Open
fix(cve): 修复 CVE-2026-96638 在 python-pillow 中的漏洞 #322
fix(cve): 修复 CVE-2026-96638 在 python-pillow 中的漏洞 #322
Open
infra_teamAdd on 8 days ago
infra_team
8 days ago

当前PR是否有AI参与:

[ ] 否

[x] Yes
__1. AI Agent 平台: Claude Code / CVE Agent Team
__2. AI 模型 : claude-sonnet-4-6
__3. Prompt 上下文 : CVE 漏洞修复全流程:归属分析、修复方案设计(backport/upgrade)、patch 生成、SPEC 文件修改(Patch/Version/Release/Changelog)、本地构建验证(rpmbuild -bp)

PR功能描述 / 为什么需要这个合入:

  • 🔍 全量审计声明:本项目已基于上游主分支执行全量补丁审计
  • CVE: CVE-2026-96638
  • 策略:backport
  • 改动详情:
    • 新增 backport-CVE-2026-96638.patch(Patch18):backport 上游 9af332ef(#9824,absolute mode 追加以 dest_length 为上限)与 e7794835(#10015,delta escape 追加以 dest_length 为上限),修复 src/PIL/BmpImagePlugin.py 中 BmpRleDecoder.decode() 解码 BMP RLE 压缩图像时无界追加导致的内存放大问题
    • python-pillow.spec:新增 Patch18,Release 14 -> 15,补 changelog 条目

该PR关联的issue

(格式为fixes #<issue号>, 或者resolves #<issue号>): fixes #110

希望检视人员了解:

likedislike
Merge blocked
Iinfra_team
8 days ago Created pull request, commit dd30ae40
Iinfra_team
8 days ago Associated issue: CVE-2026-96638
openeuler-ci-botopeneuler-ci-botCollaborators
8 days ago Added label: ai-co-authored
openeuler-ci-botopeneuler-ci-botCollaborators
8 days ago Added label: ai-includes-code
openeuler-bot
openeuler-botCollaborators
8 days ago Comments:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-pillow/249

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
8 days ago Comments:

当前仓库存在以下 保护分支 :

Protected Branch Version Release
master 13.0.0 1
openEuler-20.03-LTS-SP4 9.0.1 17
openEuler-24.03-LTS-SP1 10.3.0 14
openEuler-24.03-LTS-Next 10.3.0 14
openEuler-24.03-LTS-SP4 10.3.0 14
openEuler-24.03-LTS-SP3 10.3.0 14
openEuler-22.03-LTS-SP4 9.0.1 17
openEuler-26.09 12.3.0 1
Multi-Version_OpenStack-Gazpacho_openEuler-24.03-LTS-Next 9.2.0 2
Multi-Version_OpenStack-Gazpacho_openEuler-24.03-LTS-SP4 9.2.0 1
openEuler-26.09-DevStation 12.3.0 1
Multi-Version_OpenStack-Antelope_openEuler-24.03-LTS-SP4 9.2.0 1
Multi-Version_OpenStack-Wallaby_openEuler-24.03-LTS-SP4 9.2.0 2
Multi-Version_OpenStack-Antelope_openEuler-24.03-LTS-SP3 9.2.0 1
Multi-Version_OpenStack-Wallaby_openEuler-24.03-LTS-SP3 9.2.0 2
Multi-Version_OpenStack-Wallaby_openEuler-24.03-LTS-Next 9.2.0 2
Multi-Version_OpenStack-Wallaby_openEuler-24.03-LTS-SP2 9.2.0 2
Multi-Version_OpenStack-Wallaby_openEuler-24.03-LTS 9.2.0 2
Multi-Version_OpenStack-Wallaby_openEuler-24.03-LTS-SP1 9.2.0 2
oepkg_openstack-rocky_oe-20.03-LTS-Next 8.1.2 3
oepkg_openstack-queens_oe-20.03-LTS-Next 8.1.2 3
Multi-Version_OpenStack-Wallaby_openEuler-22.03-LTS-SP4 8.1.2 3
Multi-Version_OpenStack-Wallaby_openEuler-22.03-LTS-SP3 8.1.2 3
Multi-Version_OpenStack-Wallaby_openEuler-22.03-LTS-SP2 8.1.2 3
Multi-Version_OpenStack-Wallaby_openEuler-22.03-LTS-SP1 8.1.2 3
Multi-Version_OpenStack-Wallaby_openEuler-22.03-LTS-Next 8.1.2 3
Multi-Version_OpenStack-Antelope_openEuler-25.03 9.2.0 1
Multi-Version_OpenStack-Antelope_openEuler-24.03-LTS-SP2 9.2.0 1
Multi-Version_OpenStack-Antelope_openEuler-24.03-LTS-SP1 9.2.0 1
Multi-Version_OpenStack-Antelope_openEuler-24.03-LTS-Next 9.2.0 1
Multi-Version_OpenStack-Antelope_openEuler-24.03-LTS 9.2.0 1

评论 /sync <branch1> <branch2> ... 可将当前 PR 修改同步到其它分支(创建同步 PR):
a) 如果当前 PR 是 Open 状态,同步操作将延迟到 PR 被合并时执行
b) 如果当前 PR 已经 Merged,将立即执行同步操作

