[Security] Dependabot: Pillow (critical) #427

#jules

Vulnerable dependency: Pillow

• Highest severity: critical

• Open alerts: 14

• GHSA-vx6w-vv9f-6gvg Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-vx6w-vv9f-6gvg Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-q45j-58j2-45rg Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-q45j-58j2-45rg Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-c6hw-5grf-ff96 Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-c6hw-5grf-ff96 Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-65qm-jvmh-6pqg Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-65qm-jvmh-6pqg Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-pchr-8j38-3x4p Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-pchr-8j38-3x4p Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-58r4-6rv3-gfh8 Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-58r4-6rv3-gfh8 Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-8g5g-8vmr-9782 Pillow: Heap buffer overflow in ImagingJpegDecode
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-8g5g-8vmr-9782 Pillow: Heap buffer overflow in ImagingJpegDecode
  manifest: requirements.txt, fixed in: 13.0.0

Remediation steps

1. Upgrade Pillow to at least the fixed version(s) listed above in every manifest/lockfile.
2. Regenerate lockfiles and run the test suite.
3. Open a PR; the Dependabot alerts should auto-close after merge.