fix: patch bounded Python parser and TLS dependencies
This commit is contained in:
cesnimda
@@ -0,0 +1,117 @@
|
||||
# Python advisory inventory — P9-REMED-02
|
||||
|
||||
**BLOCKED** pending selected-model runtime qualification and remaining cache-lock assessment. No owner risk acceptance is asserted. The complete per-advisory ranges, severity/vector, direct/transitive role, actual installed/locked versions, functionality, exposure, fix compatibility, primary sources and required disposition are in [advisory-inventory.json](advisory-inventory.json).
|
||||
|
||||
109 baseline alias groups are not109 independent CVEs. Fresh49-pin before/after queries retain249→99 provider records and109→44 alias groups;65 groups no longer match the updated lock. Some model records describe version/function mismatches; these are preserved with source-limited call-site assessment rather than silently suppressed.
|
||||
|
||||
| Package | Advisory IDs / primary identifier | Current disposition |
|
||||
| --- | --- | --- |
|
||||
| certifi | [GHSA-6q48-6c7w-9gw2](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576) (PYSEC-2026-4320) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| filelock | [GHSA-v4x8-3wr5-3wq8](https://github.com/advisories/GHSA-v4x8-3wr5-3wq8) (CVE-2026-112940) | OPEN_LOCAL_CACHE_COMPATIBILITY |
|
||||
| filelock | [GHSA-9vhv-jxww-xfm5](https://github.com/advisories/GHSA-9vhv-jxww-xfm5) (CVE-2026-112913) | OPEN_LOCAL_CACHE_COMPATIBILITY |
|
||||
| filelock | [GHSA-567q-5qvw-pf92](https://github.com/advisories/GHSA-567q-5qvw-pf92) (CVE-2026-112907) | OPEN_LOCAL_CACHE_COMPATIBILITY |
|
||||
| pillow | [GHSA-4558-3h8r-v8xp](https://github.com/advisories/GHSA-4558-3h8r-v8xp) (CVE-2026-112394) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-8g5g-8vmr-9782](https://github.com/advisories/GHSA-8g5g-8vmr-9782) (CVE-2026-112403) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-rfgq-q3w2-pmv2](https://github.com/advisories/GHSA-rfgq-q3w2-pmv2) (CVE-2026-112898) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-xvh5-g6gv-559v](https://github.com/advisories/GHSA-xvh5-g6gv-559v) (CVE-2026-112902) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-p4wg-p73j-c528](https://github.com/advisories/GHSA-p4wg-p73j-c528) (CVE-2026-112895) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-65qm-jvmh-6pqg](https://github.com/advisories/GHSA-65qm-jvmh-6pqg) (CVE-2026-112400) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-58r4-6rv3-gfh8](https://github.com/advisories/GHSA-58r4-6rv3-gfh8) (CVE-2026-112397) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-pchr-8j38-3x4p](https://github.com/advisories/GHSA-pchr-8j38-3x4p) (CVE-2026-112896) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-q45j-58j2-45rg](https://github.com/advisories/GHSA-q45j-58j2-45rg) (CVE-2026-112897) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-462x-pgg6-55fp](https://github.com/advisories/GHSA-462x-pgg6-55fp) (CVE-2026-112395) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-c6hw-5grf-ff96](https://github.com/advisories/GHSA-c6hw-5grf-ff96) (CVE-2026-112404) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-vx6w-vv9f-6gvg](https://github.com/advisories/GHSA-vx6w-vv9f-6gvg) (CVE-2026-112899) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-7mwm-ghpf-9vrm](https://github.com/advisories/GHSA-7mwm-ghpf-9vrm) (CVE-2026-112402) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-w889-685w-c8fh](https://github.com/advisories/GHSA-w889-685w-c8fh) (CVE-2026-112900) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-j4m9-6w36-pw47](https://github.com/advisories/GHSA-j4m9-6w36-pw47) (CVE-2026-112893) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-27h8-gf7j-v5hc](https://github.com/advisories/GHSA-27h8-gf7j-v5hc) (CVE-2026-112392) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-fc9g-5qg7-mf45](https://github.com/advisories/GHSA-fc9g-5qg7-mf45) (CVE-2026-112891) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-cp9v-662q-vvx9](https://github.com/advisories/GHSA-cp9v-662q-vvx9) (CVE-2026-112405) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-22hg-r758-rrw9](https://github.com/advisories/GHSA-22hg-r758-rrw9) (CVE-2026-112390) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-74r2-7ff9-mjj2](https://github.com/advisories/GHSA-74r2-7ff9-mjj2) (CVE-2026-112401) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-xgh8-jp6q-p5x8](https://github.com/advisories/GHSA-xgh8-jp6q-p5x8) (CVE-2026-112901) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-254f-3936-288h](https://github.com/advisories/GHSA-254f-3936-288h) (CVE-2026-112391) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-jg86-v3jv-hrpm](https://github.com/advisories/GHSA-jg86-v3jv-hrpm) (CVE-2026-112894) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-f2g6-542v-9j58](https://github.com/advisories/GHSA-f2g6-542v-9j58) (CVE-2026-112406) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-5xm2-6676-qcp9](https://github.com/advisories/GHSA-5xm2-6676-qcp9) (CVE-2026-112399) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-gg2r-wvfm-q9rx](https://github.com/advisories/GHSA-gg2r-wvfm-q9rx) (CVE-2026-112892) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-332p-7hrc-92wf](https://github.com/advisories/GHSA-332p-7hrc-92wf) (CVE-2026-112393) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-4rr5-89j8-mwwm](https://github.com/advisories/GHSA-4rr5-89j8-mwwm) (CVE-2026-112396) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-24rc-8hj2-v98c](https://github.com/advisories/GHSA-24rc-8hj2-v98c) (CVE-2026-96638) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-4rm8-3hmm-39fg](https://github.com/advisories/GHSA-4rm8-3hmm-39fg) (CVE-2026-96641) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-mrfp-p49p-3hf2](https://github.com/advisories/GHSA-mrfp-p49p-3hf2) (CVE-2026-96640) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-3j72-p6qg-6xp7](https://github.com/advisories/GHSA-3j72-p6qg-6xp7) (CVE-2026-96642) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-v9pv-5gc8-w2m6](https://github.com/advisories/GHSA-v9pv-5gc8-w2m6) (CVE-2026-96639) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-g4qv-2jxx-769h](https://github.com/advisories/GHSA-g4qv-2jxx-769h) (CVE-2026-96643) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-g842-9rc4-69pw](https://github.com/advisories/GHSA-g842-9rc4-69pw) (CVE-2026-96637) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-9v9v-9qvf-h2hj](https://github.com/advisories/GHSA-9v9v-9qvf-h2hj) (CVE-2026-96644) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-g7cr-3p24-7wf7](https://github.com/advisories/GHSA-g7cr-3p24-7wf7) (CVE-2026-96778) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-p8hx-v2p6-rp84](https://github.com/advisories/GHSA-p8hx-v2p6-rp84) (CVE-2026-96636) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-78g4-xqwv-q3g8](https://github.com/advisories/GHSA-78g4-xqwv-q3g8) (no