mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-20 12:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
76,365 Commits 38 Branches 627 Tags
77d1feb37e280733684ae8a9449fb031d5d7ff40
Commit Graph

5 Commits

Author SHA1 Message Date
Tim Orling
b13a89f19d python3-git: fix CVE_PRODUCT 
Using the pypi.bbclass default CPE of python:GitPython detects no CVEs.
With CVE_PRODUCT = "gitpython_project:gitpython" we properly detect
9 CVEs, with 4 unpatched.

WARNING: python3-git-3.1.42-r0 do_cve_check:
Found unpatched CVEs: CVE-2026-42215, CVE-2026-42284,
CVE-2026-44243, CVE-2026-44244

Note: The original commit targeted python3-git_3.1.43.bb. This is
adjusted for Scarthgap, where the recipe version is 3.1.42.

(From OE-Core rev: 0c9e81e2b248c15054c8a847f043aea994b8adbe)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3a6af75a33b4e007f0d3a247b6a149e32d51e510)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Darsh Kelaiya
7be1953871 python3-git: fix CVE-2026-44244 
This patch applies the upstream 3.1.49 backport for
CVE-2026-44244. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commits are referenced in [3] and [4].

[1] b049a13105
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44244
[3] c417af469f
[4] 8e24503b42

(From OE-Core rev: 9aaa23d4f6c04049fcdb532f6a83c654e8e6e15d)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Darsh Kelaiya
96afd71237 python3-git: fix CVE-2026-44243 
This patch applies the upstream 3.1.48 backport for
CVE-2026-44243. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commits are referenced in [3] and [4].

[1] dbfa264764
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44243
[3] 25ba54dd3f
[4] 4af8463cca

(From OE-Core rev: 0853d0c72e96a3c4e3a5329589a9aa151e2f2c46)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Darsh Kelaiya
1e39c2a5e3 python3-git: fix CVE-2026-42284 
This patch applies the upstream 3.1.47 backport for
CVE-2026-42284. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] da545232d0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-42284

(From OE-Core rev: 1582c80d83558b9f1e9c3137bd79ec3f0a5c643c)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC:
See https://github.com/gitpython-developers/GitPython/pull/2130#issue-4299717224:
The author links the fix to this advisory/CVE.
]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Trevor Gamblin
7bdf0d4869 python3-git: upgrade 3.1.41 -> 3.1.42 
This release contains bugfixes, documentation updates, and changes to
metadata for build and CI.

Changelog: https://github.com/gitpython-developers/GitPython/releases/tag/3.1.42

(From OE-Core rev: b4dc9793f3196a774b19fbf4342ebcd42655d14e)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2024-02-29 10:26:13 +00:00