diff mbox series

[meta-python,wrynose,8/9] python3-filelock: ignore CVE-2026-112910

Message ID 20261111052938.3691463-9-dkelaiya@cisco.com
State New
Headers show
Series python3-filelock: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 11, 2026, 5:29 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- WindowsFileLock can ignore mode=0o600 and inherit the parent
  directory ACL instead of assigning owner-only permissions. [1][2]
- The issue also covers the ReadWriteLock database on Windows; the
  upstream advisory explicitly excludes UnixFileLock. [1]
- The Wrynose Linux target uses POSIX file permission handling and
  does not use the affected Windows security-descriptor code. [1][2]
- Mark the CVE as not applicable to the Linux target platform.

Reference:
[1] https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-112910

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb b/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
index 814fd59eb3..40c4fe9427 100644
--- a/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
+++ b/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
@@ -8,6 +8,7 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=2c6acbdf7bb74caa37512c3a5ca6857b"
 CVE_PRODUCT = "tox-dev:filelock"
 
 CVE_STATUS[CVE-2026-112907] = "not-applicable-platform: Windows oplock handling is not used on Linux"
+CVE_STATUS[CVE-2026-112910] = "not-applicable-platform: Windows ACL inheritance is affected; Linux uses POSIX file permissions"
 
 SRC_URI += " file://run-ptest \
     file://CVE-2026-112939.patch \