On Sat Sep 12, 2026 at 4:37 PM CEST, Peter Marko wrote: > > >> -----Original Message----- >> From: [email protected] <openembedded- >> [email protected]> On Behalf Of Yoann Congal via >> lists.openembedded.org >> Sent: Friday, September 11, 2026 11:03 AM >> To: [email protected]; [email protected] >> Cc: [email protected] >> Subject: Re: [OE-core][scarthgap][PATCH] python3-ply: set status for >> CVE-2025- >> 56005 >> >> On Thu Sep 3, 2026 at 7:19 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS >> PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: >> > From: Hetvi Thakar <[email protected]> >> > >> > PLY 3.11 contains the picklefile parameter described by >> > CVE-2025-56005, but exploitation requires an application to >> > explicitly pass an attacker-controlled pickle file to yacc(). >> > >> > No OE-Core consumer uses this parameter. Ubuntu ignores the issue for >> > the same reason [1], and NVD records the CVE as disputed [2]. >> > >> > [1] https://ubuntu.com/security/CVE-2025-56005 >> > [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005 >> > >> > Signed-off-by: Hetvi Thakar <[email protected]> >> > --- >> > meta/recipes-devtools/python/python3-ply_3.11.bb | 1 + >> > 1 file changed, 1 insertion(+) >> > >> > diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb >> > b/meta/recipes- >> devtools/python/python3-ply_3.11.bb >> > index 0855c871cf..5bed977158 100644 >> > --- a/meta/recipes-devtools/python/python3-ply_3.11.bb >> > +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb >> > @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\ >> > " >> > >> > CVE_PRODUCT = "dabeaz:ply" >> > +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application- >> specific use of PLY's picklefile parameter with attacker-controlled pickle >> data" >> > >> > BBCLASSEXTEND = "native nativesdk" >> >> Hello, >> >> As fas as I can tell, this patch is also needed on wrynose. >> I can't merge here until this is fixed there. >> >> Can you send a patch to fix this on this branch and then, ping back >> here? > > Hello Yoann, > > In wrynose this will be fixed by update of sbom-cve-check tooling. > > Peter
Right, thanks Peter! > >> >> Thanks! >> -- >> Yoann Congal >> Smile ECS -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246340): https://lists.openembedded.org/g/openembedded-core/message/246340 Mute This Topic: https://lists.openembedded.org/mt/121064824/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
