@@ -385,7 +385,7 @@ When a CVE is published for a bundled C library:
385385> We aim to treat all vulnerability reports in line with coordinated disclosure principles.
386386> If you have any questions or concerns at any point, please reply to this thread.
387387>
388- > Thanks again,
388+ > Thanks again,
389389> The Pillow maintainers
390390
391391### A.2 Embargoed Distro Notification
@@ -395,20 +395,20 @@ When a CVE is published for a bundled C library:
395395> This is an embargoed notification of a vulnerability in Pillow. Please keep this
396396> information confidential until the disclosure date listed below.
397397>
398- > ** CVE:** \< CVE-XXXX -XXXXX\>
399- > ** Affected versions:** \< e.g. Pillow < 11.x.x\>
400- > ** Fixed version:** \< version\>
401- > ** Severity:** \< Critical / High / Medium / Low\> (CVSS \< score\> : \< vector\> )
402- > ** Reporter:** \< name / affiliation, or "reported privately"\>
398+ > ** CVE:** \< CVE-XXXX -XXXXX\>
399+ > ** Affected versions:** \< e.g. Pillow < 11.x.x\>
400+ > ** Fixed version:** \< version\>
401+ > ** Severity:** \< Critical / High / Medium / Low\> (CVSS \< score\> : \< vector\> )
402+ > ** Reporter:** \< name / affiliation, or "reported privately"\>
403403> ** Public disclosure date:** \< DATE TIME UTC\>
404404>
405- > ** Summary:**
405+ > ** Summary:**
406406> \< One paragraph describing the vulnerability class and impact without a full exploit.\>
407407>
408- > ** Proof of concept:**
408+ > ** Proof of concept:**
409409> \< Minimal reproducer or attached patch.\>
410410>
411- > ** Remediation:**
411+ > ** Remediation:**
412412> Upgrade to Pillow \< fixed version\> . No known workaround.
413413>
414414> Please do not share this information, issue public patches, or make user communications
@@ -422,21 +422,21 @@ When a CVE is published for a bundled C library:
422422
423423> ** Summary:** \< One-paragraph technical summary.\>
424424>
425- > ** CVE:** \< CVE-XXXX -XXXXX\>
426- > ** Affected versions:** Pillow \< \< fixed version\>
427- > ** Fixed version:** \< version\>
428- > ** Severity:** \< rating\> (CVSS \< score\> )
425+ > ** CVE:** \< CVE-XXXX -XXXXX\>
426+ > ** Affected versions:** Pillow \< \< fixed version\>
427+ > ** Fixed version:** \< version\>
428+ > ** Severity:** \< rating\> (CVSS \< score\> )
429429> ** Reporter:** \< credited name / "reported privately"\>
430430>
431- > ** Details:**
431+ > ** Details:**
432432> \< Fuller technical description. Include attack scenario where helpful.\>
433433>
434- > ** Remediation:**
434+ > ** Remediation:**
435435> ```
436436> pip install --upgrade Pillow
437437> ```
438438>
439- > **Timeline:**
440- > - Reported: \<date\>
441- > - Fixed: \<date\>
439+ > **Timeline:**
440+ > - Reported: \<date\>
441+ > - Fixed: \<date\>
442442> - Disclosed: \<date\>
0 commit comments