From patchwork Thu Nov 5 08:59:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103094 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30039.1793869208884754057 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=TJPAT26o; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6759; q=dns/txt; s=iport01; t=1793869208; x=1795078808; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ucxZ06C8s9+8vx/7OWLIlo0Y9mUiFi8LlzCTF2YqkNE=; b=TJPAT26ocZpHeINX7/8QW+ODqw0rArezvcbi4vIs5cMltQAFgOvIvZ93 chagRD++gLJ9yNQQu4rnyNJzSLhYlTPLJKE49gdK+PoLOxfEEf4oz8OMr PuJwyEpSnMmpJQ3Y6jyJfbRHO+bEQN7i+2t3UIJW7+YsLYte1mYsX96X4 LiVM+dN02Z585Psqk5/DtJ4S5L4TOXWhcKgxDXcNpOJjTdQvlChe3MKAZ L+koDjZomjwXurUgtyBFbnJa86dPwrKnsghBCGLA9RU06oSz7J/ww+C1K RpT4RZT3EeKq20s5zegc8r/TwPfckm5GqIlWBNlI7eV7RqMUqabKGuOt+ w==; X-CSE-ConnectionGUID: 5Dcy1DLCQ4KcunsziixGTg== X-CSE-MsgGUID: ZcMOMJxBSDmJWMNm+M7w/w== X-IPAS-Result: A0AHAwBRROxq/5P/Ja1aHgEBCxIMggULgld1YENJA4RUj1OBNWwDi2WSPIF+DwEBAQ9EDQQBAYQ/RgKOHQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAE9CRMDAQIDAiYCAiALIwgQCYMCAYI6AzcDEaEGmyR6fzOBAYMpAYFU2EwNgloBCxQBgQouhUCCfyABhQNdGAGEfScbG4FygRWDaYEFgRpCAoU8gmoEgiJ6EoFaHmCMGgKBUoZxSIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD0BbgeSL4Iec4EOAStWbWlOoweCIaAgcQoog3iMJI8+hXwaM4QElBmSVAuYfY4KhAqRX2iEaYFvBDGBWXAVgyIJShkPji8KC4NgzlsmMgIJAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:jMFMEKoXMiKBWDugLDITN2EssRJeBmJJZBIvgKrLsJaIsI4StFCzt garIBmCaPqLMGOgKNlwPIvipxwGvMCBxoA2HgNv/ihhECoX9uPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8E835pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0rtbCnAX2 dgzEWwuZQ2FnPC3waKUduY506zPLOGzVG8ekmtrwTecCbMtRorOBvySo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LV/rSn8/w7pX7Wz1EqFuWrLAf6GnIxws327/oWDbQUoHWGJwNxx7J+ Aoq+UzLCTQ9Ef6P4wGp91CTo8nK3gakR8UNQejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dTJ lIZ/gIqrLMu7wqsVtT7UhiyrXKIsxJaXMBfe9DW8ymXwabSpgLcDW8eQ3sYMJottdQ9Qnoh0 Vrhc87VOAGDeYa9ERq1nop4ZxvrUcTJBQfuvRM5cDY= IronPort-HdrOrdr: A9a23:15xpiqM4ZoaDN8BcTuOjsMiBIKoaSvp037BN7TEXdfU1SL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IHjJ7MHd3ATV0mmhD0JczqmLg== X-Talos-CUID: 9a23:zbsgaGPF2sakeO5DBQVs5Rc4PuscLl7W0XHLMU65GUlVR+jA X-Talos-MUID: 9a23:4ATTPwz8XKmKC9JJ0+WCnopvXNWaqJalLWcos4UsgOWBFxNVHTLeqWuoBZByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="545101096" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:07 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id BE0F618000247 for ; Thu, 5 Nov 2026 09:00:07 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 6747DCBF201; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 01/18] python3-virtualenv: fix CVE-2026-102938 Date: Thu, 5 Nov 2026 00:59:50 -0800 Message-Id: <20261105090007.351866-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131881 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Keep pyvenv.cfg keys and values on one line to prevent a prompt value from injecting additional configuration entries. [1] https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140 [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-102938.patch | 141 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 4 + 2 files changed, 145 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102938.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102938.