Backfill release notes with security fix details #7877

aclark4life · 2024-03-13T19:13:33Z

Resolves #7864

Added release notes for past releases: 2.6.0, 2.5.2,2.3.2, 2.3.1.
Add suggested CVE format to template
Move Security to the top of release notes
Fix headings
Update all existing CVE notes to match template

docs/releasenotes/2.3.1.rst

docs/releasenotes/10.2.0.rst

docs/releasenotes/6.2.0.rst

docs/releasenotes/6.2.2.rst

aclark4life · 2024-03-13T19:34:58Z

Thanks @hugovk and @nulano and @radarhere for the fixes and feedback!

docs/releasenotes/10.0.0.rst

hugovk · 2024-03-13T20:14:52Z

Thanks for this! Definitely makes sense to move the security notes up.

I'm in two minds about adding extra "Fix CVE-YYYY-XXXXX" headers with the "More information about this vulnerability included in database record CVE-2023-44271" note.

Comparison:

Before	After

The "Note: More information about this vulnerability included in database record CVE-2023-44271" uses up a lot of space and doesn't really tell us much, it's mainly saying there's a link.

The font sizes aren't that different and it might not be totally clear that "Added ImageFont.MAX_STRING_LENGTH" is a subheading of "Fix CVE-2023-44271". They could think the note is the only thing, and relevant to the CVE.

I think I prefer the original with just a descriptive header and CVE-YYYY-XXXXX: prefix for the paragraph.

aclark4life · 2024-03-13T20:40:12Z

I think I prefer the original with just a descriptive header and CVE-YYYY-XXXXX: prefix for the paragraph.

Me too although I'm trying to overemphasize CVE reporting in the release notes so I can pass to Tidelift for review so they can compare before and after lifting. We can probably come up with something in the middle. Let me think about it and try to fix when I add the remaining back fills.

One possibility is

CVE-YYYY-XXXXX

Instead of

Fix CVE-YYYY-XXXXX

Because the fix is probably implied.

As for the CVE note, the over-consumption of space was intended … but at the same time I agree there's not much going on there.

Lastly I don't worry too much about confusion over section content organization, or at least I should say they read OK to me either way.

hugovk · 2024-03-13T20:54:09Z

I don't think the fact something was assigned a CVE ID is the most important thing.

We should write for our main audience - users - who want to know what's in a release, not Tidelift so they can see a difference pre/post-lifting.

However, I think we had very few (if any?) CVEs assigned pre-Tidelift, so something like a search for "cve" instantly shows the positive impact of lifting.

As a compromise, how about including the CVE link in the existing title like this?

.. _Added ImageFont.MAX_STRING_LENGTH:

:cve:`2023-44271`: Added ImageFont.MAX_STRING_LENGTH
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

To protect against potential DOS attacks when using arbitrary strings as text
input, Pillow will now raise a :py:exc:`ValueError` if the number of characters
passed into ImageFont methods is over a certain limit,
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`.

This threshold can be changed by setting
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`. It can be disabled by setting
``ImageFont.MAX_STRING_LENGTH = None``.

(The .. _Added ImageFont.MAX_STRING_LENGTH: is a reference so the old anchors still work, for people using permalinks to the old headers.)

aclark4life · 2024-03-13T21:26:05Z

I don't think the fact something was assigned a CVE ID is the most important thing.

We should write for our main audience - users - who want to know what's in a release, not Tidelift so they can see a difference pre/post-lifting.

I'm going to raise Subjective here. Suffice it to say, improvements we make for Tidelift are by design for users.

However, I think we had very few (if any?) CVEs assigned pre-Tidelift, so something like a search for "cve" instantly shows the positive impact of lifting.

Easily answering that question is the primary goal of this PR. The first pre-Tidelift CVE fix was just retro-added in 2.3.1 (c451df3) and the earliest possible fix to include Tidelift support is in 6.2.0 or so.

As a compromise, how about including the CVE link in the existing title like this?

.. _Added ImageFont.MAX_STRING_LENGTH:

:cve:`2023-44271`: Added ImageFont.MAX_STRING_LENGTH
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

To protect against potential DOS attacks when using arbitrary strings as text
input, Pillow will now raise a :py:exc:`ValueError` if the number of characters
passed into ImageFont methods is over a certain limit,
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`.

This threshold can be changed by setting
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`. It can be disabled by setting
``ImageFont.MAX_STRING_LENGTH = None``.

(The .. _Added ImageFont.MAX_STRING_LENGTH: is a reference so the old anchors still work, for people using permalinks to the old headers.)

