File matrix-synapse-older-pillow.patch of Package matrix-synapse

Overview Repositories Revisions Requests Users Attributes Meta

File matrix-synapse-older-pillow.patch of Package matrix-synapse (Revision 3dbf24d58625121fe8f583fdfc13f5d8)

Currently displaying revision 3dbf24d58625121fe8f583fdfc13f5d8 , Show latest

From dbf3202cf9eea73433ebc6c27bffeab40e9d5bf1 Mon Sep 17 00:00:00 2001
From: Oleg Girko <ol@infoserver.lv>
Date: Mon, 18 Sep 2023 18:14:32 +0100
Subject: [PATCH] Revert "Mandate Pillow>=10.0.1 because of libwebp CVE
 (#16347)"

It's not needed to update Pillow in Fedora because it has
no bundled libwebp.

Fedora has older version of Pillow, and it's OK because it's not
vulnerable to this bug.

This reverts commit 053155a2af52aa66910e4a22dad60109607b1098.
---
 pyproject.toml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 6cab77d13f..e1c574674f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -181,9 +181,7 @@ PyYAML = ">=3.13"
 pyasn1 = ">=0.1.9"
 pyasn1-modules = ">=0.0.7"
 bcrypt = ">=3.1.7"
-# 10.0.1 minimum is mandatory here because of libwebp CVE-2023-4863.
-# Packagers that already took care of libwebp can lower that down to 5.4.0.
-Pillow = ">=10.0.1"
+Pillow = ">=5.4.0"
 # We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2.
 sortedcontainers = ">=1.5.2"
 pymacaroons = ">=0.13.0"
-- 
2.43.0

Places

File matrix-synapse-older-pillow.patch of Package matrix-synapse (Revision 3dbf24d58625121fe8f583fdfc13f5d8)

Places