mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-10 14:02:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-pip: fix CVE-2023-5752

Browse Source 
When installing a package from a Mercurial VCS URL (ie "pip install
hg+...") with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the "hg clone" call
(ie "--config"). Controlling the Mercurial configuration can modify how
and which repository is installed. This vulnerability does not affect
users who aren't installing from Mercurial.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-5752

Upstream patches:
389cb799d0

(From OE-Core rev: 862c0338fba06077a26c775b49f993eac63762c9)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Jiaying Song
2024-11-25 15:46:11 +08:00
committed by Steve Sakoman
parent 4ec499266e
commit 53801adf75
2 changed files with 39 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
meta/recipes-devtools/python/python3-pip_22.0.3.bb
View File

@@ -34,9 +34,11 @@ LIC_FILES_CHKSUM = "\
inherit pypi python_setuptools_build_meta
SRC_URI += "file://0001-change-shebang-to-python3.patch"
SRC_URI += "file://no_shebang_mangling.patch"
SRC_URI += "file://reproducible.patch"
SRC_URI += "file://0001-change-shebang-to-python3.patch \
file://no_shebang_mangling.patch \
file://reproducible.patch \
file://CVE-2023-5752.patch \
"
SRC_URI[sha256sum] = "f29d589df8c8ab99c060e68ad294c4a9ed896624f6368c5349d70aa581b333d0"