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102938.patch new file mode 100644 index 0000000000..0df2179527 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102938.patch @@ -0,0 +1,141 @@ +From a30f995461043acb6cacbf3a890951563ccf7140 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Thu, 17 Sep 2026 18:06:12 +0200 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103086 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30266.1793869209181269794 for ; Thu, 05 Nov 2026 01:00:13 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Av4kggbD; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=66497; q=dns/txt; s=iport01; t=1793869213; x=1795078813; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Ey8GszdFNvQwEBUk4PlMsNsP0xXEGZOaf9poAnq9Fsw=; b=Av4kggbD54Mhr4bqMxOrHmDjo2D6157AWm5KL7dR5nmx1zWSPMFT9bKY 6Dncl+RC4vtHBsbsboneOFJHBRZoswA+zT/dBrkIfOrYRAMQg6w+Ouptn rmHsCcqsQJKDtzH/yvR2xAPNUtwvWFUDJKTD9IvKH9mFCcl++O1L4kh/E ny1k0f72oW0ejqz3JOJlziAY7CMO0VNUcqsQWY+ZSFP6lYfXID389enZl AlSAV4xhd8+DA7YU5lOchoi6eFcfa237fEuWSo18Z9HRQkRpKfgscjm3u 2dmUtchaZMnLmxMIOg0Tvzpp3JJwcvdPQxu+h+G5oM4n07SPqYKdjBswn g==; X-CSE-ConnectionGUID: 7n1UyWN8RqW5uqyBw+2fcA== X-CSE-MsgGUID: IP0qkI++RSWBlS9NrzrhWQ== X-IPAS-Result: A0AFAABHRexq/5H/Ja1aGgEBAQEBAQEBAQEDAQEBARIBAQEBAgIBAQEBgX0EAQEBAQsBglZ1YENEBQOEVFyOd4E1bAOBE4pShWeMVSOBAQNXDwEBAQ9EDQQBAYQ/RgJPFY05AiY1CA4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAxoBCAQLARgBKBUJEwMBAgMCJgICIAsjCBAJgwIBgjoDNwMRoQ2aUhs3en8zgQGDKQGBVNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAUSDCoEvJxsbgXKBFYEXgVx2gQWBDQ0YKgKFPIJqBIIiehKBWh5lCYwMAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgkQtDgsGAQENCBcEKAcBGhMBBw0XBBADMQ4pGTUYBxEHKAUJAw0UCBSSQx1Dj2SCIYE1nh5NcQoog3iMJI8+hXwaM4EWgm6BV6UWC5YagmOCWYc1gRkEgl+ECpFUCwsNAQIQBjeEaYFpATqBWXAVO4JmAQkWNBkPjisCAgoLg2CEUENRhCTEUyYyAgkDLwEBBwIHAQwBAwuBaJAAAiYEA4FPAQE IronPort-Data: A9a23:m52Qoa0nb90h9/T0HPbD5YJwkn2cJEfYwER7XKvMYLTBsI5bpzAAy zZKWmGHbKrfN2vxf4xzYIq+/U9V68CEy9AxHgU43Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmcsbjpOg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGU0dvAJwn3LZNGF4T6 OUJAi9ONB6IrrfjqF67YrEEasULNsLnOsYb/3pn1zycVaZgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUidC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZjeSxbYSNIYXTLSlTtmeg/ nvF3ie6OColHtikmByf4GisudaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7JQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:oqhoJa2mHxwjdrvfJKfHpwqjBJAkLtp133Aq2lEZdPUzSL3+qy nOpoV+6faaslgssR0b9OxofZPwIk80lqQFhLX5Q43CYOCOggLBR+tfBMnZsl/d8kbFmdK1u5 0NT0EHMr3NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPGdXg2UK1XYANu5deXcGPTV7OQ== X-Talos-CUID: 9a23:YoGmgGAECDpwfnb6E3ZhrXMFJeZ1SGTikWrJMmWnSjxnQ5TAHA== X-Talos-MUID: 9a23:HJM/twXLRyQGOqvq/B7U3ChhFYQr2Z+RIkQ2wLMcqdOEChUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544560311" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:12 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 13B8A18000440 for ; Thu, 5 Nov 2026 09:00:12 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 6B8E5CBF202; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 02/18] python3-virtualenv: fix CVE-2026-102930 Date: Thu, 5 Nov 2026 00:59:51 -0800 Message-Id: <20261105090007.351866-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131896 From: Hetvi Thakar Backport the seed-wheel digest check [1], as identified by advisory [5]. Include prerequisite [2] so the expected digests are obtained over verified HTTPS, and follow-up [3] so missing digests cannot silently disable verification. Include follow-up [4] to verify wheels in private