diff mbox series

[wrynose,meta-python,3/4] python3-h11: set CVE_PRODUCT

Message ID 20260724010746.2638347-3-anuj.mittal@oss.qualcomm.com
State Under Review
Delegated to: Anuj Mittal
Headers show
Series [wrynose,meta-oe,1/4] ltrace: fix PRIb64 length modifier on LP64 musl | expand

Commit Message

Anuj Mittal July 24, 2026, 1:07 a.m. UTC 
From: mark.yang <mark.yang@lge.com>

The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.

CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.

[1] https://www.cve.org/CVERecord?id=CVE-2025-43859

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bdfe740e89cf8afd41e6348e31a07211)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 meta-python/recipes-devtools/python/python3-h11_0.16.0.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb b/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb
index a47e6ab61e..ed1702ff54 100644
--- a/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb
+++ b/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb
@@ -7,4 +7,6 @@  inherit pypi setuptools3
 
 SRC_URI[sha256sum] = "4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1"
 
+CVE_PRODUCT = "python-hyper:h11"
+
 RDEPENDS:${PN} += "python3-profile"