From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3400C433EF for ; Thu, 2 Jun 2022 06:30:58 +0000 (UTC) Subject: Re: [meta-python][dunfell][PATCH 1/9] python3-pillow: Upgrade 6.2.1 -> 7.2.0 To: openembedded-devel@lists.openembedded.org From: "Ranjitsinh Rathod" X-Originating-Location: Pune, Maharashtra, IN (165.225.120.241) X-Originating-Platform: Linux Chrome 102 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Wed, 01 Jun 2022 23:30:43 -0700 References: <6bdffec7-eb98-b2ba-a89a-a13cf4ac5a85@gmail.com> In-Reply-To: <6bdffec7-eb98-b2ba-a89a-a13cf4ac5a85@gmail.com> Message-ID: <29102.1654151443160260957@lists.openembedded.org> Content-Type: multipart/alternative; boundary="NL5oovxyscBRZlfIComM" List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 02 Jun 2022 06:30:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/97380 --NL5oovxyscBRZlfIComM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Armin, I understand that we are not upgrading versions on the LTS branch, but this= series of upgrades fixing the below CVEs. CVE-2019 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2019 ) -19911 CVE-20= 20 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2020 ) -10177 CVE-2020 ( h= ttps://asc.bmwgroup.net/mgujira/browse/CVE-2020 ) -10378 CVE-2020 ( https:/= /asc.bmwgroup.net/mgujira/browse/CVE-2020 ) -10379 CVE-2020 ( https://asc.b= mwgroup.net/mgujira/browse/CVE-2020 ) -10994 CVE-2020 ( https://asc.bmwgrou= p.net/mgujira/browse/CVE-2020 ) -11538 CVE-2020 ( https://asc.bmwgroup.net/= mgujira/browse/CVE-2020 ) -35653 CVE-2020 ( https://asc.bmwgroup.net/mgujir= a/browse/CVE-2020 ) -35654 CVE-2020 ( https://asc.bmwgroup.net/mgujira/brow= se/CVE-2020 ) -35655 CVE-2020 ( https://asc.bmwgroup.net/mgujira/browse/CVE= -2020 ) -5310 CVE-2020 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2020 )= -5311 CVE-2020 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2020 ) -5312 = CVE-2020 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2020 ) -5313 CVE-202= 1 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -23437 CVE-2021 ( ht= tps://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -25287 CVE-2021 ( https://= asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -25288 CVE-2021 ( https://asc.bm= wgroup.net/mgujira/browse/CVE-2021 ) -25289 CVE-2021 ( https://asc.bmwgroup= .net/mgujira/browse/CVE-2021 ) -25290 CVE-2021 ( https://asc.bmwgroup.net/m= gujira/browse/CVE-2021 ) -25291 CVE-2021 ( https://asc.bmwgroup.net/mgujira= /browse/CVE-2021 ) -25292 CVE-2021 ( https://asc.bmwgroup.net/mgujira/brows= e/CVE-2021 ) -25293 CVE-2021 ( https://asc.bmwgroup.net/mgujira/browse/CVE-= 2021 ) -27921 CVE-2021 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2021 )= -27922 CVE-2021 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -2792= 3 CVE-2021 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -28675 CVE-= 2021 ( https://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -28676 CVE-2021 (= https://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -28677 CVE-2021 ( https= ://asc.bmwgroup.net/mgujira/browse/CVE-2021 ) -28678 CVE-2021 ( https://asc= .bmwgroup.net/mgujira/browse/CVE-2021 ) -34552 CVE-2022 ( https://asc.bmwgr= oup.net/mgujira/browse/CVE-2022 ) -22815 CVE-2022 ( https://asc.bmwgroup.ne= t/mgujira/browse/CVE-2022 ) -22816 CVE-2022 ( https://asc.bmwgroup.net/mguj= ira/browse/CVE-2022 ) -22817 CVE-2022 ( https://asc.bmwgroup.net/mgujira/br= owse/CVE-2022 ) -24303 To solve these many CVEs by applying a patch would be really tough and main= taining patches too. What is your opinion here? Thanks, Ranjitsinh Rathod --NL5oovxyscBRZlfIComM Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Armin,

I understand that we are not upgrading versions on the= LTS branch, but this series of upgrades fixing the below CVEs.
CVE-2019-19911 CVE-2020-10177 CVE-2020-10378 CVE-20= 20-10379 CVE-2020-10994 CVE-2020-11538 CVE-2020= -35653 CVE-2020-35654 <= /span>CVE-2020-35655 CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2= 020-5313 CVE-2021-23437 CVE-2021-25287 CVE-2021= -25288 CVE-2021-25289 <= /span>CVE-2021-25290 CVE-2021-25291 CVE-2021-25292 CVE-2021-25293 = CVE-2021-27921 CVE-2021= -27922 CVE-2021-27923 CVE-2021-28675 CVE-2021-2= 8676 CVE-2021-28677 CVE-2021-28678 CVE-2021-34552 CVE-2022-22815 CVE-2022-22816 CVE-= 2022-22817 CVE-2022= -24303

To solve these many CVEs by applying a p= atch would be really tough and maintaining patches too. What is your opinio= n here?

Thanks,
Ranjitsinh Rathod
--NL5oovxyscBRZlfIComM--