From: "mark.yang" <[email protected]> The pypi class default python:pyopenssl matches nothing in the CVE databases, which have used four vendor spellings for pyOpenSSL over the years:
* CVE-2013-4314 (jean-paul_calderone:pyopenssl) * CVE-2018-1000807 (pyopenssl:pyopenssl) * CVE-2018-1000808 (pyopenssl_project:pyopenssl) * CVE-2026-27448, CVE-2026-27459 (pyca:pyopenssl in the CNA records, pyopenssl:pyopenssl in the NVD CPEs) Set all four vendor:product pairs. For scarthgap, python3-pyopenssl is 24.0.0. CVE-2026-27448 and CVE-2026-27459 are fixed in 26.0.0, so this metadata change will expose those CVEs as applicable/unpatched. The fixes for these CVEs need to be handled separately. Note: Original commit was for python3-pyopenssl_26.0.0.bb. This is adjusted for scarthgap where recipe version is python3-pyopenssl_24.0.0.bb. Signed-off-by: mark.yang <[email protected]> Signed-off-by: Richard Purdie <[email protected]> (cherry picked from commit ba3d752e577004f871fe7f4235e2625410140a08) Signed-off-by: Himanshu Jadon <[email protected]> --- meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb b/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb index 94a70aa17d..ab00730b57 100644 --- a/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb +++ b/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb @@ -8,6 +8,7 @@ DEPENDS += "openssl python3-cryptography" SRC_URI[sha256sum] = "6aa33039a93fffa4563e655b61d11364d01264be8ccb49906101e02a334530bf" PYPI_PACKAGE = "pyOpenSSL" +CVE_PRODUCT = "jean-paul_calderone:pyopenssl pyca:pyopenssl pyopenssl:pyopenssl pyopenssl_project:pyopenssl" inherit pypi setuptools3 SRC_URI += " \ -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242259): https://lists.openembedded.org/g/openembedded-core/message/242259 Mute This Topic: https://lists.openembedded.org/mt/120499955/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
