diff mbox series

[meta-python,blacksail,10/10] python3-oauthlib: patch CVE-2026-49265

Message ID 20261026101850.1470035-10-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,blacksail,1/10] libmspack: patch CVE-2026-110602 | expand

Commit Message

Ankur Tyagi Oct. 26, 2026, 10:18 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49265

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../python3-oauthlib/CVE-2026-49265.patch     | 51 +++++++++++++++++++
 .../python/python3-oauthlib_3.3.1.bb          |  2 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-oauthlib/CVE-2026-49265.patch
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-oauthlib/CVE-2026-49265.patch b/meta-python/recipes-devtools/python/python3-oauthlib/CVE-2026-49265.patch
new file mode 100644
index 0000000000..8cbc368b6c
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-oauthlib/CVE-2026-49265.patch
@@ -0,0 +1,51 @@ 
+From f3510969587daff0de06a233cf6be3a6233b3429 Mon Sep 17 00:00:00 2001
+From: Jonathan Huot <jonathan.huot@gmail.com>
+Date: Sat, 11 Jul 2026 13:15:29 +0200
+Subject: [PATCH] Improve PKCE code comparison
+
+(cherry picked from commit 74664d3fe037a354e180e305135c6bab1747a6b0)
+
+CVE: CVE-2026-49265
+Upstream-Status: Backport [https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0]
+
+Dropped changes to the CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
+index 09dc619..c73314a 100644
+--- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
++++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
+@@ -4,6 +4,7 @@ oauthlib.oauth2.rfc6749.grant_types
+ """
+ import base64
+ import hashlib
++import hmac
+ import json
+ import logging
+ 
+@@ -44,9 +45,10 @@ def code_challenge_method_s256(verifier, challenge):
+ 
+     .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
+     """
+-    return base64.urlsafe_b64encode(
++    expected = base64.urlsafe_b64encode(
+         hashlib.sha256(verifier.encode()).digest()
+-    ).decode().rstrip('=') == challenge
++    ).decode().rstrip('=')
++    return hmac.compare_digest(expected, challenge)
+ 
+ 
+ def code_challenge_method_plain(verifier, challenge):
+@@ -58,7 +60,7 @@ def code_challenge_method_plain(verifier, challenge):
+ 
+     .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
+     """
+-    return verifier == challenge
++    return hmac.compare_digest(verifier, challenge)
+ 
+ 
+ class AuthorizationCodeGrant(GrantTypeBase):
diff --git a/meta-python/recipes-devtools/python/python3-oauthlib_3.3.1.bb b/meta-python/recipes-devtools/python/python3-oauthlib_3.3.1.bb
index bdc1f0e7b4..c375b172c7 100644
--- a/meta-python/recipes-devtools/python/python3-oauthlib_3.3.1.bb
+++ b/meta-python/recipes-devtools/python/python3-oauthlib_3.3.1.bb
@@ -4,6 +4,8 @@  HOMEPAGE = "https://github.com/idan/oauthlib"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=2699a9fb0d71d5eafd75d8d7c302f7df"
 
+SRC_URI += "file://CVE-2026-49265.patch"
+
 SRC_URI[sha256sum] = "0f0f8aa759826a193cf66c12ea1af1637f87b9b4622d46e866952bb022e538c9"
 
 CVE_PRODUCT = "oauthlib"