Yes! I will try this, thanks.

docs/releasenotes/9.0.0.rst

docs/releasenotes/8.2.0.rst

docs/releasenotes/8.1.2.rst

docs/releasenotes/6.2.0.rst

docs/releasenotes/2.3.2.rst

docs/releasenotes/2.3.1.rst

docs/releasenotes/10.3.0.rst

Before back fill, clean up. - Add suggested CVE format to template - Move Security to the top of release notes - Fix headings - Update all existing CVE notes to match template

for more information, see https://pre-commit.ci

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Co-authored-by: Ondrej Baranovič <nulano@nulano.eu>

@hugovk

- Include CVE link in title (via @hugovk) - Retro-add release notes for 2.3.2, 2.5.2 for CVE-2014-3589

for more information, see https://pre-commit.ci

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

- Back fill release notes for 3.1.1 - Add credits to 2.3.2, 2.5.2

- Restore accidentally overwritten contents - Update to match updated template

- Categorized previously uncategorized notes under ``Other Changes`` - TODO: Fix categorization of notes in ``Other Changes`` that belong in other categories

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

aclark4life · 2024-03-15T18:14:10Z

Thanks again @hugovk @nulano @radarhere ! I think this is about ready to go. If folks still don't like the 10.3.0 release notes entry, I can remove. But I do want to keep track of that list of CVEs I just added in 115179e somewhere. Maybe sneak it into deprecations and removals e.g. "We removed all these vulnerabilities" 😄

docs/releasenotes/2.6.0.rst

hugovk · 2024-03-16T18:14:27Z

docs/releasenotes/10.3.0.rst

+- 1995-2009: No known CVEs
+- 2010-2018: :cve:`2014-1932`, :cve:`2014-3589`, :cve:`2016-0740`, :cve:`2016-3076`
+- 2019-2024: :cve:`2019-16865`, :cve:`2019-19911`, :cve:`2020-10177`, :cve:`2020-15999`,


These date ranges seem arbitrary and unexplained.

Why start in 1995? CVEs began in 1999:

The CVE List was officially launched for the public in September 1999.

https://www.cve.org/About/History

Why start the second range in 2010? The first listed CVE is 2014.

1995-2009: PIL
2010-2018: Pillow
2019-2024: Pillow w/Tidelift support

hugovk · 2024-03-16T18:21:12Z

docs/releasenotes/10.3.0.rst

+
+Added release notes for past releases: ``2.6.0``, ``2.5.2``,
+``2.3.2``, ``2.3.1``. With these additions we are able to
+provide a comprehensive list of all Pillow CVE records from


There are only 23 CVEs listed here.

But there are 48 listed at #7864, do we not need those extra ones?

Good catch! I'm not sure, but I do want to track all CVEs from 1995 (dawn of CVEs) to now.

hugovk · 2024-03-16T22:56:12Z

docs/releasenotes/2.6.0.rst

+Other Changes
+=============
+
+Relaxed precision of some tests
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Relaxed imagedraw tests to allow slight errors for x86 vs x64.


Hmm, this was indeed something added to 2.6.0, but it seems insignificant on its own. We rarely mention changes to tests in release notes.

Plus there's also all the 2.6.0-rc1 changes not included, and we've not added the non-CVE fixes to the other new files, and the other non-CVE releases are skipped, so I think we could skip this.

Fine to remove, yeah

hugovk · 2024-03-16T22:58:07Z

docs/releasenotes/2.7.0.rst

+Other Changes
+=============


Feels a bit odd starting off with "Other changes"?

If we're going to apply the template to older release notes (I wouldn't worry too much about it), we should re-categorise all the entries rather than dropping them all in "Other".

Right, that was a placeholder for … moving them out of the "Other Changes" category into the appropriate category.

hugovk · 2024-03-16T23:01:46Z

docs/releasenotes/2.8.0.rst

+Other Changes
+=============


hugovk · 2024-03-16T23:11:32Z

docs/releasenotes/3.4.0.rst

+Other changes
+=============


I think we could use "API Additions"

hugovk · 2024-03-16T23:13:34Z

docs/releasenotes/4.2.0.rst

+Deprecations
+============


Also "Backwards Incompatible Changes" for removals

hugovk · 2024-03-16T23:14:42Z

docs/releasenotes/5.1.0.rst

@@ -30,6 +21,12 @@ Images can now be appended to PDF files in place by passing in
 Other Changes
 =============

+New BLP File Format


Could also be "API Changes", or "API Additions"

docs/releasenotes/10.3.0.rst

docs/releasenotes/2.6.0.rst

hugovk

Thanks for this.

If possible, please do wait for an approving review before merge, especially on big PRs.

I was intending to do another pass, so I've made #7885 with most of the suggestions.

aclark4life · 2024-03-17T00:05:30Z

If possible, please do wait for an approving review before merge, especially on big PRs.

