This is a security release of Python 3.12
Release information: [1]
* drop CVE patches included in this release
* refresh all remaining patches via devtool
* remove some tab style in SRC_URI.
* add CVE_STATUS entries for CVEs fixed in this release but still
reported as Unpatched by cve-check (including 2 fixed already in
previous release)
[1] https://www.python.org/downloads/release/python-31214/
(From OE-Core rev: 57549d561886972b733952a4e4077cd8889d12ed)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The BER decoder shared by the CER and DER codecs parses long-form tags by
accumulating continuation octets without an upper bound on the tag ID size.
A crafted input can force construction of an arbitrarily large integer with
CPU cost growing quadratically, and can trigger unhandled ValueError
exceptions in the Python 3.11+ error formatting paths. Any application
decoding untrusted BER, CER, or DER input is affected.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] 628e36ecbb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59884
(From OE-Core rev: 75ff4b187cf1b5e4e874cab8273ea84377b3c873)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The univ.Real type converts its mantissa, base, and exponent to a Python
float using exact big-integer exponentiation. A BER, CER, or DER encoded
REAL value only a few bytes long can carry a very large exponent, causing
float conversion through prettyPrint(), str(), comparison, arithmetic,
int(), or an explicit float() call to consume excessive CPU and memory and
hang applications that decode untrusted ASN.1 data and then print, log, or
compare the decoded objects.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] e60c691cb9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59886
(From OE-Core rev: 24991f7383dbe229a696ad209ae7d58115a051a1)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
NVD uses westes:flex for recent CVEs in flex, based on the GitHub repo
(From OE-Core rev: 4979619b4aaa8c4b462fae30027b335253b61b24)
Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8bb6aa4b4acb16c59b66aa55b33053e3e8749e72)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
CVE_PRODUCT is not set for python3-pip, so cve-check can miss or
misreport pip CVEs. CVE-2026-8643 is reported in NVD with pypa:pip.
Add CVE_PRODUCT to match the NVD product name and report this CVE
correctly.
(From OE-Core rev: 3a24c9f77622148c3894c9228e061cabf79f169f)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a486abd4889ad03e1a8ddd5311595f3ece7d61b6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in
Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree).
An attacker can craft XML input that forces O(n²) hash collisions in
libexpat's internal name dictionary, causing excessive CPU consumption.
The previous mitigation seeded libexpat's hash function with only 4
bytes of entropy, which is insufficient against a determined attacker.
This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0),
providing a full 16-byte secret. Older expat versions fall back
gracefully to the legacy XML_SetHashSalt via a runtime NULL check.
Backport patch to fix CVE-2026-7210.
https://nvd.nist.gov/vuln/detail/CVE-2026-7210
Upstream fix:
24b8f12544
-- Changes from Upstream --
Replace compile-time version checks with runtime detection of the
XML_SetHashSalt16Bytes function using #pragma weak. This allows using
backported security fixes from expat even when version macros haven't
been bumped (in thus case expat 2.6.4 with CVE-2026-41080).
- Add weak symbol declaration for XML_SetHashSalt16Bytes
- Convert newxmlparseobject() version check to runtime NULL check
- Convert pyexpat_exec() CAPI export check to runtime NULL check
Tested with ptest:
Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882
After: PASSED: 40020, FAILED: 0, SKIPPED: 1882
CVE: CVE-2026-7210
(From OE-Core rev: d753c46085c9d31f3b68d59f863855c909a6f400)
Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The pypi class default python:pyyaml vendor prefix matches nothing,
so PyYAML CVEs are not evaluated at all. The databases use two
vendor spellings: pyyaml in the NVD CPEs, and "Red Hat" (with a
space, not expressible as a vendor:product pair) in CVE-2020-1747's
CNA record. Use the bare product name to cover both.
All four existing CVEs (CVE-2017-18342, CVE-2019-20477,
CVE-2020-1747, CVE-2020-14343) are fixed by 5.4, so they resolve as
not affected at 6.0.1.
Note: Original commit was for python3-pyyaml_6.0.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyyaml_6.0.1.bb.
(From OE-Core rev: 666e25c1fe1347da307726afd87554ffc080ed12)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 89a0ba3c2da2a7755bafb28afbf75dc7112e2549)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The CVE databases track xmltodict as xmltodict:xmltodict, so the
default python:xmltodict vendor prefix never matches and its CVEs
are not evaluated at all. Use the exact vendor:product pair.
Note: Original commit was for python3-xmltodict_1.0.4.bb. This is
adjusted for scarthgap where recipe version is python3-xmltodict_0.13.0.bb.