aliases) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-654x-cwwv-5j9c](https://github.com/advisories/GHSA-654x-cwwv-5j9c) (CVE-2026-114501) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pillow | [GHSA-5x8w-8jj5-q52h](https://github.com/advisories/GHSA-5x8w-8jj5-q52h) (CVE-2026-112398) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-5jq2-8x83-x246](https://github.com/advisories/GHSA-5jq2-8x83-x246) (CVE-2026-102994, PYSEC-2026-4153) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-fp3h-c4fm-7vvf](https://github.com/advisories/GHSA-fp3h-c4fm-7vvf) (CVE-2026-102995, PYSEC-2026-4154) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-w23x-9jrw-r45c](https://github.com/advisories/GHSA-w23x-9jrw-r45c) (CVE-2026-103000, PYSEC-2026-4160) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-v247-6f48-mgcj](https://github.com/advisories/GHSA-v247-6f48-mgcj) (CVE-2026-102999, PYSEC-2026-4159) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-jw7q-gvrg-4vj3](https://github.com/advisories/GHSA-jw7q-gvrg-4vj3) (CVE-2026-102997, PYSEC-2026-4156) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-g9cg-prrw-2r8q](https://github.com/advisories/GHSA-g9cg-prrw-2r8q) (CVE-2026-102996, PYSEC-2026-4155) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-qv6h-rv94-w285](https://github.com/advisories/GHSA-qv6h-rv94-w285) (CVE-2026-102993, PYSEC-2026-4158) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-php9-fj8v-98fj](https://github.com/advisories/GHSA-php9-fj8v-98fj) (CVE-2026-102998, PYSEC-2026-4157) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-qfv9-64jg-mh7p](https://github.com/advisories/GHSA-qfv9-64jg-mh7p) (CVE-2026-113792) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-7mh2-4gg2-979f](https://github.com/advisories/GHSA-7mh2-4gg2-979f) (CVE-2026-113795) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-9mx8-4j7g-633p](https://github.com/advisories/GHSA-9mx8-4j7g-633p) (CVE-2026-113793) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-39mj-jf6j-2qj3](https://github.com/advisories/GHSA-39mj-jf6j-2qj3) (CVE-2026-113794) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-5hx5-vpf9-5wcv](https://github.com/advisories/GHSA-5hx5-vpf9-5wcv) (CVE-2026-113786) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-cgf9-327m-v77c](https://github.com/advisories/GHSA-cgf9-327m-v77c) (CVE-2026-113791) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-f54x-cmq8-qg57](https://github.com/advisories/GHSA-f54x-cmq8-qg57) (CVE-2026-113790) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-6vvc-x485-93v7](https://github.com/advisories/GHSA-6vvc-x485-93v7) (CVE-2026-113789) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-6c7f-9265-g8fw](https://github.com/advisories/GHSA-6c7f-9265-g8fw) (CVE-2026-115572) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-jr96-gvgh-j3r4](https://github.com/advisories/GHSA-jr96-gvgh-j3r4) (CVE-2026-115585) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| pypdf | [GHSA-gmh7-3g9r-mjh5](https://github.com/advisories/GHSA-gmh7-3g9r-mjh5) (CVE-2026-115580) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| setuptools | [GHSA-xmj3-9gf7-h52w](https://github.com/advisories/GHSA-xmj3-9gf7-h52w) (no aliases) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| torch | [GHSA-qfhq-4f3w-5fph](https://github.com/advisories/GHSA-qfhq-4f3w-5fph) (BIT-pytorch-2025-3001, CVE-2025-3001, PYSEC-2025-195) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [GHSA-rrmf-rvhw-rf47](https://github.com/advisories/GHSA-rrmf-rvhw-rf47) (BIT-pytorch-2025-3000, CVE-2025-3000, PYSEC-2025-194) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [GHSA-vgrw-7cvw-pwgx](https://github.com/advisories/GHSA-vgrw-7cvw-pwgx) (BIT-pytorch-2025-2999, CVE-2025-2999, PYSEC-2025-193) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [GHSA-3749-ghw9-m3mg](https://github.com/advisories/GHSA-3749-ghw9-m3mg) (BIT-pytorch-2025-2953, CVE-2025-2953, PYSEC-2025-191) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-46148](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46148, PYSEC-2025-198) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-46149](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46149, PYSEC-2025-199) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-46150](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46150, PYSEC-2025-200) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-46152](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46152, PYSEC-2025-201) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-46153](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46153, PYSEC-2025-202) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55551](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55551, PYSEC-2025-203) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55552](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55552, PYSEC-2025-204) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55553](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55553, PYSEC-2025-205) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55554](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55554, PYSEC-2025-206) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55557](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55557, PYSEC-2025-207) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55558](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55558, PYSEC-2025-208) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2025-55560](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55560, PYSEC-2025-209) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [BIT-pytorch-2026-4538](https://github.com/pytorch/pytorch/) (CVE-2026-4538, PYSEC-2026-139) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [GHSA-887c-mr87-cxwp](https://github.com/advisories/GHSA-887c-mr87-cxwp) (BIT-pytorch-2025-3730, CVE-2025-3730, PYSEC-2026-1970) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| torch | [GHSA-63cw-57p8-fm3p](https://access.redhat.com/errata/RHSA-2026:24977) (BIT-pytorch-2026-24747, CVE-2026-24747, PYSEC-2026-1856, PYSEC-2026-2286) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14929](https://osv.dev/vulnerability/PYSEC-2025-217) (PYSEC-2025-217) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-qq3j-4f4f-9583](https://github.com/advisories/GHSA-qq3j-4f4f-9583) (CVE-2025-2099, PYSEC-2025-40) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14926](https://osv.dev/vulnerability/PYSEC-2025-214) (PYSEC-2025-214) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14930](https://osv.dev/vulnerability/PYSEC-2025-218) (PYSEC-2025-218) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14920](https://osv.dev/vulnerability/PYSEC-2025-211) (PYSEC-2025-211) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14921](https://osv.dev/vulnerability/PYSEC-2025-212) (PYSEC-2025-212) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14924](https://osv.dev/vulnerability/PYSEC-2025-213) (PYSEC-2025-213) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14927](https://osv.dev/vulnerability/PYSEC-2025-215) (PYSEC-2025-215) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [CVE-2025-14928](https://osv.dev/vulnerability/PYSEC-2025-216) (PYSEC-2025-216) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-37mw-44qp-f5jm](https://github.com/advisories/GHSA-37mw-44qp-f5jm) (CVE-2025-3933, PYSEC-2026-1977) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-59p9-h35m-wg4g](https://github.com/advisories/GHSA-59p9-h35m-wg4g) (CVE-2025-6638, PYSEC-2026-1981) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-jjph-296x-mrcr](https://github.com/advisories/GHSA-jjph-296x-mrcr) (CVE-2025-3264, PYSEC-2026-1985) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-fpwr-67px-3qhx](https://github.com/advisories/GHSA-fpwr-67px-3qhx) (CVE-2025-1194, PYSEC-2026-1984) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-phhr-52qp-3mj4](https://github.com/advisories/GHSA-phhr-52qp-3mj4) (CVE-2025-3777, PYSEC-2026-1986) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-rcv9-qm8p-9p6j](https://github.com/advisories/GHSA-rcv9-qm8p-9p6j) (CVE-2025-6051, PYSEC-2026-1988) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-4w7r-h757-3r74](https://github.com/advisories/GHSA-4w7r-h757-3r74) (CVE-2025-6921, PYSEC-2026-1980) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-q2wp-rjmx-x6x9](https://github.com/advisories/GHSA-q2wp-rjmx-x6x9) (CVE-2025-3263, PYSEC-2026-1987) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-9356-575x-2w9m](https://github.com/advisories/GHSA-9356-575x-2w9m) (CVE-2025-5197, PYSEC-2026-1983) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-69w3-r845-3855](https://github.com/advisories/GHSA-69w3-r845-3855) (CVE-2026-1839, PYSEC-2026-2288) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-29pf-2h5f-8g72](https://github.com/advisories/GHSA-29pf-2h5f-8g72) (CVE-2026-4372, PYSEC-2026-2289) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-fgcw-684q-jj6r](https://access.redhat.com/errata/RHSA-2026:34456) (CVE-2026-5241, PYSEC-2026-2290) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| transformers | [GHSA-xrqw-3rrv-vx5w](https://github.com/advisories/GHSA-xrqw-3rrv-vx5w) (CVE-2026-9856, PYSEC-2026-3929) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
|
||||
| urllib3 | [GHSA-vxq7-64xx-v4gw](https://github.com/advisories/GHSA-vxq7-64xx-v4gw) (CVE-2026-97689, PYSEC-2026-4177) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| urllib3 | [GHSA-gh4c-6fx4-qh6g](https://github.com/advisories/GHSA-gh4c-6fx4-qh6g) (CVE-2026-97688, PYSEC-2026-4176) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
| urllib3 | [GHSA-8988-9cw3-xx77](https://github.com/advisories/GHSA-8988-9cw3-xx77) (CVE-2026-97687, PYSEC-2026-4175) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
|
||||
@@ -0,0 +1,50 @@
|
||||
# Python security remediation — 24 October 2026
|
||||
|
||||
**Verdict: BLOCKED for remaining model-runtime qualification; no owner risk acceptance.** Five bounded dependency upgrades remove65 of109 baseline advisory alias groups from the locked graph. Remaining44 groups are recorded individually, not suppressed. This is local development evidence, not a deployed fix.
|
||||
|
||||
## Exact changes and reproducibility
|
||||
|
||||
| Package | Before | After | Selection and compatibility |
|
||||
| --- | --- | --- | --- |
|
||||
| Pillow |12.3.0 |13.0.0 |Published parser fixes include JPEG/APNG/EXIF paths. Python3.12 is supported; removed APIs were checked against the actual Image.open/convert/OCR call sites. No removed API is called by the sidecar. |
|
||||
| pypdf |6.16.2 |6.21.2 |Latest reviewed6.x security patch; PdfReader/pages/extract_text contract retained and benign PDF content checked. |
|
||||
| certifi |2026.7.22 |2026.10.19 |Removes affected compromised CA trust; transitive Requests/Hugging Face use. |
|
||||
| urllib3 |2.7.0 |2.8.0 |Patched proxy/chunk/deflate handling; no service routing/API changes. |
|
||||
| setuptools |84.0.0 |84.1.0 |Patched legacy wheel/namespace installation path. Runtime performs no package installation. |
|
||||
|
||||
Primary upstream evidence: [Pillow13 security and compatibility notes](https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html), [pypdf6.21.2 changelog](https://pypdf.readthedocs.io/en/stable/meta/CHANGELOG.html), [certifi advisory](https://github.com/advisories/GHSA-6q48-6c7w-9gw2). All per-advisory primary links, exact affected ranges, published fix events and severity labels are retained in [the inventory](advisory-inventory.json).
|
||||
|
||||
The existing UV0.12.7 Linux hash-lock command was reused with Python3.12/x86_64 Linux and the CPU Torch index. Exactly five versions changed among49 pins; no other package/version was added, removed or upgraded. `requirements.txt` declares the three previously transitive TLS/build pins explicitly as reviewed security constraints. The hash lock contains actual distribution hashes; five downloaded Linuxcp312 wheels were independently hashed and matched against it. No Torch or model artifact was downloaded. Existing application source, models, parser limits, API, withholding policy and production Dockerfile are unchanged.
|
||||
|
||||
Reproduce from `tools/summarizer` using the installed UV runtime:
|
||||
|
||||
```powershell
|
||||
rtk proxy .venv/Scripts/python.exe -m uv pip compile requirements.txt --generate-hashes --python-version 3.12 --python-platform x86_64-unknown-linux-gnu --torch-backend cpu --output-file requirements-linux.lock
|
||||
rtk proxy .venv/Scripts/python.exe -m pytest -q tests
|
||||
rtk proxy .venv/Scripts/python.exe -m pip check
|
||||
```
|
||||
|
||||
Keep an original lock copy and compare exact membership before replacing it. Regeneration reuses current lock pins; a clean resolution without that output may choose different transitive versions. Production installs continue to require hashes from the committed lock. Local Windows validation installed only the five exact changes without resolving unrelated dependencies and `pip check` passes.
