| Message ID | 20260907082127.471223-1-hthakar@cisco.com |
|---|---|
| State | New |
| Headers | show |
| Series | [scarthgap] python3-pip: set status for CVE-2018-20225 | expand |
On Mon Sep 7, 2026 at 10:21 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Hetvi Thakar <hthakar@cisco.com> > > CVE-2018-20225 describes pip selecting the highest-version candidate > across configured package indexes. Exploitation requires use of > --extra-index-url with a private package absent from the public index, > allowing an attacker to publish that package with an arbitrary version. > > Commit [1] documents the dependency-confusion risk and recommends using > --index-url for private packages. It does not change pip's candidate- > selection behavior. This change records the CVE as disputed. > > [1] https://github.com/pypa/pip/commit/fe2721893636aa15ef04d02e9beb52f7fe9a0d27 > [2] https://nvd.nist.gov/vuln/detail/CVE-2018-20225 > > Signed-off-by: Hetvi Thakar <hthakar@cisco.com> > --- > meta/recipes-devtools/python/python3-pip_24.0.bb | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb > index 1b6281c81f..7107b1c8df 100644 > --- a/meta/recipes-devtools/python/python3-pip_24.0.bb > +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb > @@ -43,6 +43,7 @@ do_install:append() { > } > > CVE_PRODUCT = "pypa:pip" > +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes" > > do_install:append(){ > # pip vendors distlib which ships Windows launcher templates (*.exe). Hello, You sent this patch for both wrynose and scarthgap: * [OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225 https://lore.kernel.org/openembedded-core/20260907082127.471223-1-hthakar@cisco.com/T/#u * [OE-core][wrynose][PATCH] python3-pip: set CVE_STATUS for CVE-2018-20225 https://lore.kernel.org/openembedded-core/20260907082218.2177656-1-hthakar@cisco.com/T/#u ... but these are not similar: title and commit message changed (diff content looks similar). During reviews, I often get identical patches between wrynose and scarthgap and I can, then, review both at the same time which helps me decrease the patch queue length. If you modify patches between wrynose and scarthgap (apart from normal backporting modification), then, I have to review both separately. So, this is not a strict rule but it would help me if the wrynose/scarthgap patches were as similar as possible. Also, the fact that the work was done twice *differently* looks like agentic/LLM output (I think a human would copy-paste, at least). If that's the case, remember that you have to mark it as such. Thanks & regards,
diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb index 1b6281c81f..7107b1c8df 100644 --- a/meta/recipes-devtools/python/python3-pip_24.0.bb +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb @@ -43,6 +43,7 @@ do_install:append() { } CVE_PRODUCT = "pypa:pip" +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes" do_install:append(){ # pip vendors distlib which ships Windows launcher templates (*.exe).