Sorry, will do!

aclark4life changed the title ~~7864 backfill~~ Backfill release notes with security fix details Mar 13, 2024

hugovk reviewed Mar 13, 2024

View reviewed changes

nulano reviewed Mar 13, 2024

View reviewed changes

docs/releasenotes/10.0.0.rst Outdated Show resolved Hide resolved

radarhere added the Documentation label Mar 13, 2024

aclark4life force-pushed the 7864-backfill branch from 944367d to 2f38e20 Compare March 14, 2024 18:00

hugovk reviewed Mar 14, 2024

View reviewed changes

radarhere reviewed Mar 15, 2024

View reviewed changes

docs/releasenotes/10.3.0.rst Outdated Show resolved Hide resolved

aclark4life and others added 18 commits March 15, 2024 10:01

Clean up for #7864

04f60eb

Before back fill, clean up. - Add suggested CVE format to template - Move Security to the top of release notes - Fix headings - Update all existing CVE notes to match template

Clean up for #7864

231e738

Clean up for #7864

95b3138

Retro-add release notes for 2.3.1 for #7864

2b8dfaa

[pre-commit.ci] auto fixes from pre-commit.com hooks

20d451b

for more information, see https://pre-commit.ci

Update docs/releasenotes/2.3.1.rst

a200d71

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/2.3.1.rst

914db6c

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/6.2.2.rst

a78fbfe

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/6.2.0.rst

deca2dd

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/10.2.0.rst

1f11733

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/10.0.0.rst

f77273d

Co-authored-by: Ondrej Baranovič <nulano@nulano.eu>

Fix template based on 29a361d

92f0889

Fix based on 29a361d

f61e184

Fix headers and retro-add notes for #7864

c69dcc1

- Include CVE link in title (via @hugovk) - Retro-add release notes for 2.3.2, 2.5.2 for CVE-2014-3589

[pre-commit.ci] auto fixes from pre-commit.com hooks

3aefe92

for more information, see https://pre-commit.ci

Update docs/releasenotes/9.0.0.rst

7b1c39c

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/8.2.0.rst

4d81ec8

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/8.1.2.rst

bae0c98

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

aclark4life and others added 11 commits March 15, 2024 10:01

Update docs/releasenotes/6.2.0.rst

e97722b

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/6.2.0.rst

7b485c7

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update docs/releasenotes/6.2.0.rst

69a4e0d

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

80 char wrap + file name tick for #7864

15deb71

Combine CVEs

ad134c6

Back fill release notes for #7864

ae5f1de

- Back fill release notes for 3.1.1 - Add credits to 2.3.2, 2.5.2

Update 3.1.1, 8.1.1 release notes for #7864

0ea144b

Restore and update 3.1.1 release notes for #7864

f316fd9

- Restore accidentally overwritten contents - Update to match updated template

Update release notes to match template for #7864

180f37b

- Categorized previously uncategorized notes under ``Other Changes`` - TODO: Fix categorization of notes in ``Other Changes`` that belong in other categories

Update release notes to match template for #7864

b5f7779

Update release notes to match template for #7864

45975e4

aclark4life force-pushed the 7864-backfill branch from 66a21cc to 45975e4 Compare March 15, 2024 14:01

aclark4life and others added 3 commits March 15, 2024 10:03

Update docs/releasenotes/7.1.0.rst

4438305

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Add release notes for 2.6.0 for #7864

5b3dabb

Update release notes for #7864

115179e

Wording

e7d8774

radarhere reviewed Mar 16, 2024

View reviewed changes

docs/releasenotes/2.6.0.rst Show resolved Hide resolved

aclark4life merged commit 913dc60 into main Mar 16, 2024
10 of 11 checks passed

aclark4life deleted the 7864-backfill branch March 16, 2024 10:06

hugovk reviewed Mar 16, 2024

View reviewed changes

hugovk mentioned this pull request Mar 16, 2024

Update release notes #7885

Merged

hugovk reviewed Mar 16, 2024

View reviewed changes

radarhere mentioned this pull request Mar 17, 2024

Update release notes hugovk/Pillow#115

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Backfill release notes with security fix details #7877

Backfill release notes with security fix details #7877

aclark4life commented Mar 13, 2024 •

edited

aclark4life commented Mar 13, 2024 •

edited

hugovk commented Mar 13, 2024

aclark4life commented Mar 13, 2024

hugovk commented Mar 13, 2024

aclark4life commented Mar 13, 2024

aclark4life commented Mar 15, 2024

hugovk Mar 16, 2024

aclark4life Mar 16, 2024

hugovk Mar 16, 2024

aclark4life Mar 16, 2024

hugovk Mar 16, 2024

aclark4life Mar 17, 2024

hugovk Mar 16, 2024

aclark4life Mar 17, 2024

hugovk Mar 16, 2024

hugovk Mar 16, 2024

hugovk Mar 16, 2024

hugovk Mar 16, 2024

hugovk left a comment

aclark4life commented Mar 17, 2024

		Deprecations
		============

Backfill release notes with security fix details #7877

Backfill release notes with security fix details #7877

Conversation

aclark4life commented Mar 13, 2024 • edited

aclark4life commented Mar 13, 2024 • edited

hugovk commented Mar 13, 2024

aclark4life commented Mar 13, 2024

CVE-YYYY-XXXXX

Fix CVE-YYYY-XXXXX

hugovk commented Mar 13, 2024

aclark4life commented Mar 13, 2024

aclark4life commented Mar 15, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hugovk left a comment

Choose a reason for hiding this comment

aclark4life commented Mar 17, 2024

aclark4life commented Mar 13, 2024 •

edited

aclark4life commented Mar 13, 2024 •

edited