Add INCIDENT_RESPONSE.md by aclark4life · Pull Request #9555 · python-pillow/Pillow

aclark4life · 2026-04-09T16:27:23Z

Changes proposed in this pull request:

Add INCIDENT_RESPONSE.md

hugovk · 2026-04-09T16:32:45Z

.github/INCIDENT_RESPONSE.md

+
+1. **Yank the release immediately** via the PyPI web interface or:
+   ```bash
+   gh api -X POST /pypi/pillow/<version>/yank


Is this real?

Probably not, fixed!

At the risk of making this document larger, add in sections in Bootstrap IRP but not ours. - https://github.com/twbs/bootstrap/blob/main/.github/INCIDENT_RESPONSE.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

wiredfool · 2026-04-09T21:46:36Z

.github/INCIDENT_RESPONSE.md

+
+| Severity | CVSS | Definition | Target Response SLA |
+|---|---|---|---|
+| **Critical** | 9.0 – 10.0 | Remote code execution, arbitrary write, or complete integrity/confidentiality loss achievable by opening a crafted image | 48 hours to patch; embargoed release where possible |


48 hours to patch is faster than we've ever done anything publicly that has been severe.

Unless we're dealing with an active compromise, I think that we're better off being somewhat more careful and definitely not promising 48 hours as an SLA. We might target that for an initial response.

Good catch thanks

…ignment step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere · 2026-04-09T21:55:50Z

.github/INCIDENT_RESPONSE.md

+
+Security fixes are applied to the **latest stable release only**. Users on older versions
+are expected to upgrade. This is consistent with Pillow's quarterly release cadence and
+is not currently documented elsewhere — reporters should assume only the latest release


'is not currently documented elsewhere'

https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Please use the latest version of Pillow. Functionality and security fixes should not be expected to be backported to earlier versions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere · 2026-04-09T22:06:49Z

.github/INCIDENT_RESPONSE.md

+|---|---|---|
+| `pybind11` | Build-time only | C++ ↔ Python bindings |
+| `olefile` | Optional (`fpx`, `mic` extras) | OLE2 container parsing (FPX, MIC formats) |
+| `defusedxml` | Optional (`xmp` extra) | Safe XML parsing for XMP metadata |


This list is missing setuptools

We have more lists of optional deps in pyproject.toml. Do they need repeating here?

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere · 2026-04-09T22:12:03Z

.github/INCIDENT_RESPONSE.md

+| [Plone](https://plone.org/) | CMS image handling |
+| [Jupyter / IPython](https://jupyter.org/) | Inline image display |
+| [ReportLab](https://www.reportlab.com/) | PDF image embedding |
+| [Wand](https://docs.wand-py.org/) | Sometimes used alongside Pillow |


The only mention of Pillow in Wand is https://github.com/emcconville/wand/blob/master/docs/roadmap.rst

PIL has a very long history and most Python projects still depend on it. We will work on a PIL compatibility layer using Wand.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere · 2026-04-10T08:00:12Z

.github/INCIDENT_RESPONSE.md

+   Numbering Authority — no separate MITRE form required). The CVE is reserved privately
+   and published automatically when the advisory goes public.
+6. **Escalation** — Escalate beyond the core maintainer team if any of the following apply:
+   - The vulnerability is being actively exploited in the wild → notify [GitHub Security](mailto:security@github.com) and the [Python Security Response Team](https://www.python.org/news/security/)


Suggested change

- The vulnerability is being actively exploited in the wild → notify [GitHub Security](mailto:security@github.com) and the [Python Security Response Team](https://www.python.org/news/security/)

- The vulnerability is being actively exploited in the wild → notify [GitHub Security](mailto:security@github.com) and the [Python Security Response Team](https://devguide.python.org/developer-workflow/psrt/)

https://www.python.org/news/security/ redirects to https://www.python.org/blogs/

Although https://devguide.python.org/developer-workflow/psrt/ is mainly instructions for the PSRT (I'm a member).

https://www.python.org/dev/security/ is the one for reporters.

But it says the PSRT only accepts CPython and pip reports.

We should not report Pillow security issues there.

And I doubt GitHub security wants to know either.

https://github.com/github/docs/security only asks for reports for GitHub-owned repositories.

Let's delete this whole bullet point.

.github/INCIDENT_RESPONSE.md

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

hugovk · 2026-04-10T11:49:46Z

.github/INCIDENT_RESPONSE.md

+
+## 5. Severity Classification
+
+Use the [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document) base score as


Any reason not to use CVSS 4?

hugovk · 2026-04-10T11:51:05Z

.github/INCIDENT_RESPONSE.md

+
+1. **GitHub private security advisory** — preferred channel; see [SECURITY.md](SECURITY.md)
+2. **Tidelift security contact** — <https://tidelift.com/security>
+3. **Direct maintainer contact** — DM on Mastodon or email


Maybe remove this? I'd prefer to get then via GHSA or Tidelift than potentially being missed in my inbox.

hugovk · 2026-04-10T11:53:06Z

.github/INCIDENT_RESPONSE.md

+4. **External researcher / coordinated disclosure** — e.g. Google Project Zero, vendor PSIRT
+5. **Automated scanning** — Dependabot, GitHub code-scanning (CodeQL), CI fuzzing
+6. **Distro security teams** — Debian, Red Hat, Ubuntu, Alpine may report upstream
+7. **User bug report** — public issue (reassess if it has security implications before it stays public)


"before it stays public" -- there's not much we can do once it's been reported publicly. Issues can be deleted, but I don't know if that helps.

.github/INCIDENT_RESPONSE.md

hugovk · 2026-04-10T11:57:52Z

.github/INCIDENT_RESPONSE.md

+1. Merge the fix to `main`, then cherry-pick to all affected release branches
+   (see [RELEASING.md — Point release](../RELEASING.md)).
+2. Amend commit messages to include the CVE identifier.
+3. Tag and push; the GitHub Actions "Wheels" workflow will build and upload to PyPI.


This is just part of the release process. Should we update RELEASING.md instead of adding different instructions here?

hugovk · 2026-04-10T12:02:57Z

.github/INCIDENT_RESPONSE.md

+3. If a PyPI release is suspected to be tampered: yank it immediately via
+   [https://pypi.org/manage/project/pillow/](https://pypi.org/manage/project/pillow/);
+   file a report with the [PyPI security team](mailto:security@pypi.org).
+4. Notify GitHub Security if repository access or Actions secrets are involved.


Confirm GH Security want this.

hugovk · 2026-04-10T12:08:20Z

.github/INCIDENT_RESPONSE.md

+|---|---|---|
+| `pybind11` | Build-time only | C++ ↔ Python bindings |
+| `olefile` | Optional (`fpx`, `mic` extras) | OLE2 container parsing (FPX, MIC formats) |
+| `defusedxml` | Optional (`xmp` extra) | Safe XML parsing for XMP metadata |


We have more lists of optional deps in pyproject.toml. Do they need repeating here?

hugovk · 2026-04-10T12:09:44Z

.github/INCIDENT_RESPONSE.md

+When a CVE is published for a bundled C library:
+
+1. Assess whether the vulnerable code path is reachable through Pillow's API.
+2. If reachable, treat as a Pillow vulnerability and follow Section 5.


Link to the section

hugovk · 2026-04-10T12:10:24Z

.github/INCIDENT_RESPONSE.md

+## 9. Dependency Map
+
+Understanding what Pillow depends on (upstream) and what depends on Pillow (downstream)
+is essential for scoping impact and coordinating notifications during an incident.
+
+### 10.1 Upstream Dependencies


Fix: 9 then 10.1, 10.2 etc

hugovk · 2026-04-10T12:11:03Z

.github/INCIDENT_RESPONSE.md

+or the formats they decode. See the
+[full plugin list](https://pillow.readthedocs.io/en/stable/handbook/third-party-plugins.html).
+
+### 10.3 Responding to an Upstream Vulnerability


The order is off:

10.1 Upstream Dependencies
10.2 Downstream Dependencies
10.3 Responding to an Upstream Vulnerability

Move 10.3 after 10.1.

