mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-wheel: fix CVE_PRODUCT

Browse Source 
The proper CVE_PRODUCT is "wheel_project:wheel".

BEFORE: python:wheel -> 1 CVE
AFTER: wheel_project:wheel -> 2 CVEs

* Both are patched at 0.42.0.
  - CVE-2022-40898 — DoS in wheel CLI via malicious input. Affects <0.38.1.
  - CVE-2026-24049 — malicious wheel file can modify permissions of arbitrary
    files. Affects 0.40.0–<0.46.2; covered by the existing
    CVE-2026-24049.patch.

Note: The original commit targeted python3-wheel_0.47.0.bb. This is
adjusted for Scarthgap, where the recipe version is 0.42.0.

AI-Generated: Claude Sonnet 5
(From OE-Core rev: 6125825144dac3f5aea440307e4b6b7e76d5333a)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fe55278e01bbe434452191109278b436bf008ebc)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Tim Orling
2026-08-20 02:07:26 -07:00
committed by Richard Purdie
parent 73e1a3a8a5
commit f65ce1d326
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/recipes-devtools/python/python3-wheel_0.42.0.bb
View File

@@ -8,6 +8,8 @@ SRC_URI[sha256sum] = "c45be39f7882c9d34243236f2d63cbd58039e360f85d0913425fbd7cee
inherit python_flit_core pypi
CVE_PRODUCT = "wheel_project:wheel"
SRC_URI += "file://CVE-2026-24049.patch"
BBCLASSEXTEND = "native nativesdk"