mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
abef4d0701
This patch applies the complete upstream fix chain for CVE-2026-45409. Commit [1] introduces early domain-length rejection required by [2]. Commit [2] is the v3.14 fix identified by [5], and commit [3] extends the protection to per-label conversions and codec support to complete the v3.15 fix described in [4]. [1] https://github.com/kjd/idna/commit/c0dda4501df5 [2] https://github.com/kjd/idna/commit/628fef84d3ed [3] https://github.com/kjd/idna/commit/e1cb465b6376 [4] https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx [5] https://security-tracker.debian.org/tracker/CVE-2026-45409 (From OE-Core rev: 09773d9d1b44dfe868913b6bb142a728529f62cb) Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
22 lines
646 B
BlitzBasic
22 lines
646 B
BlitzBasic
SUMMARY = "Internationalised Domain Names in Applications"
|
|
HOMEPAGE = "https://github.com/kjd/idna"
|
|
LICENSE = "BSD-3-Clause & Python-2.0 & Unicode-TOU"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.md;md5=204c0612e40a4dd46012a78d02c80fb1"
|
|
|
|
SRC_URI += " \
|
|
file://CVE-2026-45409_p1.patch \
|
|
file://CVE-2026-45409_p2.patch \
|
|
file://CVE-2026-45409_p3.patch \
|
|
"
|
|
SRC_URI[sha256sum] = "028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc"
|
|
|
|
CVE_PRODUCT = "kjd:idna kjd:internationalized_domain_names_in_applications"
|
|
|
|
inherit pypi python_flit_core
|
|
|
|
RDEPENDS:${PN}:class-target = "\
|
|
python3-codecs \
|
|
"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|