From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
[1] https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-0864 Signed-off-by: Darsh Kelaiya <[email protected]> --- .../python/python3/CVE-2026-0864.patch | 72 +++++++++++++++++++ .../python/python3_3.12.13.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-0864.patch diff --git a/meta/recipes-devtools/python/python3/CVE-2026-0864.patch b/meta/recipes-devtools/python/python3/CVE-2026-0864.patch new file mode 100644 index 0000000000..e39177bdcb --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2026-0864.patch @@ -0,0 +1,72 @@ +From 1426c0d9d57a1ed19f95de0d461903e7cd6f6f64 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <[email protected]> +Date: Tue, 4 Aug 2026 11:27:20 +0200 +Subject: [PATCH] [3.12] gh-143927: Normalize all line endings (CR, CRLF, and + LF) in configparser (GH-143929) (#152005) + +gh-143927: Normalize all line endings (CR, CRLF, and LF) in configparser (GH-143929) + +CVE: CVE-2026-0864 +Upstream-Status: Backport [https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6] + +(cherry picked from commit 5858e42c539dac8394636a6e9b30472b8994851f) + +Co-authored-by: Seth Larson <[email protected]> +(cherry picked from commit db4a157c790479710a1a840d7937c5c815a6f8b6) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + Lib/configparser.py | 4 +++- + Lib/test/test_configparser.py | 11 +++++++++++ + .../2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst | 2 ++ + 3 files changed, 16 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst + +diff --git a/Lib/configparser.py b/Lib/configparser.py +index f96704eb455..8ae35a0a189 100644 +--- a/Lib/configparser.py ++++ b/Lib/configparser.py +@@ -907,7 +907,9 @@ class RawConfigParser(MutableMapping): + value = self._interpolation.before_write(self, section_name, key, + value) + if value is not None or not self._allow_no_value: +- value = delimiter + str(value).replace('\n', '\n\t') ++ # Convert all possible line-endings into '\n\t' ++ value = (delimiter + str(value).replace('\r\n', '\n') ++ .replace('\r', '\n').replace('\n', '\n\t')) + else: + value = "" + fp.write("{}{}\n".format(key, value)) +diff --git a/Lib/test/test_configparser.py b/Lib/test/test_configparser.py +index b7e68d7a3e7..389aa15e670 100644 +--- a/Lib/test/test_configparser.py ++++ b/Lib/test/test_configparser.py +@@ -527,6 +527,17 @@ boolean {0[0]} NO + cf.get(self.default_section, "Foo"), "Bar", + "could not locate option, expecting case-insensitive defaults") + ++ def test_crlf_normalization(self): ++ cf = self.newconfig({"key1": "a\nb","key2": "a\rb", "key3": "a\r\nb", "key4": "a\r\nb"}) ++ buf = io.StringIO() ++ cf.write(buf) ++ cf_str = buf.getvalue() ++ self.assertNotIn("\r", cf_str) ++ self.assertNotIn("\r\n", cf_str) ++ self.assertEqual(cf_str.count("\n"), 10) ++ self.assertEqual(cf_str.count("\n\t"), 4) ++ self.assertTrue(cf_str.endswith("\n\n")) ++ + def test_parse_errors(self): + cf = self.newconfig() + self.parse_error(cf, configparser.ParsingError, +diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst +new file mode 100644 +index 00000000000..ca554997e5c +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst +@@ -0,0 +1,2 @@ ++Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing ++multi-line configparser values. +-- +2.44.4 + diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb index b6ceb0c634..752e2b888f 100644 --- a/meta/recipes-devtools/python/python3_3.12.13.bb +++ b/meta/recipes-devtools/python/python3_3.12.13.bb @@ -48,6 +48,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://CVE-2026-11972.patch \ file://CVE-2026-9669.patch \ file://CVE-2026-7210.patch \ + file://CVE-2026-0864.patch \ " SRC_URI:append:class-native = " \ -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244284): https://lists.openembedded.org/g/openembedded-core/message/244284 Mute This Topic: https://lists.openembedded.org/mt/120932906/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
