From c90d5cd84b0e27906310c28f0d78c3ded9106d65 Mon Sep 17 00:00:00 2001
From: "James R. Barlow" <james@purplerock.ca>
Date: Wed, 29 Nov 2023 14:10:04 -0800
Subject: [PATCH] Fix Ghostscript installation instructions and add warning

---
 docs/installation.rst                       |  6 ++++--
 docs/release_notes.rst                      |  6 ++++++
 src/ocrmypdf/builtin_plugins/ghostscript.py | 13 +++++++++++--
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/docs/installation.rst b/docs/installation.rst
index 18a838416..ad0687259 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -391,15 +391,17 @@ package manager:
 
 * ``winget install -e --id Python.Python.3.11``
 * ``winget install -e --id UB-Mannheim.TesseractOCR``
-* ``winget install -e --id ArtifexSoftware.GhostScript``
 
+You will need to install Ghostscript manually, `since it does not support automated
+installs anymore <https://artifex.com/news/ghostscript-10.01.0-disabling-silent-install-option>`_.
+
+* `Ghostscript download page <https://ghostscript.com/releases/gsdnld.html>`_.`
 
 (Or alternately, using the `Chocolatey <https://chocolatey.org/>`_ package manager, install
 the following when running in an Administrator command prompt):
 
 * ``choco install python3``
 * ``choco install --pre tesseract``
-* ``choco install ghostscript``
 * ``choco install pngquant`` (optional)
 
 Either set of commands will install the required software. At the mmoment there is no
diff --git a/docs/release_notes.rst b/docs/release_notes.rst
index 992136214..b9a8d295d 100644
--- a/docs/release_notes.rst
+++ b/docs/release_notes.rst
@@ -28,6 +28,12 @@ tagged yet.
 
 .. |OCRmyPDF PyPI| image:: https://img.shields.io/pypi/v/ocrmypdf.svg
 
+v15.4.4
+=======
+
+-  Fixed documentation for installing Ghostscript on Windows. :issue:`1198`
+-  Added warning message about security issue in older versions of Ghostscript.
+
 v15.4.3
 =======
 
diff --git a/src/ocrmypdf/builtin_plugins/ghostscript.py b/src/ocrmypdf/builtin_plugins/ghostscript.py
index 38dc6329c..73d6f00d9 100644
--- a/src/ocrmypdf/builtin_plugins/ghostscript.py
+++ b/src/ocrmypdf/builtin_plugins/ghostscript.py
@@ -6,6 +6,8 @@
 
 import logging
 
+from packaging.version import Version
+
 from ocrmypdf import hookimpl
 from ocrmypdf._exec import ghostscript
 from ocrmypdf.exceptions import MissingDependencyError
@@ -58,8 +60,15 @@ def check_options(options):
     if gs_version in BLACKLISTED_GS_VERSIONS:
         raise MissingDependencyError(
             f"Ghostscript {gs_version} contains serious regressions and is not "
-            "supported. Please upgrade to a newer version, or downgrade to the "
-            "previous version."
+            "supported. Please upgrade to a newer version."
+        )
+    if gs_version < Version('10.02.0'):
+        log.warning(
+            f"The installed version of Ghostscript {gs_version}, contains a remote "
+            "code execution security vulnerability. Please upgrade to a newer "
+            "version. For details see CVE-2023-43115. The issue is not known to "
+            "affect OCRmyPDF or processing PDFs with Ghostscript, but upgrading "
+            "Ghostscript is recommended."
         )
 
     if options.output_type == 'pdfa':