doc: Security update by Dependabot #592
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
qwersem
force-pushed
the
semenov-upgrade-py-pillow-pkg
branch
from
de88a07 to
cd1ccec
Compare
abrodkin
approved these changes
Jan 24, 2024
PyYAML 6.0.0 is broken with cython 3, so this package is upgraded to 6.0.1, see yaml/pyyaml#724 (comment). Signed-off-by: Evgeny Semenov <[email protected]>
Upgrade the Python Pillow package to 10.2.0 by the Dependabot alert. This package affects on other reportlab and rst2pdf packages, which were also upgraded in this commit. Dependabot alerts: "< 10.0.0": Pillow Denial of Service vulnerability. An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. "< 10.0.1": - Bundled libwebp in Pillow vulnerable. Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. - libwebp: OOB write in BuildHuffmanTable. Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. "< 10.2.0": Arbitrary Code Execution in Pillow. Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Signed-off-by: Evgeny Semenov <[email protected]>
qwersem
force-pushed
the
semenov-upgrade-py-pillow-pkg
branch
6 times, most recently
from
747211f to
851626e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Upgrade the Python Pillow package to 10.2.0 by the Dependabot alert. This package affects on other packages: PyYAML, reportlab and rst2pdf, which were also upgraded in this commit.