Subject: bug#47259: closed (Re: bug#47259: python-pillow-simd package vulnerable to at least CVE-2021-25293)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 23 Mar 2022 02:59:02 +0000

Your bug report

#47259: python-pillow-simd package vulnerable to at least CVE-2021-25293

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
47259: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47259
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#47259: python-pillow-simd package vulnerable to at least CVE-2021-25293
From: Maxim Cournoyer <[email-masked]>
To: Léo Le Bouter <[email-masked]>
Cc: [email-masked]
Date: Tue, 22 Mar 2022 22:57:55 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Léo,

Léo Le Bouter <[email-masked]> writes:

> Hello!
>
> pillow-simd is a fork of pillow (
> https://github.com/uploadcare/pillow-simd), it's currently still at
> version 7.x and it does not seem like it backports security patches
> from pillow.

Thanks for the heads-up; our package is currently at 9.0.0, and I've
just updated it to 9.0.0.post1.

Closing.

Maxim

Subject: python-pillow-simd package vulnerable to at least CVE-2021-25293
From: Léo Le Bouter <[email-masked]>
To: [email-masked]
Date: Fri, 19 Mar 2021 11:37:09 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello!

pillow-simd is a fork of pillow (
https://github.com/uploadcare/pillow-simd), it's currently still at
version 7.x and it does not seem like it backports security patches
from pillow.

$ ./pre-inst-env guix refresh -l python-pillow-simd
No dependents other than itself: [email-masked]

Do we remove it? Do we want to commit to backporting/applying all fixes
from python-pillow back in python-pillow-simd ourselves (I don't)?

Léo