|
||||
|
||||
## Regression evidence
|
||||
|
||||
- Baseline bounded APNG regression:1 failed/1 passed. A64-pixel synthetic APNG demonstrably allocated the full rejected canvas before the decompression-bomb check on Pillow12.3.0; no large/malicious allocation was attempted. This directly covers GHSA-5xm2-6676-qcp9's operation ordering.
|
||||
- Patched complete sidecar suite: **58/58 passed**, zero skipped, comprising56 existing cases plus2 added parser-security cases. The second truncated-xref case already passed on the old pypdf pin; it is not claimed as a RED reproduction of that pin. A five-second child deadline prevents an unbounded regression hang.
|
||||
- Real local uvicorn startup: health reports model disabled/unloaded and unavailable local summarization. Actual token-protected uploads of synthetic TXT/DOCX/PDF preserve content including `Åse Østby ærlig` and `Python and C#`; missing-token upload returns401. The owned process is stopped afterward. This uses actual HTTP and parser children, not an AI model.
|
||||
- Supplemental **Linux Python3.12.10 parser** check:2/2 added regressions pass plus3/3 actual resource-bounded child TXT/DOCX/PDF decodes preserving the same content. It runs nonroot in a read-only, network-none, capability-dropped container with512MiB/oneCPU limits; no daemon socket, host port or persistent data. The container is removed. Pytest emits one `cache_dir` warning because its cache plugin is disabled; no case is skipped or retried.
|
||||
|
||||
The supplemental Linux image contains the exact reviewed parser/TLS changes and small test dependencies; it is **not** the complete49-package sidecar graph and runs no OCR/model inference. Its image/source/process identities are in validation.json. An existing cached sidecar image was inspected and found to use Python3.11.16/FastAPI0.115.12/Pillow11.1/pypdf5.4; it was not relabelled as the current3.12 hash-lock runtime.
|
||||
|
||||
Raw logs, TRX-equivalent JUnit, before/after queries, source identities and synthetic originals remain under `.artifacts/p9-remed-02/security/`. Focused/supplemental checks are not added to the complete58 total.
|
||||
|
||||
## Fresh advisory accounting and remaining actions
|
||||
|
||||
Fresh exact OSV/PyPI queries:49 pins,98 requests before and98 after; each has97 successes and one retained PyPI404 for vendor version `torch==2.6.0+cpu`. Exact OSV CPU-version lookup succeeds. The missing PyPI vendor release is explained but remains an incomplete second-provider result; no upstream-version substitution is represented as exact vendor coverage.
|
||||
|
||||
Before:249 provider records,109 published alias groups across8 packages. After:99 records,44 groups across3 packages — filelock3, Torch19, Transformers22.65 groups no longer match the updated exact lock. Alias groups are not independent CVE or exploit counts. [ADVISORIES.md](ADVISORIES.md) indexes every baseline group and its current disposition; [JSON](advisory-inventory.json) retains all mandatory per-row fields.
|
||||
|
||||
Filelock4 changes some shared-cache/on-disk lock protocols; the inspected Hugging Face helper uses FileLock with a SoftFileLock fallback, not ReadWriteLock. No runtime/cache migration was attempted. The Windows fallback/local-marker condition still needs a narrow compatibility/ownership assessment. Read the [upstream protocol warning](https://py-filelock.readthedocs.io/en/latest/changelog.html#id162) before a shared-cache transition; no live cache participant may be silently mixed.
|
||||
|
||||
Torch/Transformers records include many alternative model, conversion, Trainer, optimizer and compiler operations with no matching application call found. Those absences are explicitly source-limited. Fixed-repository `from_pretrained` loading still exists without an immutable revision/artifact integrity record; actual checkpoint format and model dependency internals remain unqualified. The standard user cache contained no DistilBART snapshot, and no model download/inference was attempted. Some provider records describe other library versions/model families; the inventory retains those ranges and does not assert a reproduced exploit in this application.
|
||||
|
||||
Next security action: select and validate a compatible patched Torch/Transformers CPU graph for the existing model, verify immutable model/tokenizer/checkpoint identities, startup and representative inference/extraction contracts in an approved local environment. Alternatively, the product/security owner must explicitly decide any serious residual risk after applicability evidence. This task does not accept it for them. Container isolation, resource limits and mocked inference tests do not close that gate. Bootstrap pip/wheel, base OS/OCR libraries and actual production identities remain separate release audit obligations.
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"observedUtc": "2026-10-24T17:09:44.302477+00:00",
|
||||
"gate": "BLOCKED",
|
||||
"applicationSourceChanged": false,
|
||||
"modelDownloaded": false,
|
||||
"productionAccess": false,
|
||||
"sidecar": {
|
||||
"passed": 58,
|
||||
"failed": 0,
|
||||
"skipped": 0,
|
||||
"report": {
|
||||
"path": ".artifacts/p9-remed-02/security/sidecar.xml",
|
||||
"sha256": "86160173530de91c96bee058eeb229665a568e6d42ffc1630832af88f6c5b9bb",
|
||||
"bytes": 33456
|
||||
},
|
||||
"process": {
|
||||
"command": [
|
||||
"E:\\Storage\\Projects\\Active\\Job tracker\\tools\\summarizer\\.venv\\Scripts\\python.exe",
|
||||
"-m",
|
||||
"pytest",
|
||||
"-q",
|
||||
"tests",
|
||||
"--junitxml=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-remed-02\\security\\sidecar.xml"
|
||||
],
|
||||
"exitCode": 0,
|
||||
"startedUtc": "2026-10-24T17:01:50.178400+00:00",
