diff mbox series

[meta-python,wrynose,9/9] python3-filelock: ignore CVE-2026-112913

Message ID 20261111052938.3691463-10-dkelaiya@cisco.com
State New
Headers show
Series python3-filelock: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 11, 2026, 5:29 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- Upstream scopes this issue to Windows ReadWriteLock and
  AsyncReadWriteLock in directories writable by another account. [1]
- Attacker-controlled SQLite side files can cause acquisition
  failures or unsafe hot-journal recovery on Windows. [1][2]
- The advisory tracks the Linux/macOS issue separately; this series
  addresses that issue as CVE-2026-112940. [1][3]
- Mark this Windows-only CVE as not applicable to the Linux target.

Reference:
[1] https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-112913
[3] https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb b/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
index 40c4fe9427..9617d82b31 100644
--- a/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
+++ b/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
@@ -9,6 +9,7 @@  CVE_PRODUCT = "tox-dev:filelock"
 
 CVE_STATUS[CVE-2026-112907] = "not-applicable-platform: Windows oplock handling is not used on Linux"
 CVE_STATUS[CVE-2026-112910] = "not-applicable-platform: Windows ACL inheritance is affected; Linux uses POSIX file permissions"
+CVE_STATUS[CVE-2026-112913] = "not-applicable-platform: The CVE affects SQLite side-file handling on Windows only"
 
 SRC_URI += " file://run-ptest \
     file://CVE-2026-112939.patch \