diff mbox series

[meta-python,wrynose,17/18] python3-virtualenv: Ignore CVE-2026-113718

Message ID 20261105090007.351866-18-hthakar@cisco.com
State New
Headers show
Series python3-virtualenv: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 9 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- The advisory [1] limits this issue to Xonsh activation in versions
  21.3.0 through 21.14.8.
- Version 21.2.1 has no Xonsh activator, activate.xsh template or
  registered entry point. None of the existing backports adds them.
- The upstream fix [2] changes the absent Xonsh quoting code, so it
  is not applicable to this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
[2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
index 1a8091adcc..b554c3a4f8 100644
--- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
+++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
@@ -55,3 +55,4 @@  CVE_PRODUCT = "virtualenv"
 
 # The batch activator only supports Windows interpreters.
 CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}"
+CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1"