|
||||
"finishedUtc": "2026-10-24T17:02:11.534863+00:00",
|
||||
"modelLoadingDisabled": true
|
||||
}
|
||||
},
|
||||
"parserRed": {
|
||||
"passed": 1,
|
||||
"failed": 1,
|
||||
"expectedFailure": "APNG rejected-canvas allocated before bomb check",
|
||||
"evidence": {
|
||||
"path": ".artifacts/p9-remed-02/security/parser-red.log",
|
||||
"sha256": "414e669f431c500345b9a316e5ff50532eb6f3d5652274d9f7cfc2fdcd0bef2c",
|
||||
"bytes": 1964
|
||||
}
|
||||
},
|
||||
"startup": {
|
||||
"status": "PASS",
|
||||
"httpFiles": 3,
|
||||
"unauthenticatedUploadStatus": 401,
|
||||
"serverStopped": true,
|
||||
"evidence": {
|
||||
"path": ".artifacts/p9-remed-02/security/startup.json",
|
||||
"sha256": "2b3d70fcf08253063a8ce43bb4a2c45acd1e5d158d9727e66a342974c773479a",
|
||||
"bytes": 3585
|
||||
}
|
||||
},
|
||||
"linuxParser": {
|
||||
"exitCode": 0,
|
||||
"imageId": "sha256:9aaa3eca161dca35243cb8083f83706b852bbee7a24bcf3a035fbe2af1f547f3",
|
||||
"containerAbsent": true,
|
||||
"regressionCases": 2,
|
||||
"childDecodes": 3,
|
||||
"fullSidecarGraph": false,
|
||||
"ocr": false,
|
||||
"modelInference": false,
|
||||
"evidence": {
|
||||
"path": ".artifacts/p9-remed-02/security/linux-parser.json",
|
||||
"sha256": "311ddccad8a801025e0fd985f72d816595c6f96560974ab1d4e7fc661ba3f597",
|
||||
"bytes": 3213
|
||||
}
|
||||
},
|
||||
"dependencyGraph": {
|
||||
"pins": 49,
|
||||
"changed": {
|
||||
"pypdf": {
|
||||
"before": "6.16.2",
|
||||
"after": "6.21.2"
|
||||
},
|
||||
"urllib3": {
|
||||
"before": "2.7.0",
|
||||
"after": "2.8.0"
|
||||
},
|
||||
"setuptools": {
|
||||
"before": "84.0.0",
|
||||
"after": "84.1.0"
|
||||
},
|
||||
"pillow": {
|
||||
"before": "12.3.0",
|
||||
"after": "13.0.0"
|
||||
},
|
||||
"certifi": {
|
||||
"before": "2026.7.22",
|
||||
"after": "2026.10.19"
|
||||
}
|
||||
},
|
||||
"lock": {
|
||||
"path": "tools/summarizer/requirements-linux.lock",
|
||||
"sha256": "23f200fef330e2677ff4a47e5fcbaa327f98c3d4ebdcf73e2047e9f61664e7cb",
|
||||
"bytes": 119391
|
||||
},
|
||||
"source": {
|
||||
"path": "tools/summarizer/requirements.txt",
|
||||
"sha256": "292badbfbf50aa82bf9c4f0ccf73559ddef832c990b90cdff00732f7162e5209",
|
||||
"bytes": 383
|
||||
}
|
||||
},
|
||||
"inventory": {
|
||||
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
|
||||
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
|
||||
"bytes": 794994
|
||||
},
|
||||
"accounting": {
|
||||
"beforeRecords": 249,
|
||||
"beforeGroups": 109,
|
||||
"afterRecords": 99,
|
||||
"afterGroups": 44,
|
||||
"remediatedGroups": 65
|
||||
},
|
||||
"linuxWheels": [
|
||||
{
|
||||
"wheel": "certifi-2026.10.19-py3-none-any.whl",
|
||||
"sha256": "42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b",
|
||||
"presentInHashLock": true
|
||||
},
|
||||
{
|
||||
"wheel": "pillow-13.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl",
|
||||
"sha256": "42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca",
|
||||
"presentInHashLock": true
|
||||
},
|
||||
{
|
||||
"wheel": "pypdf-6.21.2-py3-none-any.whl",
|
||||
"sha256": "1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084",
|
||||
"presentInHashLock": true
|
||||
},
|
||||
{
|
||||
"wheel": "setuptools-84.1.0-py3-none-any.whl",
|
||||
"sha256": "5231689c6ac8156cd155cfb98c3fd6fb252c3e7e9bd3d78b64d3c55f132624c9",
|
||||
"presentInHashLock": true
|
||||
},
|
||||
{
|
||||
"wheel": "urllib3-2.8.0-py3-none-any.whl",
|
||||
"sha256": "0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3",
|
||||
"presentInHashLock": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -18,10 +18,12 @@ cachetools==5.5.2 \
|
||||
--hash=sha256:1a661caa9175d26759571b2e19580f9d6393969e5dfca11fdb1f947a23e640d4 \
|
||||
--hash=sha256:d26a22bcc62eb95c3beabd9f1ee5e820d3d2704fe2967cbe350e20c8ffcd3f0a
|
||||
# via -r requirements.txt
|
||||
certifi==2026.7.22 \
|
||||
--hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
|
||||
--hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
|
||||
# via requests
|
||||
certifi==2026.10.19 \
|
||||
--hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \
|
||||
--hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b
|
||||
# via
|
||||
# -r requirements.txt
|
||||
# requests
|
||||
charset-normalizer==3.5.1 \
|
||||
--hash=sha256:00668ebb0609751758682eb0b5857e7c35b9f00e84dfdef062e103244ec94d45 \
|
||||
--hash=sha256:012a22b88a77ca2e59b98ac5889b0deb604147666032f45e6d6e217634d2550d \
|
||||
@@ -666,94 +668,90 @@ packaging==26.3 \
|
||||
# huggingface-hub
|
||||
# pytesseract
|
||||
# transformers
|
||||
pillow==12.3.0 \
|
||||
--hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \
|
||||
--hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \
|
||||
--hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \
|
||||
--hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \
|
||||
--hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
|
||||
--hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \
|
||||
--hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \
|
||||
--hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \
|
||||
--hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \
|
||||
--hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
|
||||
--hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \
|
||||
--hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \
|
||||
--hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \
|
||||
--hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \
|
||||
--hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \
|
||||
--hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \
|
||||
--hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
|
||||
--hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \
