Post #1860135
2026-04-30 14:28 UTC
@hynek @hugovk @davidism I may be tempting fate by mentioning it, but I'm mildly surprised we don't see anyone pointing to the crash bug reproducers we have in CPython's testing folder and saying "security flaws!" (anyone in a position to exploit them is already able to run arbitrary Python code and probably has more interesting code snippets they could be running instead).
Replies (2)
-
@hugovk@mastodon.social 2026-04-30 15:27
@ancoghlan @hynek @davidism Oh, we've had reports about scanners complaining about Pillow test images, ones we crafted especially to make sure our fix works. Yes, we could delete the test image, but then we might break the fix and ship a vulnerability in real code!
-
@brettcannon@mastodon.social 2026-04-30 17:29
@ancoghlan @hynek @hugovk @davidism I was thinking about that exact thing a couple weeks ago, but kept quiet not to tempt fate 😁