From: Hetvi Thakar <[email protected]> PLY 3.11 contains the picklefile parameter described by CVE-2025-56005, but exploitation requires an application to explicitly pass an attacker-controlled pickle file to yacc().
No OE-Core consumer uses this parameter. Ubuntu ignores the issue for the same reason [1], and NVD records the CVE as disputed [2]. [1] https://ubuntu.com/security/CVE-2025-56005 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005 Signed-off-by: Hetvi Thakar <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- meta/recipes-devtools/python/python3-ply_3.11.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb index 0855c871cf6..5bed977158b 100644 --- a/meta/recipes-devtools/python/python3-ply_3.11.bb +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\ " CVE_PRODUCT = "dabeaz:ply" +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-specific use of PLY's picklefile parameter with attacker-controlled pickle data" BBCLASSEXTEND = "native nativesdk"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246467): https://lists.openembedded.org/g/openembedded-core/message/246467 Mute This Topic: https://lists.openembedded.org/mt/121389736/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