|
||||
--hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
|
||||
--hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \
|
||||
--hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \
|
||||
--hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \
|
||||
--hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \
|
||||
--hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \
|
||||
--hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \
|
||||
--hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \
|
||||
--hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \
|
||||
--hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
|
||||
--hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \
|
||||
--hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \
|
||||
--hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \
|
||||
--hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \
|
||||
--hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \
|
||||
--hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \
|
||||
--hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \
|
||||
--hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \
|
||||
--hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \
|
||||
--hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \
|
||||
--hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
|
||||
--hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \
|
||||
--hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \
|
||||
--hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \
|
||||
--hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \
|
||||
--hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
|
||||
--hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \
|
||||
--hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \
|
||||
--hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \
|
||||
--hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \
|
||||
--hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \
|
||||
--hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \
|
||||
--hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \
|
||||
--hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \
|
||||
--hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \
|
||||
--hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \
|
||||
--hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \
|
||||
--hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \
|
||||
--hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \
|
||||
--hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \
|
||||
--hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \
|
||||
--hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \
|
||||
--hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \
|
||||
--hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
|
||||
--hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
|
||||
--hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \
|
||||
--hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \
|
||||
--hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
|
||||
--hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \
|
||||
--hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \
|
||||
--hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
|
||||
--hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \
|
||||
--hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \
|
||||
--hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
|
||||
--hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \
|
||||
--hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \
|
||||
--hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \
|
||||
--hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \
|
||||
--hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \
|
||||
--hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
|
||||
--hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \
|
||||
--hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \
|
||||
--hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \
|
||||
--hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \
|
||||
--hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
|
||||
--hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \
|
||||
--hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
|
||||
--hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \
|
||||
--hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
|
||||
pillow==13.0.0 \
|
||||
--hash=sha256:02464da86f561f410e13b061ec37c3068a9cb557a095494157742d07b3c24a27 \
|
||||
--hash=sha256:04a63720f79e22fd54d897c233a68314c50ca0603360f54ce2bd5db8f0f43782 \
|
||||
--hash=sha256:05cd2cd39055d0b9650060e4513ef4a9a0aea870083950bd046a0d6490f93a22 \
|
||||
--hash=sha256:06903aac074d00c988e77a1fc435286dc498506d4ca8d6f69df9babddf4ecc15 \
|
||||
--hash=sha256:08b826a9bf1265c76de04a42061d61ea6b109418b7826f28ff1ecdfaa26c5502 \
|
||||
--hash=sha256:0d1a9cf7bc6917538b20f8d06b9ab2147e542f68849e96fc58eb66bdf6acc692 \
|
||||
--hash=sha256:10b5019883c98f1dd819ca48ffc6f33a91cee04948fe637c605f4345c7cafd6f \
|
||||
--hash=sha256:12b0fa15879fe5a9d9eebe66e4e2d74128a773b1a4448010c9c714f45e04b9d8 \
|
||||
--hash=sha256:12fbb851cf323cc19aac3eea1df5ad17b57e91e9fe3cfd06100dba7bb8208c13 \
|
||||
--hash=sha256:149a1c323ba366f90b48e6f1a6db6582eb50512df374588de56fc909abc0f0f3 \
|
||||
--hash=sha256:19b66ca0a4d25cc0200b381ce824c7ea090db61427315e73cfb05dbf1b35c369 \
|
||||
--hash=sha256:1c774b9c0ba0d0b356f71530677b39028878a2cae5a93e0a13779cfd17120f88 \
|
||||
--hash=sha256:20722cd5375533ad754053363a80b8fb30c79d37930a6f7228030e237ce3bd5d \
|
||||
--hash=sha256:20822140c9a2ba9c5e42df342b0a892ab2e102fc0e3db967a133bb9ce3f898bb \
|
||||
