Skip to content

Commit

Permalink
Added release notes for 9.0.1
Browse files Browse the repository at this point in the history
  • Loading branch information
radarhere committed Feb 2, 2022
1 parent 02affaa commit 4fabec3
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 0 deletions.
23 changes: 23 additions & 0 deletions docs/releasenotes/9.0.1.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
9.0.1
-----

Security
========

This release addresses several security problems.

:cve:`CVE-2022-24303`: If the path to the temporary directory on Linux or macOS
contained a space, this would break removal of the temporary image file after
``im.show()`` (and related actions), and potentially remove an unrelated file. This
been present since PIL.

This comment has been minimized.

Copy link
@mara004

mara004 Feb 3, 2022

This been present since PIL - sentence is incomplete

This comment has been minimized.

Copy link
@hugovk

hugovk Feb 3, 2022

Member

It means at least since Pillow was forked (July 2010) from PIL 1.1.7 (November 2009).

https://mail.python.org/pipermail/image-sig/2010-July/006423.html

This comment has been minimized.

Copy link
@mara004

mara004 Feb 3, 2022

Yeah, but a had is mising anyway. It should be: This had been present since PIL, or better This had been present since Pillow was forked from PIL.

This comment has been minimized.

Copy link
@radarhere

radarhere Feb 3, 2022

Author Member

I've created #6016


:cve:`CVE-2022-22817`: While Pillow 9.0 restricted top-level builtins available to
:py:meth:`PIL.ImageMath.eval`, it did not prevent builtins available to lambda
expressions. These are now also restricted.

Other Changes
=============

Pillow 9.0 added support for ``xdg-open`` as an image viewer, but there have been
reports that the temporary image file was removed too quickly to be loaded into the
final application. A delay has been added.
1 change: 1 addition & 0 deletions docs/releasenotes/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ expected to be backported to earlier versions.
.. toctree::
:maxdepth: 2

9.0.1
9.0.0
8.4.0
8.3.2
Expand Down

0 comments on commit 4fabec3

Please sign in to comment.