staging before caching them and to use the same verification for the pip seeder. This also fixes CVE-2026-113714 and CVE-2026-113717, tracked in [6] and [7]. Apply the TLS prerequisite before the three wheel fixes. Add python3-packaging for the upstream wheel-name and version checks. Keep virtualenv at version 21.2.1 without unrelated feature changes. [1] https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d [2] https://github.com/pypa/virtualenv/commit/48f6fdcc14b8654236f9081adbff10a32f536940 [3] https://github.com/pypa/virtualenv/commit/91460add8f53f4654c4aae3898e739c03fb69946 [4] https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96 [5] https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45 [6] https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3 [7] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q Signed-off-by: Hetvi Thakar --- .../CVE-2026-102930-dependent.patch | 115 +++ .../CVE-2026-102930_p1.patch | 309 +++++++ .../CVE-2026-102930_p2.patch | 293 +++++++ .../CVE-2026-102930_p3.patch | 777 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 5 + 5 files changed, 1499 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p1.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p2.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p3.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch new file mode 100644 index 0000000000..87da5978ce --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch @@ -0,0 +1,115 @@ +From 48f6fdcc14b8654236f9081adbff10a32f536940 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Tue, 14 Apr 2026 13:20:04 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103084 Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30040.1793869208926666976 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IlOfq4aF; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11857; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Ai1wq7cqmciMDWheAPPUbkAG2Q5BjGLaA/M+JTaOpqY=; b=IlOfq4aFHIHzYXccfZnsNC8ZntPH0o3dyx1Yibgngz7nxy0DNcK357CP SqRjkTajfUWD0sjMIUdztYh9rDpNjKKvYk0iB7Z52P4Su/hW347lCAZF7 HxSB+j9oNdfP29ajQ1vR4rFwKXU5KlEkWAlsWiAlq0o52G8uIhU69700b wpjPjnj3dkDHceUcrMhBJHw0X15AbEubWWBPg32gD6G+pp3Ci45oyvsSi M6oFBub101xEKJxhyIcvA0yz1YJvVPzyBLgdHM/PVbKceS5YCzdYGnPru N3JadtlU9uZa2lHPENszRm76+Vlf3C5wzRuGMzEbGNnH0zEFeePFDP5zY g==; X-CSE-ConnectionGUID: AupqIdXxQ4uoMgIvtu3bvA== X-CSE-MsgGUID: tAkNWSU4Rq+PHndwBzn1Vw== X-IPAS-Result: A0BtAgBRROxq/5X/Ja1aHgEBCxIMggULgld1YENJA4RUj1OCIQODHIhJgyaPFoF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAE9CRMDAQIDAiYCAiALIwgQCYMCAYI6AzcDEaEGmyR6fzOBAYMpAYFU2EwNgloBCxQBgQouhUCCfyABhQNdGAGEfScbG4FygRWDaYEFS09CAoU8gmoEgiKBDIFaHox6AoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgxEBXy4BK4EYCDEPHQcokwwTkDaCIaAgcQoog3iKFIIQjz6FfBozhASBV6UWC5h9glmLMYQKkkeEaYFoPIFZcBWDIglKGQ+OOYNrgSWBNIN3yAsmMgIJAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:R2DnwavSQRBOkdm4Wxg7kogRtOfnVAdfMUV32f8akzHdYApBsoF/q tZmKW/TPq7cYWrwcooiO9zj/R4DuJSDzNI3Tgc5rH09EChBgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Es11BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw0/tvGEBCx ewhdC0KSx+imf6rm7ilY7w57igjBJGD0II3oHpsy3TdSP0hW52GGv+M7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtGYH49tL/Aan3XcyFYoVGcv4I84nPYy0p6172F3N/9J4fUHpQKwB7Az o7A13jQATclD+HD8yPGylKqivDljyWiZp1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2cbLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:ivTLlKrKdam06H0rJhNEPx4aV5oJeYIsimQD101hICG9Ffbo8P