python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-10-26 05:31:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Add CVE IDs

Browse Source
This commit is contained in:
Hugo van Kemenade 2022-01-07 22:48:26 +02:00 committed by Andrew Murray
parent 82541b6dec
commit 2e9c461ca4
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES.rst
View File

@ -5,13 +5,13 @@ Changelog (Pillow)
9.0.0 (2022-01-02) 9.0.0 (2022-01-02)
------------------ ------------------
- Restrict builtins for ImageMath.eval(). CVE TBD #5923 - Restrict builtins for ImageMath.eval(). CVE-2022-22817 #5923
[radarhere] [radarhere]
- Ensure JpegImagePlugin stops at the end of a truncated file #5921 - Ensure JpegImagePlugin stops at the end of a truncated file #5921
[radarhere] [radarhere]
- Fixed ImagePath.Path array handling. CVEs TBD #5920 - Fixed ImagePath.Path array handling. CVE-2022-22815, CVE-2022-22816 #5920
[radarhere] [radarhere]
- Remove consecutive duplicate tiles that only differ by their offset #5919 - Remove consecutive duplicate tiles that only differ by their offset #5919

11
docs/releasenotes/9.0.0.rst
View File

@ -119,15 +119,16 @@ Google's `OSS-Fuzz`_ project for finding this issue.
Restrict builtins available to ImageMath.eval Restrict builtins available to ImageMath.eval
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To limit :py:class:`PIL.ImageMath` to working with images, Pillow will now restrict the :cve:`CVE-2022-22817`: To limit :py:class:`PIL.ImageMath` to working with images, Pillow
builtins available to :py:meth:`PIL.ImageMath.eval`. This will help prevent problems will now restrict the builtins available to :py:meth:`PIL.ImageMath.eval`. This will
arising if users evaluate arbitrary expressions, such as help prevent problems arising if users evaluate arbitrary expressions, such as
``ImageMath.eval("exec(exit())")``. CVE TBD ``ImageMath.eval("exec(exit())")``.
Fixed ImagePath.Path array handling Fixed ImagePath.Path array handling
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
CWE-126 and CWE-665 were found when initializing ``ImagePath.Path``. CVEs TBD :cve:`CVE-2022-22815` (CWE-126) and :cve:`CVE-2022-22816` (CWE-665) were found when
initializing ``ImagePath.Path``.
.. _OSS-Fuzz: https://github.com/google/oss-fuzz .. _OSS-Fuzz: https://github.com/google/oss-fuzz