mirror of
https://git.yoctoproject.org/poky
synced 2026-02-11 03:03:02 +01:00
python3: fix CVE-2025-6075
If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment variables.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-6075
Upstream-patch:
892747b4cf
(From OE-Core rev: 9a7f33d85355ffbe382aa175c04c64541e77b441)
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
committed by
Steve Sakoman
parent
6639c7b295
commit
c6234dce63
@@ -37,6 +37,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
|
||||
file://0001-Avoid-shebang-overflow-on-python-config.py.patch \
|
||||
file://0001-test_storlines-skip-due-to-load-variability.patch \
|
||||
file://0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch \
|
||||
file://CVE-2025-6075.patch \
|
||||
"
|
||||
|
||||
SRC_URI:append:class-native = " \
|
||||
|
||||
Reference in New Issue
Block a user