FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Updated constraints due security reasons (triggered on 2026-05-11T13:06:06+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5) by github-actions[bot] · Pull Request #28 · inab/treecript · GitHub

/ treecript Public
forked from chamilad/process-metrics-collector

Updated constraints due security reasons (triggered on 2026-05-11T13:06:06+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5) - #28

Merged
jmfernandez merged 1 commit into
execfrom
create-pull-request/patch-audit-constraints
May 12, 2026
ConversationCommits (1)ChecksFiles changed
Merged

Updated constraints due security reasons (triggered on 2026-05-11T13:06:06+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5)#28
jmfernandez merged 1 commit into
execfrom
create-pull-request/patch-audit-constraints

Conversation

github-actions Bot commented Apr 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency issues not solved for Python 3.9

Name Version ID Fix Versions Description
pillow 11.3.0 GHSA-cfh3-3jmp-rvhc 12.1.1 ### Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected. ### Patches Pillow 12.1.1 will be released shortly with a fix for this. ### Workarounds Image.open() has a formats parameter that can be used to prevent PSD images from being opened. ### References Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
pillow 11.3.0 GHSA-whj4-6x5x-4v2j 12.2.0 ### Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). ### Patches The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521). ### Workarounds Avoid Pillow >= 10.3.0, < 12.2.0 Only open specific image formats, excluding FITS.
pillow 11.3.0 GHSA-wjx4-4jcj-g98j 12.2.0 If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
pillow 11.3.0 GHSA-5xmw-vc9v-4wf2 12.2.0 Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.
pillow 11.3.0 GHSA-r73j-pqj5-w3x7 12.2.0 ### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. ### Patches Patched version: 12.2.0. PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected. ### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0 ### Resources - Fix: python-pillow/Pillow#9519
pillow 11.3.0 GHSA-pwv6-vv43-88gr 12.2.0 ### Impact Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. ### Patches Patched version: 12.2.0 Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison. ### Workarounds Use any version but affected versions: >= 10.3.0, < 12.2.0 ### Resources - Fix: python-pillow/Pillow#9520 - Original issue: CVE-2026-25990 (Pillow 12.1.1)
requests 2.32.5 GHSA-gc5v-m9x4-r6x2 2.33.0 ### Impact The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ### Affected usages Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. ### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

github-actions Bot force-pushed the create-pull-request/patch-audit-constraints branch from db2e21e to 0563ef0 Compare May 4, 2026 12:40
github-actions Bot changed the title Updated constraints due security reasons (triggered on 2026-04-27T12:38:45+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5) Updated constraints due security reasons (triggered on 2026-05-04T12:40:22+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5) May 4, 2026
github-actions Bot changed the title Updated constraints due security reasons (triggered on 2026-05-04T12:40:22+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5) Updated constraints due security reasons (triggered on 2026-05-11T13:06:06+00:00 by db83dbc42e988cb22bd3570e92348b70f64ed3e5) May 11, 2026
github-actions Bot force-pushed the create-pull-request/patch-audit-constraints branch from 0563ef0 to c43668d Compare May 11, 2026 13:06
jmfernandez merged commit 9bcdec4 into exec May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL