mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-14 04:33:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

python3: ignore CVE-2015-20107

Browse Source 
CVE-2015-20107 describes an arbitrary command execution in the mailcap
module, but this is by design in mailcap and needs to be worked around
by the calling application.

Upstream Python will be documenting this flaw in the library reference,
and it is likely that the mailcap module will be deprecated and removed
in the future.

(From OE-Core rev: 1ed7bb74d35f08af3babf73c68ee01af5f28a50b)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 85fac8408baf92d8b71946f5bfea92952b7eab01)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ross Burton
2022-04-25 12:24:44 +01:00
committed by Richard Purdie
parent 64f632c93f
commit 4dfdb53c8a
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
meta/recipes-devtools/python/python3_3.8.13.bb
View File

@@ -57,6 +57,9 @@ CVE_CHECK_WHITELIST += "CVE-2019-18348"
# This is windows only issue.
CVE_CHECK_WHITELIST += "CVE-2020-15523 CVE-2022-26488"
# The mailcap module is insecure by design, so this can't be fixed in a meaningful way.
# The module will be removed in the future and flaws documented.
CVE_CHECK_WHITELIST += "CVE-2015-20107"
PYTHON_MAJMIN = "3.8"