CVE-2022-24303

Advisory

Renku 1.0.6 updates its dependency 'pillow' to v9.0.1 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------------------------------------------------------------------------------------------

Bug Fixes
~~~~~~~~~

- **core:** fix file size in dataset imported from renku
(`2637 <https://github.com/SwissDataScienceCenter/renku-python/issues/2637>`__)
(`fc58c81 <https://github.com/SwissDataScienceCenter/renku-python/commit/fc58c8100ebb0ecb31038d21f899ae953758a04d>`__)
- **service:** bump Pillow to 9.0+ to fix security vulnerability
(`2645 <https://github.com/SwissDataScienceCenter/renku-python/issues/2645>`__)
(`6002279 <https://github.com/SwissDataScienceCenter/renku-python/commit/6002279767c3b2ce9cfe2ee56691a47c8869780d>`__)
- **service:** remove json requirement from project.lock_status
(`2676 <https://github.com/SwissDataScienceCenter/renku-python/issues/2676>`__)
(`7744a2d <https://github.com/SwissDataScienceCenter/renku-python/commit/7744a2d629950bad13d9d0374ba11e0841a4a962>`__)

Features
~~~~~~~~

- **service:** expose warnings and errors on cache.migrate endpoint
(`2681 <https://github.com/SwissDataScienceCenter/renku-python/issues/2681>`__)
(`8d4db90 <https://github.com/SwissDataScienceCenter/renku-python/commit/8d4db905598a512f2e351f081d519cf3295fd14b>`__)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24303