radarhere · 2026-04-10T12:31:32Z

.github/INCIDENT_RESPONSE.md

+|---|---|---|
+| [libjpeg-turbo](https://libjpeg-turbo.org/) | JPEG encode/decode | [GitHub](https://github.com/libjpeg-turbo/libjpeg-turbo/security) |
+| [libpng](http://www.libpng.org/pub/png/libpng.html) | PNG encode/decode | [SourceForge](https://sourceforge.net/p/libpng/bugs/) |
+| [libtiff](https://libtiff.gitlab.io/libtiff/) | TIFF encode/decode | [GitLab](https://gitlab.com/libtiff/libtiff/-/issues) |


Suggested change

| [libtiff](https://libtiff.gitlab.io/libtiff/) | TIFF encode/decode | [GitLab](https://gitlab.com/libtiff/libtiff/-/issues) |

| [libtiff](https://libtiff.gitlab.io/libtiff/) | TIFF encode/decode | [GitLab](https://gitlab.com/libtiff/libtiff/-/work_items) |

https://gitlab.com/libtiff/libtiff/-/issues redirects to https://gitlab.com/libtiff/libtiff/-/work_items

radarhere · 2026-04-10T12:31:42Z

.github/INCIDENT_RESPONSE.md

+| [aom](https://aomedia.googlesource.com/aom/) | AV1 codec (AVIF) | [Chromium tracker](https://bugs.chromium.org/p/aomedia/) |
+| [dav1d](https://code.videolan.org/videolan/dav1d) | AV1 decode (AVIF) | [VideoLAN Security](https://www.videolan.org/security/) |
+| [openjpeg](https://www.openjpeg.org/) | JPEG 2000 encode/decode | [GitHub](https://github.com/uclouvain/openjpeg/security) |
+| [freetype2](https://freetype.org/) | Font rendering | [GitLab](https://gitlab.freedesktop.org/freetype/freetype/-/issues) |


radarhere · 2026-04-10T12:31:52Z

.github/INCIDENT_RESPONSE.md

+| [fribidi](https://github.com/fribidi/fribidi) | Unicode bidi (via raqm) | [GitHub](https://github.com/fribidi/fribidi) |
+| [zlib](https://zlib.net/) | Deflate compression | [zlib.net](https://zlib.net/) |
+| [liblzma / xz-utils](https://tukaani.org/xz/) | XZ/LZMA compression | [GitHub](https://github.com/tukaani-project/xz) |
+| [bzip2](https://gitlab.com/bzip2/bzip2) | BZ2 compression | [GitLab](https://gitlab.com/bzip2/bzip2/-/issues) |


Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

- Update CVSS v3.1 to CVSS 4.0 throughout - Remove 'Direct maintainer contact' from detection sources - Fix 'before it stays public' wording for user bug reports - Simplify sections 7.3 and 7.4 to reference RELEASING.md instead of duplicating release process steps - Update RELEASING.md Point release section with security-specific steps (amend CVE in commits, publish GitHub Security Advisory) - Fix PyPI API tokens entry (remove GitHub secrets reference) - Fix 404 PyPI manage URL (use correct case and /releases/ path) - Replace security@pypi.org mailto with https://pypi.org/security/ - Remove unconfirmed 'Notify GitHub Security' bullet - Fix section numbering: 10.x → 9.x under Section 9. Dependency Map - Reorder: move 9.3 Responding to Upstream Vulnerability before 9.3 Downstream Dependencies (now 9.2 and 9.3 respectively) - Add anchor link for Section 5 reference in 9.2 - Add #plugin-list anchor to third-party plugins handbook link - Fix GitLab issue tracker URLs to use /-/work_items for libtiff, freetype2, and bzip2 - Add pyproject.toml reference for complete optional dependencies list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

hugovk reviewed Apr 9, 2026

View reviewed changes

Add INCIDENT_RESPONSE.md

cb5736e

aclark4life force-pushed the irp branch from fd0c2c7 to cb5736e Compare April 9, 2026 16:36

aclark4life added 2 commits April 9, 2026 12:47

Fix links

4d63d0b

Add sections from Bootstrap example

cdaa1bf

At the risk of making this document larger, add in sections in Bootstrap IRP but not ours. - https://github.com/twbs/bootstrap/blob/main/.github/INCIDENT_RESPONSE.md

aclark4life added Documentation 🤖-assisted AI-assisted labels Apr 9, 2026

aclark4life and others added 2 commits April 9, 2026 16:59

Fix version support matrix to reflect main-only security policy

64ed471

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update Readiness Review: quarterly cadence, trim checklist

4a74a20

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aclark4life force-pushed the irp branch from 656b970 to 4a74a20 Compare April 9, 2026 21:24

aclark4life and others added 3 commits April 9, 2026 17:25

Remove backport comment from version support matrix

3aa0761

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Inline Readiness Review procedure as prose

c2ac2da

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Simplify Roles section note

