.0.1 | 1 |
| daskdev/ | 4ecd7bc35500 | pillow | 10.0.1 | 1 |
| daskdev/ | 052630f5ca04 | pillow | 10.0.1 | 1 |
| deconzcommunity/ | 062de2362641 | pillow | 10.0.1 | 1 |
| deconzcommunity/ | 6541bbb78952 | pillow | 10.0.1 | 1 |
| dpage/ | 37946e4f3e7b | pillow | 10.0.1 | 1 |
| emby/ | 22298eefb428 | SkiaSharp | 2.88.6 | 1 |
| esphome/ | 3f51ec10e823 | pillow | 10.0.1 | 1 |
| evk02/ | ef6ff257ef35 | pillow | 10.0.1 | 1 |
| factly/ | ca5bc71d1d5c | pillow | 10.0.1 | 1 |
| geoscienceaustralia/ | f4039b45572a | pillow | 10.0.1 | 1 |
| hhyo/ | 1aa41843419e | pillow | 10.0.1 | 1 |
| hkotel/ | a7e6b6abe087 | pillow | 10.0.1 | 1 |
| improwised/ | 97280b55cbd4 | pillow | 10.0.1 | 1 |
| jellyfin/ | 05a9734d7e83 | SkiaSharp | 2.88.6 | 1 |
| jellyfin/ | ee24f4459a40 | SkiaSharp | 2.88.6 | 1 |
| kobotoolbox/ | b15679454415 | pillow | 10.0.1 | 1 |
| kobotoolbox/ | bcacc01bccd4 | pillow | 10.0.1 | 1 |
| linuxserver/ | f7d7c7704249 | pillow | 10.0.1 | 1 |
| linuxserver/ | e36d16f7341c | pillow | 10.0.1 | 1 |
| linuxserver/ | 89cd8d5fb1ac | pillow | 10.0.1 | 1 |
| linuxserver/ | c4d2766b9eb7 | pillow | 10.0.1 | 1 |
| linuxserver/ | 0ac871624394 | pillow | 10.0.1 | 1 |
| linuxserver/ | 2ce561a95e7b | pillow | 10.0.1 | 1 |
| linuxserver/ | 2427dde159a2 | SkiaSharp | 2.88.6 | 1 |
| linuxserver/ | f93d2560e233 | pillow | 10.0.1 | 1 |
| linuxserver/ | e48b479c1891 | pillow | 10.0.1 | 1 |
| lsstsqre/ | 79b00fb67a65 | pillow | 10.0.1 | 1 |
| matrixdotorg/ | cb89c0f17ba1 | pillow | 10.0.1 | 1 |
| matrixdotorg/ | def97fd537d8 | pillow | 10.0.1 | 1 |
| mcronce/ | f820ef2e3c26 | pillow | 10.0.1 | 1 |
| mcronce/ | c03c1c7f5aa9 | pillow | 10.0.1 | 1 |
| mide/ | 4eee0dcb715f | pillow | 10.0.1 | 1 |
| mondata/ | 6f94c6caf8bf | pillow | 10.0.1 | 1 |
| moreillon/ | bacb2ddd8394 | pillow | 10.0.1 | 1 |
| mvitale1989/ | 1504ccda06df | pillow | 10.0.1 | 1 |
| ncsapolyglot/ | 438d82cdbdb5 | pillow | 10.0.1 | 1 |
| netboxcommunity/ | 3d652dca5351 | pillow | 10.0.1 | 1 |
| nlmacamp/ | 5dbb8589f824 | pillow | 10.0.1 | 1 |