--hash=sha256:21c32061a5512dc13f87cc7303e120e4d77c2f70df89a35af0e3ce246e5ac57f \
|
||||
--hash=sha256:2310e2adfc13c6d457d7d0f2ffdd5c56a74a317650cf765887df8d515a647ac0 \
|
||||
--hash=sha256:23edf4ec4b6f4f240e8df6e4985e9ee2ced86474632433e55fb1e2548744bf40 \
|
||||
--hash=sha256:2d50500a4a3bc6469adcdb319cf05d688b08ca3bf0f22a05339f3b25b433a599 \
|
||||
--hash=sha256:2e31c4e68cffd7b1f116127626813b82fcba19edf6b940a7b0c266d6484d0055 \
|
||||
--hash=sha256:34fb3db1149c879343861831728c243c432d4a5afc8f1878ca7612ef8de2a033 \
|
||||
--hash=sha256:37290fbef0c73e2d51d594eb78fded7dc7170d1c3ad0a890269e6fd8c8c4e061 \
|
||||
--hash=sha256:405be6058e206a86fedce2f715ecc2343f94072d7925251632dffa2c05f70dca \
|
||||
--hash=sha256:40a266371ece581e5de13b6635ef78d7487824af80561b6ca27694a88c19bc0f \
|
||||
--hash=sha256:42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca \
|
||||
--hash=sha256:44629d4498c9cb6b2051806155f22141df0d8a929c56134b166655232dfb2f8c \
|
||||
--hash=sha256:49c12af515073e9bf511e4ef736743bf70d531a643668722279314b937742ba4 \
|
||||
--hash=sha256:4a25756244bdcce3b50580baadf320fa48297f0eeb8e114ba64139a40d4d0fc8 \
|
||||
--hash=sha256:4bd024d567eca931b668978d672dba914d4b8e2628e2c3073a2ad178de8a2620 \
|
||||
--hash=sha256:4f8db54177035a2b5f717f94475b74907e12a96dc74f6d487f3966b0a4694071 \
|
||||
--hash=sha256:51ebb529fc5e8abdd55302f6c3f8943037348ec2384329a3e55677f69ae2fdfc \
|
||||
--hash=sha256:567f20f1c75897d7663830da6ea8af719e03d712b1d9ee7f813319f9ece42e5a \
|
||||
--hash=sha256:5933fcea5a5ba64c686f55c886a115cbfd92f2900460784a1e79909fdbafd7b6 \
|
||||
--hash=sha256:5bdb38ba220b61b4ec31dd1046dea6b016d3c6850a23f43ed8b58332b2fc668e \
|
||||
--hash=sha256:5f56499c1a74d2b862beb0c33b8016f99d095858455df9d21583bbbc1c15b582 \
|
||||
--hash=sha256:67871a13cf47275201553b536c025da777f997fa562a19eb798af4ad4b97c18f \
|
||||
--hash=sha256:67c8d44ad89fa7eb88de5d6ef6199b1e03dd24974f85a67639fc8badb801fe79 \
|
||||
--hash=sha256:6a0920cb55df5a4d3f6862964908078c0bd59332bdd1bcd20d14e8c70ef27cc5 \
|
||||
--hash=sha256:6bce6a29c3898191f4c9998e4d4e8f69790caeabde46e54da4bc235ce5bde683 \
|
||||
--hash=sha256:6f38f3f885a09cafc93fd667b1173a92f379e43785d635e7983c893f0da319fb \
|
||||
--hash=sha256:73ee25cf8cf8b75d5a5aeed7cb6588f5e5dbfbb0fde51707b630bbb23897645c \
|
||||
--hash=sha256:7b999816b5850a35ada08443e6e03945f1f6488144a83afe2d37b240a552aafa \
|
||||
--hash=sha256:7c88c10dd432f3b39ccdafc9ed81d0c21b8fd634502574da76d1bfa4fe2c76d0 \
|
||||
--hash=sha256:7d5e097eabd5d4915c27ac9f6e9325bb1e01a7c94d7348b5c4451d3fc30e8521 \
|
||||
--hash=sha256:7e91e97a929232cdb828889ee6ad0e48d7f40f4ec38818f4e4a8968b2b1af22e \
|
||||
--hash=sha256:7f6299e494e46253d40c34653cac369412f44ca53b5f85d848d3f95b1ed0546c \
|
||||
--hash=sha256:816752a5ef76a80484c8c441c85593b7ea9304f6231fc5776ad1fbff7e773058 \
|
||||
--hash=sha256:83b37abd87b590acd8f47ca8a61f70893322b11834d36e07c2298dacad4d14d2 \
|
||||
--hash=sha256:8619685cad8efc4c38c66d3b36aad854523297c43d748b3b6f0cc03c90ba3463 \
|
||||
--hash=sha256:8bf295fe459343bc6093c8e5e0df60bfa189e0fcb775a22e2c2488fdeccc6c0d \
|
||||
--hash=sha256:8e459b613cf31f8980f584387b4fe47bf08e076e288d61aa8eba1f7fd4ddbb81 \
|
||||
--hash=sha256:8f36aa77f74b14a2103622b196402c71330e4e7cf4122ee45c854e9a01e0eecf \
|
||||
--hash=sha256:93ff9c9c3663ce23aaa5d0b6b6abac55359e2a0c06c7e30f3771829af816be63 \
|
||||
--hash=sha256:9a635068d9793c7f0d929f39f18b58f1bd86c236e8e7b64167b86af9232ebca0 \
|
||||
--hash=sha256:9dda0788a9932776a75d8bcc020076edc308ce2508b51f6739a45e3158b3fc42 \
|
||||
--hash=sha256:a192360d512305fe92d3053e4f7627bbad1f7708f1f4ad38cccd9336acabe9ad \
|
||||
--hash=sha256:a2a14cd73d5e6c927f644b0110ee81f59c4ef506259ec9183904747f2caacc81 \
|
||||
--hash=sha256:a625df9a2a5597fa5e5266e01aefc82604bb85d291e3547981e863560d75da6c \
|
||||
--hash=sha256:a6aaa7871aebca081eb5c45f83e845bbd9712ae99fa9286dbfdcee835e63f4b4 \
|
||||
--hash=sha256:aa694c49787040943570d61c9b8fc01271bd2a2cfdd55f0d896f8aecdce1a981 \
|
||||
--hash=sha256:adb3c2124c68e480f4632d06cb7caa3b48a51678475f483b4edb1c6dee29ea43 \
|
||||
--hash=sha256:b84be41387fc00db28c13c02e30d42b02d8d8f6a4a741a1aee6012ca7f1f6039 \
|
||||
--hash=sha256:bf97ba1b5542050e9b0c74e632323b6d8136cc99d64e193abebee22fe6013c76 \
|
||||
--hash=sha256:c3bc8ee0271387e0b1e3ad0ff893645990a656e79bf9c42f4f734a3642b11d51 \
|
||||
--hash=sha256:c50c80e3591e5cf9a8dfa6007d4f10732f02e32263850999286e56ccd650cfb2 \
|
||||
--hash=sha256:c6fd031333dedcad7ce3e03d244093f43504f209e86925ebdb2b868fa4037630 \
|
||||
--hash=sha256:c87a04e7f152ee4db5dbe15f0bfa3fe628a1aeedbe66b81c43b87f52c813f9ac \
|
||||
--hash=sha256:cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510 \
|
||||
--hash=sha256:d4737f50d23ddd11d6685faacbb9252887dde0bc7997127757247983d74399d6 \
|
||||
--hash=sha256:d7710eb676e9bb68965cb045be0d333b4c0d7f9dfbaa7fbf121385b1588683d3 \
|
||||
--hash=sha256:d9b0a2bee3f3e03e9f29057aedb807dbf1e1d96ee1b9d0f422d9db6c8583271d \
|
||||
--hash=sha256:e65dd6e75de67b2362a4fa3e16aa627595f65054dc4ec73d64680c84d592fa61 \
|
||||
--hash=sha256:e892354a424b1e82a78ba16785822bdd40de06f19446a3d4a28047df1a4f8932 \
|
||||
--hash=sha256:e8ca8f69b7c77fa96dad99f8638c1fc4f1c0bed4acaa1baf7a3c31bdb80a0ab1 \
|
||||
--hash=sha256:e91c2b1cbeae768c98752e67e717e283d68dae45717b41f2d91eaee648e37b7d \
|
||||
--hash=sha256:e98b4f91f99b24b1da72e10621ba181f7281922384a7403094debb4199de6c00 \
|
||||
--hash=sha256:ef5fe6b7db3f501c56000ba8fe7c7e1a35ca1d45824fbeb95a67daa85cff4dbe \
|
||||
--hash=sha256:f11a3c1358bb3c68012a7b1f41b223c3db9f7bfde90b481df028cfe1c3363313 \
|
||||
--hash=sha256:f391dc92a015c478745192fe4f2e120c2af2aba18d9fe0616341cbf537599806 \
|
||||
--hash=sha256:f7cbb7a64e7ec664775195e4f81923bc8a93d9451b963f844e59118f63147a7a \
|
||||
--hash=sha256:f9bd7d260d986f3553518c5d723544346fa48031f8aef3265d786aeb59845bc0 \
