mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-20 12:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-idna: Fix CVE-2026-45409

Browse Source 
This patch applies the complete upstream fix chain for
CVE-2026-45409. Commit [1] introduces early domain-length rejection
required by [2]. Commit [2] is the v3.14 fix identified by [5], and
commit [3] extends the protection to per-label conversions and codec
support to complete the v3.15 fix described in [4].

[1] https://github.com/kjd/idna/commit/c0dda4501df5
[2] https://github.com/kjd/idna/commit/628fef84d3ed
[3] https://github.com/kjd/idna/commit/e1cb465b6376
[4] https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
[5] https://security-tracker.debian.org/tracker/CVE-2026-45409

(From OE-Core rev: 09773d9d1b44dfe868913b6bb142a728529f62cb)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hetvi Thakar
2026-08-19 22:56:04 -07:00
committed by Richard Purdie
parent 3ffe50e092
commit abef4d0701
4 changed files with 200 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
meta/recipes-devtools/python/python3-idna_3.7.bb
View File

@@ -3,6 +3,11 @@ HOMEPAGE = "https://github.com/kjd/idna"
LICENSE = "BSD-3-Clause & Python-2.0 & Unicode-TOU"
LIC_FILES_CHKSUM = "file://LICENSE.md;md5=204c0612e40a4dd46012a78d02c80fb1"
SRC_URI += " \
file://CVE-2026-45409_p1.patch \
file://CVE-2026-45409_p2.patch \
file://CVE-2026-45409_p3.patch \
"
SRC_URI[sha256sum] = "028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc"
CVE_PRODUCT = "kjd:idna kjd:internationalized_domain_names_in_applications"