| Message ID | 20261105115526.634289-16-leon.anavi@konsulko.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-python,01/19] python3-apispec: Upgrade 6.10.0 -> 6.10.1 | expand |
diff --git a/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb b/meta-python/recipes-devtools/python/python3-svglib_2.3.3.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb rename to meta-python/recipes-devtools/python/python3-svglib_2.3.3.bb index 9403e7d49e..9f47ffe581 100644 --- a/meta-python/recipes-devtools/python/python3-svglib_2.3.2.bb +++ b/meta-python/recipes-devtools/python/python3-svglib_2.3.3.bb @@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24" CVE_PRODUCT = "svglib" -SRC_URI[sha256sum] = "625b62cf440ab57f5def42d5be47a0d6b73c02711ef86ab1545650a98ac1ad5f" +SRC_URI[sha256sum] = "1aef52f3dc651416119b55716e673995d2c9f90c86a07df0b2bcf6de26c7e0ff" inherit pypi python_hatchling
Upgrade to release 2.3.3: Security: - The limit on <use> expansions added in 2.3.1 counted expansions, not their size. Each expansion copies and renders the whole element it refers to, so a few kilobytes of nested <use> groups with a large group at the bottom could still take minutes and gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete fix of GHSA-555j-qj3j-c8jv). The elements copied by all expansions of a document, external SVGs included, are now limited too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the remaining <use> elements are skipped and an error is logged. Thanks to Adrian Korwel for the report. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> --- .../python/{python3-svglib_2.3.2.bb => python3-svglib_2.3.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-svglib_2.3.2.bb => python3-svglib_2.3.3.bb} (87%)