diff mbox series

[meta-python,wrynose,16/18] python3-virtualenv: Ignore CVE-2026-102937

Message ID 20261105090007.351866-17-hthakar@cisco.com
State New
Headers show
Series python3-virtualenv: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 9 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- The advisory [1] describes command injection when Windows cmd.exe
  executes a generated activate.bat file.
- BatchActivator.supports() rejects Linux interpreters, so the Linux
  CLI does not select this activator.
- Limit the status to Linux TARGET_OS values. Leave other platforms,
  including MinGW SDK builds, unexcluded.
- The upstream fix is [2]; no backport is needed for Linux activation.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q
[2] https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../recipes-devtools/python/python3-virtualenv_21.2.1.bb       | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
index adeff3939a..1a8091adcc 100644
--- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
+++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
@@ -52,3 +52,6 @@  RDEPENDS:${PN} += " \
 "
 
 CVE_PRODUCT = "virtualenv"
+
+# The batch activator only supports Windows interpreters.
+CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}"