xG/c5rsSMc5wx+ZJhNo7290ey7MBDhHP1OkOws1MmZPTUO0VHAROoJ0WKh+UyDJ8SUzIFgPM lbH5SWcOeRMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ANV0mlhD0Jcjpy1SZNNXB7OaY= X-Talos-CUID: 9a23:0m3tLWzz1VK8y3PN79wsBgU9B9g8U3Ht3E6MPkidBkd3VKDOQ0G5rfY= X-Talos-MUID: 9a23:OWP51Qw3Uxv1xaN+TSfhYh/9+GyaqLiHC2YyqqhagdDHDQx2Nyi3njLufJByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="536397600" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:07 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id C2BA118000326 for ; Thu, 5 Nov 2026 09:00:07 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 6F369CBF203; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 03/18] python3-virtualenv: fix CVE-2026-102925 Date: Thu, 5 Nov 2026 00:59:52 -0800 Message-Id: <20261105090007.351866-4-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131887 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Remove the extra template quotes around values that are already quoted for Bash and Fish activation scripts. [1] https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6 [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2 Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-102925.patch | 296 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 297 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102925.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102925.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102925.patch new file mode 100644 index 0000000000..f9f6747dd9 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102925.patch @@ -0,0 +1,296 @@ +From 4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Fri, 18 Sep 2026 06:10:09 +0200 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103093 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30039.1793869208884754057 for ; Thu, 05 Nov 2026 01:00:12 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=HVBpcRwM; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11718; q=dns/txt; s=iport01; t=1793869212; x=1795078812; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=kjT0xNHY2D+6ivrj/wFP5HJ7wa/wGEbbvKr64D7Nuis=; b=HVBpcRwMYX5B7MJHLEbIRGr7oxSSF4STS6/ylInIGVTFcrBVk/PquiMo wWM1uCmVy3LhX0AHl8SiZmwEMBxZZopwJMvqZXdfo61Z6YUTQwSQPZyvu ngxx34QkXO+Xv+txQPmRApWrgGQuqm3o777HuFkAGlTInwRtJP1Uzhyzz gjQjufaq6ChCpy7W95xQVPS54DEsD4BDwRQzG/slWxdul6ySB29YTVgFA AEUNQ8nLr7anqgicuVAnZgSi0S27m8T05fED/4Gt54NdMVn1wajPlOsAG q96t0QFkN98d6PzgDiwbAXMwu/Cy1D9YnY6SU8jaZvAlXTo4MwZ1M1v8y w==; X-CSE-ConnectionGUID: xn8cv2QQSlCeo+/AHkJDpA== X-CSE-MsgGUID: Xmr+EYFrRF6e/DzouYHI9A== X-IPAS-Result: A0AcAABRROxq/5H/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJA4RUiBuHOIIhA4MciEmSPIF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAE9CRMDAQIDAiYCAiALIwgQCYMCAYI6AzcDEQahAJsken8zgQGDKQGBVNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAUSEOScbG4FygRWDaYEFS09CAoU8gmoEgiJ6EoFaHox6AoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgxEBXxsEDwEHJIFgJCiTDJBJgiGgIHEKKIN4ihSCEI8+hXwaM4QEgVelFguYfYJZizGECpFfaIRpgWg8gVlwFYMiCUoZD445g2uBJYE0zAImMgIJAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:7U7pw6yIibXiC/2MOxd6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUEz mpOWWiEM/aKamWjfYx0PNu3p04AuJ6Dz9RhGVBqqlhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj5MscpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJFEwbYYGoN9OOmVl+ PtbbxktbTKvn8vjldpXSsE07igiBNPgMIVavjRryivUSK52B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cPnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OWxbYONI4XVHq25mG6oo 