On Mon Aug 31, 2026 at 11:22 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > On Mon, Aug 31, 2026 at 02:42 PM, Yoann Congal wrote: > >> >> On Wed Aug 19, 2026 at 1:15 PM CEST, Hetvi Thakar -X (hthakar - E >> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: >> >>> From: Hetvi Thakar <[email protected]> >>> >>> This patch applies the upstream fix as referenced in [2], using >>> the commit shown in [1]. >>> >>> The backport makes Template URI normalization strip all leading >>> slashes, preventing a double-slash URI from bypassing the path >>> traversal check while keeping Mako at version 1.3.2. >>> >>> [1] >>> https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3 >>> >>> [2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm >>> >>> Signed-off-by: Hetvi Thakar <[email protected]> >>> --- >>> .../python/python3-mako/CVE-2026-41205.patch | 110 ++++++++++++++++++ >>> .../python/python3-mako_1.3.2.bb | 2 + >>> 2 files changed, 112 insertions(+) >>> create mode 100644 >>> meta/recipes-devtools/python/python3-mako/CVE-2026-41205.patch >> >> Hello, >> >> As fas as I can tell, a fix for this CVE is also needed on wrynose. >> >> I can't merge here until this is fixed there. >> >> Can you send a patch to fix this and then, ping back here? >> >> Thanks! >> -- >> Yoann Congal >> Smile ECS > > Hi, > > I have submitted a package upgrade for wrynose that addresses this > CVE: > > https://lists.openembedded.org/g/openembedded-core/message/244285 ( > https://lists.openembedded.org/g/openembedded-core/message/244285 ) > > Could you please take a look and review it? > > Regards, > Hetvi
Thanks for the quick answer. I will review both but not in the current cycle. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244759): https://lists.openembedded.org/g/openembedded-core/message/244759 Mute This Topic: https://lists.openembedded.org/mt/120827665/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
