mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-25 07:36:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-pip: Fix CVE-2026-8643

Browse Source 
Apply the primary upstream fix referenced in [4] with commit [1]. Then
apply the two follow-up regression-fix commits [2] and [3].

The primary fix rejects entry-point names that escape the configured
scripts directory. The follow-up fixes handle doubled-slash roots and
reuse the existing directory-containment helper.

[1] 8eb178480b
[2] 7ff8bdd81e
[3] fa7854f6b3
[4] https://github.com/advisories/GHSA-wf93-45jw-7689

(From OE-Core rev: 2c276677d619bc6205872eb2b5a9948a4605d8ea)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hetvi Thakar
2026-08-16 21:44:29 -07:00
committed by Paul Barker
parent 97fdca2021
commit b24d56a0b3
4 changed files with 185 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
meta/recipes-devtools/python/python3-pip_24.0.bb
View File

@@ -33,6 +33,9 @@ inherit pypi python_setuptools_build_meta
SRC_URI += "file://no_shebang_mangling.patch \
file://CVE-2026-1703.patch \
file://CVE-2026-8643.patch \
file://CVE-2026-8643-regression_p1.patch \
file://CVE-2026-8643-regression_p2.patch \
"
SRC_URI[sha256sum] = "ea9bd1a847e8c5774a5777bb398c19e80bcd4e2aa16a4b301b718fe6f593aba2"