(From OE-Core rev: 918d1fd448ff96431197031e5adb1be658156bc2)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2229426b729adf85780c23d38c85fc3cf090f6ba)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD tracks certifi as certifi:certifi, so the default python:certifi
vendor prefix never matches and its CVEs are not evaluated at all.
Use the exact vendor:product pair.
For scarthgap, python3-certifi is 2024.2.2. CVE-2024-39689 affects
certifi versions before 2024.7.4, but this recipe already carries
CVE-2024-39689.patch. With this mapping, cve-check can evaluate that
existing backport against the correct NVD product instead of missing
the CVE mapping.
Note: Original commit was for python3-certifi_2026.2.25.bb. This is
adjusted for scarthgap where recipe version is
python3-certifi_2024.2.2.bb.
(From OE-Core rev: e6773f4c819544eae93f3efa7d2101b448db4ebb)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 26c49743ec431a3cc39803664eec8851be75756e)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The pypi class default python:idna matches nothing in the CVE
databases, which track the Python idna CVEs as:
* CVE-2024-3651 (kjd:internationalized_domain_names_in_applications) [1]
* CVE-2026-45409 (kjd:idna in the CNA record, same NVD CPE as above)
Set both vendor:product pairs.
For scarthgap, python3-idna is 3.7. CVE-2026-45409 affects idna
versions before 3.15, so this metadata change will expose that CVE as
applicable/unpatched. The fix for CVE-2026-45409 needs to be handled
separately.
The bare product name is not an option here: it would also match
"servo:idna", the Rust idna crate (e.g. CVE-2024-12224).
Note: Original commit was for python3-idna_3.11.bb. This is adjusted
for scarthgap where recipe version is python3-idna_3.7.bb.
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-3651
(From OE-Core rev: 70a1b17edf909715065c1d727f989fc07f8db8bf)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48428c0fe22d8ecbfa53efffb28173d4d37539e6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The pypi class default python:pyopenssl matches nothing in the CVE
databases, which have used four vendor spellings for pyOpenSSL over
the years:
* CVE-2013-4314 (jean-paul_calderone:pyopenssl)
* CVE-2018-1000807 (pyopenssl:pyopenssl)
* CVE-2018-1000808 (pyopenssl_project:pyopenssl)
* CVE-2026-27448, CVE-2026-27459 (pyca:pyopenssl in the CNA records,
pyopenssl:pyopenssl in the NVD CPEs)
Set all four vendor:product pairs.
For scarthgap, python3-pyopenssl is 24.0.0. CVE-2026-27448 and
CVE-2026-27459 are fixed in 26.0.0, so this metadata change will
expose those CVEs as applicable/unpatched. The fixes for these CVEs
need to be handled separately.
Note: Original commit was for python3-pyopenssl_26.0.0.bb. This is
adjusted for scarthgap where recipe version is
python3-pyopenssl_24.0.0.bb.
(From OE-Core rev: f6cc7e0c0a4a906244fc8cd4b45706d42a931fce)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ba3d752e577004f871fe7f4235e2625410140a08)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The default python:pyasn1 does not match the NVD/CNA entries which use
pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use
the exact pyasn1:pyasn1 pair.
Note: Original commit was for python3-pyasn1_0.6.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyasn1_0.5.1.bb.
Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: 4c2a8f74464cf3b7143bd9e978eef976aea6315e)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4971337840e8855740409e8f5dadb3ab3661f033)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD registers ply as dabeaz:ply, so the default python:ply vendor
prefix never matches and no CVEs are reported. Use the exact
vendor:product pair.
CVE-2025-56005 will then show as unpatched; no fixed release exists.
Suggested-by: Paul Barker <paul@pbarker.dev>
(From OE-Core rev: 069cda2549b0dd841914c5b860f138f6db8b3977)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb80fef9a76649fb1144408fbc7e2903439cd556)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD lists it as cryptography.io:cryptography and CNA lists it as
pyca:cryptography, so set both vendor:product pairs to match correctly
and precisely.
Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: f4029c635ce3dc1470352d3d3381d9fef19426ed)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b721019e0b2ccbaa8de267e14b282c48a5a3de8b)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Bugzilla bug 33641 (assigned CVE-2025-69648) has been resolved as a
duplicate of bug 33638 (assigned CVE-2025-69646):
https://sourceware.org/bugzilla/show_bug.cgi?id=33641
The existing patch already fixes the issue associated with both CVEs.
Update the "CVE:" tag to reference both identifiers.
