From patchwork Thu Nov 5 08:59:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103086 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30266.1793869209181269794 for ; Thu, 05 Nov 2026 01:00:13 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Av4kggbD; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=66497; q=dns/txt; s=iport01; t=1793869213; x=1795078813; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Ey8GszdFNvQwEBUk4PlMsNsP0xXEGZOaf9poAnq9Fsw=; b=Av4kggbD54Mhr4bqMxOrHmDjo2D6157AWm5KL7dR5nmx1zWSPMFT9bKY 6Dncl+RC4vtHBsbsboneOFJHBRZoswA+zT/dBrkIfOrYRAMQg6w+Ouptn rmHsCcqsQJKDtzH/yvR2xAPNUtwvWFUDJKTD9IvKH9mFCcl++O1L4kh/E ny1k0f72oW0ejqz3JOJlziAY7CMO0VNUcqsQWY+ZSFP6lYfXID389enZl AlSAV4xhd8+DA7YU5lOchoi6eFcfa237fEuWSo18Z9HRQkRpKfgscjm3u 2dmUtchaZMnLmxMIOg0Tvzpp3JJwcvdPQxu+h+G5oM4n07SPqYKdjBswn g==; X-CSE-ConnectionGUID: 7n1UyWN8RqW5uqyBw+2fcA== X-CSE-MsgGUID: IP0qkI++RSWBlS9NrzrhWQ== X-IPAS-Result: A0AFAABHRexq/5H/Ja1aGgEBAQEBAQEBAQEDAQEBARIBAQEBAgIBAQEBgX0EAQEBAQsBglZ1YENEBQOEVFyOd4E1bAOBE4pShWeMVSOBAQNXDwEBAQ9EDQQBAYQ/RgJPFY05AiY1CA4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAxoBCAQLARgBKBUJEwMBAgMCJgICIAsjCBAJgwIBgjoDNwMRoQ2aUhs3en8zgQGDKQGBVNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAUSDCoEvJxsbgXKBFYEXgVx2gQWBDQ0YKgKFPIJqBIIiehKBWh5lCYwMAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgkQtDgsGAQENCBcEKAcBGhMBBw0XBBADMQ4pGTUYBxEHKAUJAw0UCBSSQx1Dj2SCIYE1nh5NcQoog3iMJI8+hXwaM4EWgm6BV6UWC5YagmOCWYc1gRkEgl+ECpFUCwsNAQIQBjeEaYFpATqBWXAVO4JmAQkWNBkPjisCAgoLg2CEUENRhCTEUyYyAgkDLwEBBwIHAQwBAwuBaJAAAiYEA4FPAQE IronPort-Data: A9a23:m52Qoa0nb90h9/T0HPbD5YJwkn2cJEfYwER7XKvMYLTBsI5bpzAAy zZKWmGHbKrfN2vxf4xzYIq+/U9V68CEy9AxHgU43Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmcsbjpOg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGU0dvAJwn3LZNGF4T6 OUJAi9ONB6IrrfjqF67YrEEasULNsLnOsYb/3pn1zycVaZgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUidC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZjeSxbYSNIYXTLSlTtmeg/ nvF3ie6OColHtikmByf4GisudaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7JQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:oqhoJa2mHxwjdrvfJKfHpwqjBJAkLtp133Aq2lEZdPUzSL3+qy nOpoV+6faaslgssR0b9OxofZPwIk80lqQFhLX5Q43CYOCOggLBR+tfBMnZsl/d8kbFmdK1u5 0NT0EHMr3NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPGdXg2UK1XYANu5deXcGPTV7OQ== X-Talos-CUID: 9a23:YoGmgGAECDpwfnb6E3ZhrXMFJeZ1SGTikWrJMmWnSjxnQ5TAHA== X-Talos-MUID: 9a23:HJM/twXLRyQGOqvq/B7U3ChhFYQr2Z+RIkQ2wLMcqdOEChUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544560311" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:12 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 13B8A18000440 for ; Thu, 5 Nov 2026 09:00:12 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 6B8E5CBF202; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 02/18] python3-virtualenv: fix CVE-2026-102930 Date: Thu, 5 Nov 2026 00:59:51 -0800 Message-Id: <20261105090007.351866-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131896 From: Hetvi Thakar Backport the seed-wheel digest check [1], as identified by advisory [5]. Include prerequisite [2] so the expected digests are obtained over verified HTTPS, and follow-up [3] so missing digests cannot silently disable verification. Include follow-up [4] to verify wheels in private staging before caching them and to use the same verification for the pip seeder. This also fixes CVE-2026-113714 and CVE-2026-113717, tracked in [6] and [7]. Apply the TLS prerequisite before the three wheel fixes. Add python3-packaging for the upstream wheel-name and version checks. Keep virtualenv at version 21.2.1 without unrelated feature changes. [1] https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d [2] https://github.com/pypa/virtualenv/commit/48f6fdcc14b8654236f9081adbff10a32f536940 [3] https://github.com/pypa/virtualenv/commit/91460add8f53f4654c4aae3898e739c03fb69946 [4] https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96 [5] https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45 [6] https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3 [7] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q Signed-off-by: Hetvi Thakar --- .../CVE-2026-102930-dependent.patch | 115 +++ .../CVE-2026-102930_p1.patch | 309 +++++++ .../CVE-2026-102930_p2.patch | 293 +++++++ .../CVE-2026-102930_p3.patch | 777 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 5 + 5 files changed, 1499 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p1.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p2.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p3.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch new file mode 100644 index 0000000000..87da5978ce --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch @@ -0,0 +1,115 @@ +From 48f6fdcc14b8654236f9081adbff10a32f536940 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Tue, 14 Apr 2026 13:20:04 -0700 +Subject: [PATCH]