|
||||
--hash=sha256:fc481f742ccda20e9ed760b8f978dff50f2a4e9bc253ac167fb0a05b0783ef52 \
|
||||
--hash=sha256:ff3fe9eb621fbb9db4c4be33ab946f6bac5f98ab50ca8d3260503653656c961b \
|
||||
--hash=sha256:ffea6b2986a797c84b6d1d27d4f43e0b83c73fc16281a930891cd237cf0d08fe
|
||||
# via
|
||||
# -r requirements.txt
|
||||
# pytesseract
|
||||
@@ -875,9 +873,9 @@ pymupdf==1.25.5 \
|
||||
--hash=sha256:d94b800e9501929c42283d39bc241001dd87fdeea297b5cb40d5b5714534452f \
|
||||
--hash=sha256:ee22155d3a634642d76553204867d862ae1bdd9f7cf70c0797d8127ebee6bed5
|
||||
# via -r requirements.txt
|
||||
pypdf==6.16.2 \
|
||||
--hash=sha256:595647f6191de6f402cfde1d0c455d6cbccbd509aac32b34783009c032de5d6e \
|
||||
--hash=sha256:c8b09a59399062fb45a1b8156c18a787a10a3dae03ac9674397a226712c94604
|
||||
pypdf==6.21.2 \
|
||||
--hash=sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4 \
|
||||
--hash=sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084
|
||||
# via -r requirements.txt
|
||||
pytesseract==0.3.13 \
|
||||
--hash=sha256:4bf5f880c99406f52a3cfc2633e42d9dc67615e69d8a509d74867d3baddb5db9 \
|
||||
@@ -1114,10 +1112,12 @@ safetensors==0.8.0 \
|
||||
--hash=sha256:fcdd41ec4628fee5799f807c73c353629130fbd942aa23d83c623dd6c9d52d78 \
|
||||
--hash=sha256:fd6f3f93c9a0a7cc2788ee63fb763353d4bd2e89b0751bc78fcf7dda00bea774
|
||||
# via transformers
|
||||
setuptools==84.0.0 \
|
||||
--hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
|
||||
--hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
|
||||
# via torch
|
||||
setuptools==84.1.0 \
|
||||
--hash=sha256:23657205b63d4d31395ab917815247f694aafad28cd21316bf5fd45a51048ea0 \
|
||||
--hash=sha256:5231689c6ac8156cd155cfb98c3fd6fb252c3e7e9bd3d78b64d3c55f132624c9
|
||||
# via
|
||||
# -r requirements.txt
|
||||
# torch
|
||||
starlette==1.6.0 \
|
||||
--hash=sha256:a86dd39d14bb45f85a3d18525215a9ef0cfd1f192ac793220e72598c90335f0c \
|
||||
--hash=sha256:d4e3ac5e546444960c710297a3c9fc3f7ebae1b7e963f3d36173b49da535be9b
|
||||
@@ -1191,10 +1191,12 @@ typing-inspection==0.4.4 \
|
||||
--hash=sha256:547274fa6b0a561ccf549cc9524b999a578e737d015d8709d021f9d0d13bea47 \
|
||||
--hash=sha256:65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147
|
||||
# via fastapi
|
||||
urllib3==2.7.0 \
|
||||
--hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
|
||||
--hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
|
||||
# via requests
|
||||
urllib3==2.8.0 \
|
||||
--hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
|
||||
--hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63
|
||||
# via
|
||||
# -r requirements.txt
|
||||
# requests
|
||||
uvicorn==0.34.0 \
|
||||
--hash=sha256:023dc038422502fa28a09c7a30bf2b6991512da7dcdb8fd35fe57cfc154126f4 \
|
||||
--hash=sha256:404051050cd7e905de2c9a7e61790943440b3416f49cb409f965d9dcd0fa73e9
|
||||
|
||||
@@ -5,9 +5,13 @@ transformers==4.48.3
|
||||
cachetools==5.5.2
|
||||
pydantic==2.10.6
|
||||
torch==2.6.0
|
||||
pillow==12.3.0
|
||||
pillow==13.0.0
|
||||
pytesseract==0.3.13
|
||||
pypdf==6.16.2
|
||||
pypdf==6.21.2
|
||||
pymupdf==1.25.5
|
||||
python-docx==1.1.2
|
||||
python-multipart==0.0.32
|
||||
# Constrain transitive TLS/build dependencies to reviewed security fixes.
|
||||
certifi==2026.10.19
|
||||
urllib3==2.8.0
|
||||
setuptools==84.1.0
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
"""Bounded regressions for upload-parser advisories, without hostile large allocations."""
|
||||
|
||||
import io
|
||||
import struct
|
||||
import subprocess
|
||||
import sys
|
||||
import zlib
|
||||
|
||||
import pytest
|
||||
from PIL import Image
|
||||
|
||||
|
||||
def test_truncated_pdf_xref_finishes_without_exhausting_parser_timeout():
|
||||
# GHSA-39mj-jf6j-2qj3: an incomplete xref's final short line must not spin.
|
||||
script = """
|
||||
import io
|
||||
from pypdf import PdfReader
|
||||
from pypdf.errors import PdfReadError
|
||||
body = b'%PDF-1.0\\n 1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\\n 2 0 obj<</Type/Pages/Kids[]/Count 0>>endobj\\n'
|
||||
tail = b'\\n startxref\\n%d\\n%%%%EOF' % len(body)
|
||||
try:
|
||||
PdfReader(io.BytesIO(body + b'xref\\n 0 3\\n 0000000000 65535 f \\n' + tail))
|
||||
except PdfReadError:
|
||||
print('rejected')
|
||||
else:
|
||||
raise AssertionError('Incomplete xref was accepted')
|
||||
"""
|
||||
result = subprocess.run([sys.executable, "-c", script], capture_output=True, text=True, timeout=5)
|
||||
assert result.returncode == 0, result.stderr
|
||||
assert result.stdout.strip() == "rejected"
|
||||
|
||||
|
||||
def test_apng_rejects_oversized_canvas_before_background_allocation(monkeypatch):
|
||||
# GHSA-5xm2-6676-qcp9, scaled to64 pixels so the RED case stays harmless.
|
||||
def chunk(kind, data):
|
||||
return struct.pack(">I", len(data)) + kind + data + struct.pack(">I", zlib.crc32(kind + data))
|
||||
|
||||
png = (
|
||||
b"\x89PNG\r\n\x1a\n"
|
||||
+ chunk(b"IHDR", struct.pack(">IIBBBBB", 8, 8, 8, 6, 0, 0, 0))
|
||||
+ chunk(b"acTL", struct.pack(">II", 2, 0))
|
||||
+ chunk(b"fcTL", struct.pack(">IIIIIHHBB", 0, 1, 1, 0, 0, 1, 10, 1, 0))
|
||||
+ chunk(b"IDAT", zlib.compress(b"\x00\x00\x00\x00\x00"))
|
||||
+ chunk(b"IEND", b"")
|
||||
)
|
||||
monkeypatch.setattr(Image, "MAX_IMAGE_PIXELS", 16)
|
||||
fills = []
|
||||
original_fill = Image.core.fill
|
||||
|
||||
def record_fill(mode, size, *args):
|
||||
fills.append(size)
|
||||
return original_fill(mode, size, *args)
|
||||
|
||||
monkeypatch.setattr(Image.core, "fill", record_fill)
|
||||
with pytest.raises(Image.DecompressionBombError):
|
||||
Image.open(io.BytesIO(png))
|
||||
assert (8, 8) not in fills, "An oversized canvas was allocated before bomb rejection"
|
||||
Reference in New Issue
Block a user