(From OE-Core rev: b6cffcce711a1285ffba7f39e7acf5861fda6486)
Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
xmlto was previously hosted on Fedora's pagure.io server, but this is
being decomissioned. As xmlto isn't Fedora-specific the repository has
migrated to codeberg.org.
>From discussion with Michal Schorm <mschorm@redhat.com>:
I became the new maintainer of the project upstream and after a
discussion with Kevin Fenzi, migrated it to a new home on the
codeberg.org: https://codeberg.org/xmlto/xmlto
(From OE-Core rev: 514e5212a304f879ca73b0008baea56e9626d0e5)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0046c780bf612aa7946023f8993c45f0c0b65c08)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
bz2.BZ2Decompressor objects could be reused after a decompression error.
If an application caught the resulting OSError and retried with the same
decompressor, crafted input could cause the decompressor to resume from an
invalid internal state and perform out-of-bounds writes to a stack buffer.
This could crash the process when processing untrusted data.
This CVE has a CVSS 4.0 score of 8.2. The patch (5755d0f08394) is
referenced in the CVEList database.
(From OE-Core rev: 226831c16d13133e89d3405b5e2298bb6571bed6)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When using the "tarfile" module with a file opened in "streaming mode"
(mode="r|") the tarfile module did not properly handle EOF, making archive
parsing take exponentially longer.
(From OE-Core rev: 9c066bcd634e7b938a10c64ef1eaf322a99ec434)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bbd9c82298880ab61b9befea97dfe8a0a4943836)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed
by a crafted archive where a hardlink references a symlink stored at a
deeper name than the hardlink itself.
(From OE-Core rev: a76513212f1830fbda2dc6a243943a3c1a011239)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Makes the exclusion list a bit more readable, avoiding very long sed
expression lines.
[Kris Gavvala]:
this commit was modified to fit scarthgap. the original commit expects
to skip test_timerfd_TFD_TIMER_ABSTIME, test_date_locale2 and test_null_dlsym.
These tests were not being skipped on scarthgap so were removed from the
backport.
(From OE-Core rev: 649b6848ccd4aa3842b2b42b03058511e4f07ce3)
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
(cherry picked from commit d9a44e7390d7c8f2c2b73572825a6f8ceeb729ac)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Binutils objdump contains a denial-of-service vulnerability when processing
a crafted binary with malformed DWARF debug information. A logic error in
the handling of DWARF compilation units can result in an invalid offset_size
value being used inside byte_get_little_endian, leading to an abort (SIGABRT).
A local attacker can trigger the crash by supplying a malicious input file.
(From OE-Core rev: ca101b2ff0b91630df25ee619c809e0621d41b21)
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
[YC: The patch is referenced on the NVD page:
https://nvd.nist.gov/vuln/detail/CVE-2025-69645 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
CVE-2025-69649:
Null pointer dereference in readelf before 2.46 results in segfault when
processing a crafted ELF binary with malformed header fields.
No evidence of memory corruption beyond the null pointer dereference, nor
any possibility of code execution, was observed.
CVE-2025-69652:
Null pointer dereference in readelf when processing a crafted ELF binary
with malformed DWARF abbrev or debug information which leads to SIGABORT.
No evidence of memory corruption or code execution was observed; the impact
is limited to denial of service.
(From OE-Core rev: 86dd1306e350c4cd3b36a39254d6f17587960a60)
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
[YC: patches are referenced in the NVD database:
https://nvd.nist.gov/vuln/detail/CVE-2025-69649https://nvd.nist.gov/vuln/detail/CVE-2025-69652 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This patch applies the upstream v10.0.9 stable backport for
CVE-2026-2243. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] 37ff880a12
[2] https://access.redhat.com/security/cve/CVE-2026-2243
(From OE-Core rev: 9d20ff0a25cf9822c1164baaf0a319985c5cc88f)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This patch applies the upstream v10.0.8 stable backport for
CVE-2026-0665. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] 4ba877461e
[2] https://access.redhat.com/security/cve/CVE-2026-0665
(From OE-Core rev: c66315d7276db8f65794cf514689301b027b13eb)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This patch applies the upstream v10.0.8 stable backport for
CVE-2025-14876. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] e649201bb9
[2] https://access.redhat.com/security/cve/CVE-2025-14876
(From OE-Core rev: 2e1f2bbf21f332dd34cff915e06a8545bc974cca)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The vulnerability is Windows-specific and depends on command-line
handling through CreateProcess, which does not apply to Linux/Yocto
builds.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-3566
(From OE-Core rev: 8c56e85dd02063da5630c9b73fb242686a970e20)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