3iF0lXXGCs0atHY5SiC70OMp77myHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBVi4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:lxBaVaCelR9qZgflHemO55DYdb4zR+YMi2TDsHoBLiC9E/bo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a585+oJjsaE52JKGxCe3+mLnE= X-Talos-CUID: 9a23:haWuemPBnFW6Z+5DSC83/1BOI/kedlbQyzSXCm+7K0pxYejA X-Talos-MUID: 9a23:+SA2cgknMy7SzUewjCgZdnpSMd0rzpWAEnojz5hBl9uDKB1QGma02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="545101173" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:12 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 15E16180005B7 for ; Thu, 5 Nov 2026 09:00:12 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 72F6ACBF204; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 04/18] python3-virtualenv: fix CVE-2026-113732 Date: Thu, 5 Nov 2026 00:59:53 -0800 Message-Id: <20261105090007.351866-5-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131895 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Use Fish-specific quoting so backslashes and quotes in an environment path or prompt remain literal data. Include follow-up [3], released in [4], to preserve apostrophes and backslashes after multibyte text in Fish 3 legacy locales. Keep the upstream GBK and UTF-8 regression tests. [1] https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q [3] https://github.com/pypa/virtualenv/commit/685435d7fb53da12da99e195ee2753f5ca083249 [4] https://github.com/pypa/virtualenv/releases/tag/21.14.9 Signed-off-by: Hetvi Thakar --- .../CVE-2026-113732_p1.patch | 116 +++++++++++++++++ .../CVE-2026-113732_p2.patch | 120 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 2 + 3 files changed, 238 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p1.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p2.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p1.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p1.patch new file mode 100644 index 0000000000..1afedad035 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p1.patch @@ -0,0 +1,116 @@ +From 3bddeaf8d02c3ee7f576503efb082f8f494cfcab Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Wed, 30 Sep 2026 22:59:45 -0700 +Subject: [PATCH] Merge commit from fork + +FishActivator inherited shlex.quote, whose POSIX rules leave a backslash +literal inside single quotes. fish reads \' there as an escaped quote, so a +path or --prompt with a backslash before a quote ended the literal early and +ran the rest as commands, without any error from fish. + +Give FishActivator its own quote() that escapes backslashes and quotes. + +CVE: CVE-2026-113732 +Upstream-Status: Backport [https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab] + +Backport Changes: +- Add the cli_run import required by the upstream regression test; + it is absent from the 21.2.1 test module. + +Signed-off-by: Hetvi Thakar +--- + src/virtualenv/activation/fish/__init__.py | 6 ++++ + tests/unit/activation/test_fish.py | 40 ++++++++++++++++++++-- + 2 files changed, 43 insertions(+), 3 deletions(-) + +diff --git a/src/virtualenv/activation/fish/__init__.py b/src/virtualenv/activation/fish/__init__.py +index 74300db..81d6d92 100644 +--- a/src/virtualenv/activation/fish/__init__.py ++++ b/src/virtualenv/activation/fish/__init__.py +@@ -15,6 +15,12 @@ class FishActivator(ViaTemplateActivator): + def templates(self) -> Iterator[str]: + yield "activate.fish" + ++ @staticmethod ++ def