CVE-2021-28677

Advisory

Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Changed

- ``!lore`` can now replace ``role_slug`` (:class:`.config.Role` attributes
only) with role mention;
- ``!doas`` can now act for players that left the server (limited range);
- Database host and name is now printed at bot startup;
- ``.gitignore`` now ignores all ``start_bot*.py`` files.

Fixed

- ``!open``/``!close``: new safety check to avoid double opening/closing;
- Added :obj:`.config.is_ready` to avoid double :meth:`.LGBot.on_ready` calls;
- Added unique constraint to :class:`.bdd.Role`-:class:`.bdd.BaseAction`
junction table to avoid duplicate rows;
- ``!boudoir``: dead players could create some and sometimes write messages in;
- ``!lore`` did not correctly detect some docs ID;
- ``!lore`` formatting failed on some specific cases (e.g bullet lists +
italic);
- ``!action``: :attr:`.bdd.UtilEtat.remplie` was sometimes used istead of
:attr:`.bdd.UtilEtat.ignoree`;
- Fixed fatal errors on :func:`.blocs.tools.private` commands warning
messages, :func:`.features.voter_agir.get_cible`, ``!infos``, and role
creation detection (if missing required roles);
- Bumped dependencies security upgrades.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28677