On Thu Sep 3, 2026 at 7:19 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Hetvi Thakar <[email protected]> > > PLY 3.11 contains the picklefile parameter described by > CVE-2025-56005, but exploitation requires an application to > explicitly pass an attacker-controlled pickle file to yacc(). > > No OE-Core consumer uses this parameter. Ubuntu ignores the issue for > the same reason [1], and NVD records the CVE as disputed [2]. > > [1] https://ubuntu.com/security/CVE-2025-56005 > [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005 > > Signed-off-by: Hetvi Thakar <[email protected]> > --- > meta/recipes-devtools/python/python3-ply_3.11.bb | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb > b/meta/recipes-devtools/python/python3-ply_3.11.bb > index 0855c871cf..5bed977158 100644 > --- a/meta/recipes-devtools/python/python3-ply_3.11.bb > +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb > @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\ > " > > CVE_PRODUCT = "dabeaz:ply" > +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires > application-specific use of PLY's picklefile parameter with > attacker-controlled pickle data" > > BBCLASSEXTEND = "native nativesdk"
Hello, As fas as I can tell, this patch is also needed on wrynose. I can't merge here until this is fixed there. Can you send a patch to fix this on this branch and then, ping back here? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245625): https://lists.openembedded.org/g/openembedded-core/message/245625 Mute This Topic: https://lists.openembedded.org/mt/121064824/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
