Skip to content

python3Packages.pillow: 8.4.0 -> 9.0.0, python3Packages.imageio: 2.13.2 -> 2.13.5#154825

Merged
SuperSandro2000 merged 2 commits intoNixOS:stagingfrom
risicle:ris-pillow-9.0.0
Jan 13, 2022
Merged

python3Packages.pillow: 8.4.0 -> 9.0.0, python3Packages.imageio: 2.13.2 -> 2.13.5#154825
SuperSandro2000 merged 2 commits intoNixOS:stagingfrom
risicle:ris-pillow-9.0.0

Conversation

@risicle
Copy link
Contributor

@risicle risicle commented Jan 13, 2022 •
edited
Loading

Motivation for this change

https://nvd.nist.gov/vuln/detail/CVE-2022-22815
https://nvd.nist.gov/vuln/detail/CVE-2022-22816
https://nvd.nist.gov/vuln/detail/CVE-2022-22817

I wouldn't consider these as severe as most pillow vulnerabilities - only moderately rare use cases would be vulnerable.

Bumped imageio and added a patch to fix its behaviour and tests with pillow 9.

Have also built from python39Packages: kivy tilequant mahotas pydicom pilkit cairosvg piexif pytesseract bokeh wordcloud faker pikepdf imageio python-mapnik imageio on macos 10.15 and nixos x86_64.

These vulnerabilities look quite patchable so no backport label.

Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.05 Release Notes (or backporting 21.11 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@risicle risicle added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jan 13, 2022
@github-actions github-actions bot added the 6.topic: python Python is a high-level, general-purpose programming language. label Jan 13, 2022
@ofborg ofborg bot added 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 1001-2500 This PR causes many rebuilds on Linux and should target the staging branches. labels Jan 13, 2022
@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Jan 13, 2022

@ofborg build python3Packages.pillow python3Packages.imageio

@SuperSandro2000 SuperSandro2000 merged commit d6374a3 into NixOS:staging Jan 13, 2022
@risicle risicle mentioned this pull request Jan 14, 2022
Merged
13 tasks
vcunat pushed a commit that referenced this pull request Jan 29, 2022
@SuperSandro2000 @vcunat
Merge #154825: python3Packages.{pillow,imageio}: security updates
76b70d0 
(cherry picked from commit d6374a3)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SuperSandro2000 SuperSandro2000 SuperSandro2000 approved these changes

@FRidh FRidh Awaiting requested review from FRidh

@jonringer jonringer Awaiting requested review from jonringer

@prikhi prikhi Awaiting requested review from prikhi

@cillianderoiste cillianderoiste Awaiting requested review from cillianderoiste

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 6.topic: python Python is a high-level, general-purpose programming language. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 1001-2500 This PR causes many rebuilds on Linux and should target the staging branches.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@risicle @SuperSandro2000