quote(string: str) -> str: ++ # fish reads \\ and \' as escapes inside single quotes, unlike POSIX sh, so shlex.quote's output lets a ++ # backslash before a quote end the literal early ++ return "'" + string.replace("\\", "\\\\").replace("'", "\\'") + "'" ++ + def replacements(self, creator: Creator, dest_folder: Path) -> dict[str, str]: + data = super().replacements(creator, dest_folder) + data.update({ +diff --git a/tests/unit/activation/test_fish.py b/tests/unit/activation/test_fish.py +index f726e7e..fc1b8a6 100644 +--- a/tests/unit/activation/test_fish.py ++++ b/tests/unit/activation/test_fish.py +@@ -1,7 +1,6 @@ + from __future__ import annotations + + import os +-import shlex + import shutil + import subprocess + import sys +@@ -13,6 +12,7 @@ import pytest + + from virtualenv.activation import FishActivator + from virtualenv.info import IS_WIN ++from virtualenv.run import cli_run + + if TYPE_CHECKING: + from collections.abc import Callable +@@ -59,8 +59,8 @@ def test_fish_tkinter_generation( + assert "set -e _OLD_PKG_CONFIG_PATH" in content + + if present: +- assert f"set -gx TCL_LIBRARY {shlex.quote(tcl_lib)}\n" in content +- assert f"set -gx TK_LIBRARY {shlex.quote(tk_lib)}\n" in content ++ assert f"set -gx TCL_LIBRARY {FishActivator.quote(tcl_lib)}\n" in content ++ assert f"set -gx TK_LIBRARY {FishActivator.quote(tk_lib)}\n" in content + else: + assert "if test -n ''\n if set -q TCL_LIBRARY;" in content + assert "if test -n ''\n if set -q TK_LIBRARY;" in content +@@ -79,6 +79,40 @@ def test_fish_tkinter_path_does_not_run_commands( + assert not marker.exists() + + ++@pytest.mark.skipif(IS_WIN, reason="fish is not available on Windows") ++@pytest.mark.skipif(FISH is None, reason="fish is not installed") ++@pytest.mark.parametrize( ++ ("prompt", "env_name"), ++ [ ++ pytest.param(r"x\'$(touch PWNED)'\'", "env", id="prompt-backslash-quote"), ++ pytest.param(None, r"x\'$(touch PWNED)'\'", id="dirname-backslash-quote"), ++ ], ++) ++def test_fish_activate_does_not_run_commands( ++ tmp_path: Path, current_fastest: str, prompt: str | None, env_name: str ++) -> None: ++ dest = tmp_path / env_name ++ args = ["--without-pip", str(dest), "--creator", current_fastest, "--no-periodic-update", "--activators", "fish"] ++ if prompt is not None: ++ args += ["--prompt", prompt] ++ cli_run(args) ++ (work_dir := tmp_path / "workdir").mkdir() ++ ++ # the path is passed as an argument so the driver cannot expand a payload dir name while locating the script ++ result = subprocess.run( ++ [FISH, "--no-config", "-c", 'source $argv[1]; printf "%s" "$VIRTUAL_ENV"', str(dest / "bin" / "activate.fish")], ++ capture_output=True, ++ text=True, ++ encoding="utf-8", ++ cwd=str(work_dir), ++ timeout=60, ++ check=False, ++ ) ++ ++ assert not (work_dir / "PWNED").exists() ++ assert result.stdout == str(dest), result.stderr ++ ++ + @pytest.mark.skipif(IS_WIN, reason="we have not setup fish in CI yet") + def test_fish(activation_tester_class, activation_tester, monkeypatch, tmp_path) -> None: + monkeypatch.setenv("HOME", str(tmp_path)) +-- +2.35.6 diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p2.