注意:

  1. /sync 命令可以指定同步到多个分支,仅最后一个 /sync 命令生效
  2. 如果创建的同步 PR 不正确,可通过向同步 PR 的源分支提交轻量级 PR 完善,或使用 /close 命令关闭
likedislike
openeuler-botopeneuler-botCollaborators
8 days ago Added label: ci_processing
openeuler-ci-botopeneuler-ci-botCollaborators
8 days ago Set shinwell_hu,yangzhao_kl as approver
openeuler-ci-botopeneuler-ci-botCollaborators
8 days ago Added label: sig/sig-python-modules
openeuler-ci-bot
openeuler-ci-botCollaborators
8 days ago Comments:

Welcome To openEuler Community

Hey @infra_team , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. You can self-configure the PR merge rules for this repository. For more details, please refer to Here.

Contact Guide

If you have any questions, please contact the SIG: sig-python-modules ,
and any of the maintainers: @shinwell_hu, @yangzhao_kl ,
and any of the committers: @cherry530, @randy1568, @starlet-dx .

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
8 days ago Added label: openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-botCollaborators
8 days ago Comments:

CLA Signature Pass

infra_team, thanks for your pull request. All authors of the commits have signed the CLA. 👍

likedislike
openeuler-bot
openeuler-botCollaborators
8 days ago Comments:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/python-pillow/249

likedislike
openeuler-bot
openeuler-botCollaborators
8 days ago Comments:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/python-pillow/249

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
8 days ago Added label: ai-compliance-failed
openeuler-ci-bot
openeuler-ci-botCollaborators
8 days ago Comments:

AI Declaration Check Failed

@infra_team, AI declaration is not compliant. AI tool: Claude Code

Please check:

  1. The AI tool and model declared in the PR description must be real.
  2. Commit messages must include the AI model, and it must be consistent with the PR description.

Details: AI Coding Assistants. ⚠️

likedislike
openeuler-botopeneuler-botCollaborators
8 days ago Removed label: ci_processing
openeuler-bot
openeuler-botCollaborators
8 days ago Comments:
Check Name Build Result 详情 Build Details
check_binary_file ✅SUCCESS #249
check_lfsconfig ☑EXCLUDE
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ✅SUCCESS
x86_64 check_build ✅SUCCESS #249
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ✅SUCCESS #249
check_install ✅SUCCESS
check_license ✅SUCCESS
likedislike
openeuler-botopeneuler-botCollaborators
8 days ago Added label: ci_successful
openeuler-bot
openeuler-botCollaborators
8 days ago Comments:

如下为接口变更检查结果,目标分支为openEuler-24.03-LTS-SP3,请PR提交者check差异信息

Arch Name Check Items Rpm Name Check Result Build Details
compare_package(x86_64) add_rpms ✅SUCCESS #249
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
compare_package(aarch64) add_rpms ✅SUCCESS #249
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
likedislike
openeuler-bot
openeuler-botCollaborators
8 days ago Comments:
likedislike
xu_pingCollaborators
3 days ago Comments:

/retest

likedislike
openeuler-bot
openeuler-botCollaborators
3 days ago Comments:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-pillow/259

likedislike
openeuler-botopeneuler-botCollaborators
3 days ago Removed label: ci_successful
openeuler-botopeneuler-botCollaborators
3 days ago Added label: ci_processing
openeuler-bot
openeuler-botCollaborators
3 days ago Comments:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/python-pillow/259

likedislike
openeuler-bot
openeuler-botCollaborators
3 days ago Comments:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/python-pillow/259

likedislike
openeuler-botopeneuler-botCollaborators
3 days ago Removed label: ci_processing
openeuler-bot
openeuler-botCollaborators
3 days ago Comments:
Check Name Build Result 详情 Build Details
check_binary_file ✅SUCCESS #259
check_lfsconfig ☑EXCLUDE
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ✅SUCCESS
x86_64 check_build ✅SUCCESS #259
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ✅SUCCESS #259
check_install ✅SUCCESS
check_license ✅SUCCESS
likedislike
openeuler-botopeneuler-botCollaborators
3 days ago Added label: ci_successful
openeuler-bot
openeuler-botCollaborators
3 days ago Comments:

如下为接口变更检查结果,目标分支为openEuler-24.03-LTS-SP3,请PR提交者check差异信息

Arch Name Check Items Rpm Name Check Result Build Details
compare_package(x86_64) add_rpms ✅SUCCESS #259
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
compare_package(aarch64) add_rpms ✅SUCCESS #259
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
likedislike
openeuler-bot
openeuler-botCollaborators
3 days ago Comments:
likedislike
xu_pingCollaborators
3 days ago Comments:

/lgtm
/approve

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
3 days ago Added label: approvedlgtm
openeuler-ci-bot
openeuler-ci-botCollaborators
3 days ago Comments:

Review Code Feedback

  • The label lgtm, approved was added to this pull request. It means that cherry530 reviewed the code changes. 👋
Tips
  • If this pull request is not merged while all conditions are met, comment /check-pr to try again. 😄
likedislike