Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Mandate Pillow>=10.0.1 because of libwebp CVE #16347

Merged
merged 2 commits into from
Sep 18, 2023
Merged

Mandate Pillow>=10.0.1 because of libwebp CVE #16347

merged 2 commits into from
Sep 18, 2023

Conversation

MatMaul
Copy link
Contributor

@MatMaul MatMaul commented Sep 18, 2023 •
edited by DMRobertson
Loading

Pull Request Checklist

@MatMaul MatMaul marked this pull request as ready for review September 18, 2023 12:22
@MatMaul MatMaul requested a review from a team as a code owner September 18, 2023 12:22
@DMRobertson
Copy link
Contributor

This ensures that people installing from PyPI directly will pull in a fixed version of libwebp that comes bundled in Pillow.

See

DMRobertson
DMRobertson approved these changes Sep 18, 2023
View reviewed changes
Copy link
Contributor

@DMRobertson DMRobertson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Happy if CI is.

@MatMaul MatMaul merged commit 4663d55 into develop Sep 18, 2023
37 checks passed
@MatMaul MatMaul deleted the mv/bump-pillow-webp branch September 18, 2023 13:01
MatMaul pushed a commit that referenced this pull request Sep 18, 2023
Mandate Pillow>=10.0.1 because of libwebp CVE (#16347)
053155a
OlegGirko pushed a commit to OlegGirko/synapse that referenced this pull request Sep 18, 2023
Revert "Mandate Pillow>=10.0.1 because of libwebp CVE (matrix-org#16347…
2741524 
…)"

It's not needed to update Pillow in Fedora because it has
no bundled libwebp.

Fedora has older version of Pillow, and it's OK because it's not
vulnerable to this bug.

This reverts commit 053155a.
yingziwu added a commit to yingziwu/synapse that referenced this pull request Sep 19, 2023
@yingziwu
Merge tag 'v1.92.3' into develop
79d5ffd 
This is again a security update targeted at mitigating [CVE-2023-4863](https://cve.org/CVERecord?id=CVE-2023-4863).
It turns out that libwebp is bundled statically in Pillow wheels so we need to update this dependency instead of
libwebp package at the OS level.

Unlike what was advertised in 1.92.2 changelog this release also impacts PyPI wheels and Debian packages from matrix.org.

We encourage admins to upgrade as soon as possible.

- Pillow 10.0.1 is now mandatory because of libwebp CVE-2023-4863, since Pillow provides libwebp in the wheels. ([\matrix-org#16347](matrix-org#16347))

* Bump pillow from 10.0.0 to 10.0.1. ([\matrix-org#16344](matrix-org#16344))
OlegGirko pushed a commit to OlegGirko/synapse that referenced this pull request Sep 27, 2023
Revert "Mandate Pillow>=10.0.1 because of libwebp CVE (matrix-org#16347…
473a021 
…)"

It's not needed to update Pillow in Fedora because it has
no bundled libwebp.

Fedora has older version of Pillow, and it's OK because it's not
vulnerable to this bug.

This reverts commit 053155a.
Fizzadar added a commit to beeper/synapse-legacy-fork that referenced this pull request Oct 11, 2023
@Fizzadar
Merge tag 'v1.92.3' into merge-1.92
62e332c 
This is again a security update targeted at mitigating [CVE-2023-4863](https://cve.org/CVERecord?id=CVE-2023-4863).
It turns out that libwebp is bundled statically in Pillow wheels so we need to update this dependency instead of
libwebp package at the OS level.

Unlike what was advertised in 1.92.2 changelog this release also impacts PyPI wheels and Debian packages from matrix.org.

We encourage admins to upgrade as soon as possible.

- Pillow 10.0.1 is now mandatory because of libwebp CVE-2023-4863, since Pillow provides libwebp in the wheels. ([\matrix-org#16347](matrix-org#16347))

* Bump pillow from 10.0.0 to 10.0.1. ([\matrix-org#16344](matrix-org#16344))

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQSTI7xPaHQ1yo0PA8uSL1esuTqr+QUCZQhY+QAKCRCSL1esuTqr
# +bMqAQDqRpYdK0XdLw3PkHTCVc+XrgyN2y+KT1PlSsrGkdjeMgD/fiGsiWdf+gck
# yngNrQhIIp3Co1J/zTfrRN5Hy9dCqwI=
# =dVcZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon Sep 18 15:04:41 2023 BST
# gpg:                using EDDSA key 9323BC4F687435CA8D0F03CB922F57ACB93AABF9
# gpg: Can't check signature: No public key

# Conflicts:
#	.github/workflows/latest_deps.yml
#	.github/workflows/twisted_trunk.yml
#	poetry.lock
#	synapse/config/experimental.py
#	synapse/handlers/message.py
#	synapse/rest/client/read_marker.py
OlegGirko pushed a commit to OlegGirko/synapse that referenced this pull request Dec 12, 2023
Revert "Mandate Pillow>=10.0.1 because of libwebp CVE (matrix-org#16347…
dbf3202 
…)"

It's not needed to update Pillow in Fedora because it has
no bundled libwebp.

Fedora has older version of Pillow, and it's OK because it's not
vulnerable to this bug.

This reverts commit 053155a.
OlegGirko pushed a commit to OlegGirko/synapse that referenced this pull request Dec 12, 2023
Revert "Mandate Pillow>=10.0.1 because of libwebp CVE (matrix-org#16347…
d08247b 
…)"

It's not needed to update Pillow in Fedora because it has
no bundled libwebp.

Fedora has older version of Pillow, and it's OK because it's not
vulnerable to this bug.

This reverts commit 053155a.
OlegGirko pushed a commit to OlegGirko/synapse that referenced this pull request Dec 12, 2023
Revert "Mandate Pillow>=10.0.1 because of libwebp CVE (matrix-org#16347…
7e4800a 
…)"

It's not needed to update Pillow in Fedora because it has
no bundled libwebp.

Fedora has older version of Pillow, and it's OK because it's not
vulnerable to this bug.

This reverts commit 053155a.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@DMRobertson DMRobertson DMRobertson approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MatMaul @DMRobertson