[Snyk:High] Upgrade pillow to 9.0.0 (due by 02/26/2022)

[pkfec]

Overview

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Arbitrary Code Execution via PIL.ImageMath.eval which allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

https://security.snyk.io/vuln/SNYK-PYTHON-PILLOW-2331901

###Detailed path
Introduced through: project@0.0.0 › pillow@8.3.2
Introduced through: project@0.0.0 › wagtail@2.11.8 › pillow@8.3.2

Remediation:

Upgrade pillow to version 9.0.0

Completion criteria:

• Upgrade pillow to version 9.0.0

[patphongs]

Upgrading to Pillow 9 would be a risk to us since we are currently on a lower version of Wagtail. Closing this since Pillow is only used within our authenticated CMS system and does not pose an imminent risk.