CVE-2021-25290

Advisory

Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* **SECURITY**: Bumped Pillow from 8.1.0 to 8.1.2 https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
* **SECURITY**: Tightened security check for the password change page.
* Added a warning message on theme editor to indicate site reload is needed if template caching is on.
* Ordering fix for helpfiles FAQ (Thanks bernd-wechner)
* Removed the word "test" from default fixtures
* Extended max_length for user_display field on corp reps add/edit
* Updated the description for the setting "Create User on Form Submissions" and forms default fixtures.
* Membership view improvements on members search (Thanks bernd-wechner)
* Resolved an error RelatedObjectDoesNotExist in helpdesk
* Avoided a bad escape in forms

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25290