From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christopher Allan Webber Subject: bug#22858: Patch security vulnerability in python-pillow Date: Mon, 29 Feb 2016 14:37:32 -0800 Message-ID: <87si0bkus3.fsf@dustycloud.org> References: <87twkrl1l2.fsf@dustycloud.org> <20160229214724.GA23259@jasmine> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:33044) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaWS6-00052Q-U1 for bug-guix@gnu.org; Mon, 29 Feb 2016 17:38:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aaWS2-0003X0-Sj for bug-guix@gnu.org; Mon, 29 Feb 2016 17:38:06 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:57115) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aaWS2-0003Ww-Oq for bug-guix@gnu.org; Mon, 29 Feb 2016 17:38:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84) (envelope-from ) id 1aaWS2-0002Qq-JP for bug-guix@gnu.org; Mon, 29 Feb 2016 17:38:02 -0500 Sender: "Debbugs-submit" Resent-Message-ID: In-reply-to: <20160229214724.GA23259@jasmine> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org To: Leo Famulari Cc: 22858@debbugs.gnu.org --=-=-= Content-Type: text/plain Leo Famulari writes: >> I'm trying to figure out where the patches for this are, but I can't >> find them. I expected them to maybe be here, but I don't see them here: > > I updated python-pillow to 3.1.1 with 16095d2729, fixing these issues. > > When I did that, CVE-2016-2533 wasn't named yet, but my understanding is > that the update does address it: > https://github.com/python-pillow/Pillow/commits/e5324bd3b4195d68d4a066b16d912fca30d3c4be > > Python2-pil *is* vulnerable. However, it seems to have no users in our > source tree. Should we remove it? I think so. Here's a patch to remove it. Look good? (Not sure if this needs a review or not :)) - Chris --=-=-= Content-Type: text/x-patch Content-Disposition: inline; filename=0001-gnu-Remove-python2-pil.patch >From cbeb28d364bf2df3ef95c547b80830611254fd5c Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Mon, 29 Feb 2016 14:36:01 -0800 Subject: [PATCH] gnu: Remove python2-pil. * gnu/packages/python.scm (python2-pil): Remove variable. It is vulnerable to CVE-2016-2533, and python2-pillow provides equivalent functionality, so this package can be cleanly removed. --- gnu/packages/python.scm | 61 ------------------------------------------------- 1 file changed, 61 deletions(-) diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 812aeb0..4f34537 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -4596,67 +4596,6 @@ converts incoming documents to Unicode and outgoing documents to UTF-8.") (strip-python2-variant python-beautifulsoup4))) (native-inputs `(("python2-setuptools" ,python2-setuptools))))) -(define-public python2-pil - (package - (name "python2-pil") - (version "1.1.7") - (source - (origin - (method url-fetch) - (uri (string-append - "http://effbot.org/downloads/Imaging-" - version ".tar.gz")) - (sha256 - (base32 - "04aj80jhfbmxqzvmq40zfi4z3cw6vi01m3wkk6diz3lc971cfnw9")) - (modules '((guix build utils))) - (snippet - ;; Adapt to newer freetype. As the package is unmaintained upstream, - ;; there is no use in creating a patch and reporting it. - '(substitute* "_imagingft.c" - (("freetype/") - "freetype2/"))))) - (build-system python-build-system) - (inputs - `(("freetype" ,freetype) - ("libjpeg" ,libjpeg) - ("libtiff" ,libtiff) - ("python-setuptools" ,python-setuptools) - ("zlib" ,zlib))) - (arguments - ;; Only the fork python-pillow works with Python 3. - `(#:python ,python-2 - #:tests? #f ; no check target - #:phases - (alist-cons-before - 'build 'configure - ;; According to README and setup.py, manual configuration is - ;; the preferred way of "searching" for inputs. - ;; lcms is not found, TCL_ROOT refers to the unavailable tkinter. - (lambda* (#:key inputs #:allow-other-keys) - (let ((jpeg (assoc-ref inputs "libjpeg")) - (zlib (assoc-ref inputs "zlib")) - (tiff (assoc-ref inputs "libtiff")) - (freetype (assoc-ref inputs "freetype"))) - (substitute* "setup.py" - (("JPEG_ROOT = None") - (string-append "JPEG_ROOT = libinclude(\"" jpeg "\")")) - (("ZLIB_ROOT = None") - (string-append "ZLIB_ROOT = libinclude(\"" zlib "\")")) - (("TIFF_ROOT = None") - (string-append "TIFF_ROOT = libinclude(\"" tiff "\")")) - (("FREETYPE_ROOT = None") - (string-append "FREETYPE_ROOT = libinclude(\"" - freetype "\")"))))) - %standard-phases))) - (home-page "http://www.pythonware.com/products/pil/") - (synopsis "Python Imaging Library") - (description "The Python Imaging Library (PIL) adds image processing -capabilities to the Python interpreter.") - (license (x11-style - "file://README" - "See 'README' in the distribution.")))) - (define-public python2-cssutils (package (name "python2-cssutils") -- 2.6.3 --=-=-=--