On Mon Sep 7, 2026 at 10:21 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Hetvi Thakar <[email protected]> > > CVE-2018-20225 describes pip selecting the highest-version candidate > across configured package indexes. Exploitation requires use of > --extra-index-url with a private package absent from the public index, > allowing an attacker to publish that package with an arbitrary version. > > Commit [1] documents the dependency-confusion risk and recommends using > --index-url for private packages. It does not change pip's candidate- > selection behavior. This change records the CVE as disputed. > > [1] > https://github.com/pypa/pip/commit/fe2721893636aa15ef04d02e9beb52f7fe9a0d27 > [2] https://nvd.nist.gov/vuln/detail/CVE-2018-20225 > > Signed-off-by: Hetvi Thakar <[email protected]> > --- > meta/recipes-devtools/python/python3-pip_24.0.bb | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb > b/meta/recipes-devtools/python/python3-pip_24.0.bb > index 1b6281c81f..7107b1c8df 100644 > --- a/meta/recipes-devtools/python/python3-pip_24.0.bb > +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb > @@ -43,6 +43,7 @@ do_install:append() { > } > > CVE_PRODUCT = "pypa:pip" > +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of > --extra-index-url with a private package not present on the primary public > index; pip intentionally selects the highest version across configured > indexes" > > do_install:append(){ > # pip vendors distlib which ships Windows launcher templates (*.exe).
Hello, You sent this patch for both wrynose and scarthgap: * [OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225 https://lore.kernel.org/openembedded-core/[email protected]/T/#u * [OE-core][wrynose][PATCH] python3-pip: set CVE_STATUS for CVE-2018-20225 https://lore.kernel.org/openembedded-core/[email protected]/T/#u ... but these are not similar: title and commit message changed (diff content looks similar). During reviews, I often get identical patches between wrynose and scarthgap and I can, then, review both at the same time which helps me decrease the patch queue length. If you modify patches between wrynose and scarthgap (apart from normal backporting modification), then, I have to review both separately. So, this is not a strict rule but it would help me if the wrynose/scarthgap patches were as similar as possible. Also, the fact that the work was done twice *differently* looks like agentic/LLM output (I think a human would copy-paste, at least). If that's the case, remember that you have to mark it as such. Thanks & regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245245): https://lists.openembedded.org/g/openembedded-core/message/245245 Mute This Topic: https://lists.openembedded.org/mt/121125671/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