ad582c1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

wiredfool reviewed Apr 9, 2026

View reviewed changes

aclark4life and others added 4 commits April 9, 2026 17:46

Fix severity classification cross-reference, remove incident lead ass…

e0f9e2b

…ignment step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove Tidelift notification step from triage

68be7f3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace section sign (§) with plain Section references

3f90d5c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Change Critical/High SLA targets to best effort

20af4ec

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 9, 2026

View reviewed changes

aclark4life and others added 3 commits April 9, 2026 17:59

Trim version support matrix prose

e74a89f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove section 7.5 Rollback Procedures

00ff863

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Trim Plan Maintenance section

0d440b7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 9, 2026

View reviewed changes

Add setuptools to Python-level dependencies

80a91fd

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 9, 2026

View reviewed changes

aclark4life and others added 4 commits April 9, 2026 18:13

Clarify advisory thread purpose as reporter coordination

6f815c2

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Link to section 1.3 in Plan Maintenance

b579577

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add private channels note to internal communication guidance

5598959

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove Wand from downstream dependencies

6fe81dd

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aclark4life marked this pull request as ready for review April 9, 2026 22:22

radarhere reviewed Apr 10, 2026

View reviewed changes

.github/INCIDENT_RESPONSE.md Outdated Show resolved Hide resolved

radarhere reviewed Apr 10, 2026

View reviewed changes

.github/INCIDENT_RESPONSE.md Outdated Show resolved Hide resolved

radarhere reviewed Apr 10, 2026

View reviewed changes

.github/INCIDENT_RESPONSE.md Outdated Show resolved Hide resolved

aclark4life and others added 2 commits April 10, 2026 07:44

Update .github/INCIDENT_RESPONSE.md

6a0192a

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Remove active exploitation escalation bullet from incident response

d016c90

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aclark4life force-pushed the irp branch from 8dda360 to d016c90 Compare April 10, 2026 11:44

Combine plan maintenance into a single paragraph

24b12dc

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

hugovk reviewed Apr 10, 2026

View reviewed changes

radarhere reviewed Apr 10, 2026

View reviewed changes

aclark4life and others added 2 commits April 10, 2026 10:37

Update .github/INCIDENT_RESPONSE.md

0cbdd2e

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

	- The vulnerability is being actively exploited in the wild → notify [GitHub Security](mailto:security@github.com) and the [Python Security Response Team](https://www.python.org/news/security/)
	- The vulnerability is being actively exploited in the wild → notify [GitHub Security](mailto:security@github.com) and the [Python Security Response Team](https://devguide.python.org/developer-workflow/psrt/)


		## 5. Severity Classification

		Use the [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document) base score as

	\| [libtiff](https://libtiff.gitlab.io/libtiff/) \| TIFF encode/decode \| [GitLab](https://gitlab.com/libtiff/libtiff/-/issues) \|
	\| [libtiff](https://libtiff.gitlab.io/libtiff/) \| TIFF encode/decode \| [GitLab](https://gitlab.com/libtiff/libtiff/-/work_items) \|

	\| [freetype2](https://freetype.org/) \| Font rendering \| [GitLab](https://gitlab.freedesktop.org/freetype/freetype/-/issues) \|
	\| [freetype2](https://freetype.org/) \| Font rendering \| [GitLab](https://gitlab.freedesktop.org/freetype/freetype/-/work_items) \|

	\| [bzip2](https://gitlab.com/bzip2/bzip2) \| BZ2 compression \| [GitLab](https://gitlab.com/bzip2/bzip2/-/issues) \|
	\| [bzip2](https://gitlab.com/bzip2/bzip2) \| BZ2 compression \| [GitLab](https://gitlab.com/bzip2/bzip2/-/work_items) \|

Uh oh!

Conversation

aclark4life commented Apr 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants