Details: https://nvd.nist.gov/vuln/detail/CVE-2009-0127
The vulnerability is disputed[1] by upstream: "There is no vulnerability in M2Crypto. Nowhere in the functions are the return values of OpenSSL functions interpreted incorrectly. The functions provide an interface to their users that may be considered confusing, but is not incorrect, nor it is a vulnerability." [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0127 Signed-off-by: Gyorgy Sarvari <[email protected]> Signed-off-by: Khem Raj <[email protected]> (cherry picked from commit b46a5452a1c1a417f2971e494e151fa1f4022e36) Signed-off-by: Gyorgy Sarvari <[email protected]> --- meta-python/recipes-devtools/python/python3-m2crypto_0.40.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-m2crypto_0.40.1.bb b/meta-python/recipes-devtools/python/python3-m2crypto_0.40.1.bb index 1d8c22d196..95c57d5d48 100644 --- a/meta-python/recipes-devtools/python/python3-m2crypto_0.40.1.bb +++ b/meta-python/recipes-devtools/python/python3-m2crypto_0.40.1.bb @@ -16,6 +16,8 @@ SRC_URI[sha256sum] = "bbfd113ec55708c05816252a4f09e4237df4f3bbfc8171cbbc33057d25 PYPI_PACKAGE = "M2Crypto" inherit pypi siteinfo setuptools3 +CVE_STATUS[CVE-2009-0127] = "disputed: upstream claims there is no bug" + DEPENDS += "openssl swig-native" RDEPENDS:${PN} += "\ python3-datetime \
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#123792): https://lists.openembedded.org/g/openembedded-devel/message/123792 Mute This Topic: https://lists.openembedded.org/mt/117421629/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