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p2.patch new file mode 100644 index 0000000000..ad66d9b1e2 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p2.patch @@ -0,0 +1,120 @@ +From 685435d7fb53da12da99e195ee2753f5ca083249 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 02:08:22 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103100 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30265.1793869209177458011 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KJjf27r1; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7840; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+jaZV3gZM7dUEeZZcAb31dxCq0IyiQtkrLceKyRyQT4=; b=KJjf27r1Qej6ldKMdPFwNk5WNZCRYC1FPoAcV7yYziaU4AoIFG0z1HIZ dwI423dIiAnMY7tdhtk6R9iTkzJK792wMLngsFUU7iqPo9os6LBZZAcVu 70eQrqumR8U4czycEQsWHE6DswMa0rZRv2nJ6IjlJjXBsBhvwYwW3Yfyk WAXrC9vPMPTZzBO/v6g053+Ct+212wFSyQFFeMhNRDMSSEIJ+8SQgiM2h 9dUDaoZ1RnGrzhXFigLSykihgNOCaRdTCNYtJSgmCOvvcZ2ddYzVLshW8 KyhcKECvrda51ovHDg7UYeqwluzBIdAkyK1PnaKyCxQOkNSBehQ5VA2C5 Q==; X-CSE-ConnectionGUID: 9xL5NoUTSN61bfGZIsE2Xw== X-CSE-MsgGUID: KkZ4d4nXSX6smRBfAceyGA== X-IPAS-Result: A0CFAADGROxq/5P/Ja1aHQEBAQEJARIBBQUBgX4GAQsBglZ1YAo5SQOEVI9TgiEDgROKUpI8gX4PAQEBD0QNBAEBhD9GAo4dAiY2Bw4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMECwEYAT0JEwMBAgMCJgICIAsjCBmDAgGCOgM3AxGhDZsken8zgQGDKQGBVNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAUSEOScbG4FygRWCc3aBBYEaQgKFPIJqBIINFYEMgVoegweJcwKBUoZxSIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD0BbgeSL4MRDko2ASsXgQlATA4Bkn0FkESCIaAgcQoog3iKFIIQjz6FfBozhASBV5JCklQLmH2OCoQKkXpNhGmBbwMygVlwFYMiCUoZD44uCwuDYIVkyHcmMgIJAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:RHVZYa1AB0H2NaE2L/bD5YJwkn2cJEfYwER7XKvMYLTBsI5bpzYPy jcbUGHUOvyKYGX2f492ady3/ElVuZ7cndc1TwVs3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmcsbjpOg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGXVESYKsfx9pMJz8X/ /I3GhEWQ0qzmLfjqF67YrEEasULNsLnOsYb/3pn1zycVK5gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUifC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZjeSxYIWJIYXXLSlTtmWbl D7Ko2LJOSFEL9ml4zSs+X+9qcaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl/BQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:LCoC/qGLC1zj0qOzpLqEyseALOsnbusQ8zAXPidKOHtom62j5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:VGvOoG/mmWSz1eTdRjmVvx8EPp0DdUDh91GOekW2JlRIU5DPeUDFrQ== X-Talos-MUID: 9a23:Qw2U4Aul9FpJN1Tloc2npzJQaMs05ZSVOB4WlK8steCPOD1fEmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544874315" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 28C411800027C for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 7748FCBF21E; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 05/18] python3-virtualenv: fix CVE-2026-113776 Date: Thu, 5 Nov 2026 00:59:54 -0800 Message-Id: <20261105090007.351866-6-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131885 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Replace activation-template placeholders in a single pass so placeholder names inside substituted paths or prompts cannot be expanded again as script content. [1] https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74 [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113776.patch | 133 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 134 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113776.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113776.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113776.patch new file mode 100644 index 0000000000..c1e034edb5 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113776.patch @@ -0,0 +1,133 @@ +From 602b26623a724827ff171bf11fef4ad186d01f74 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Wed, 30 Sep 2026 23:01:05 -0700 +Subject: [PATCH] Merge commit from fork + +instantiate_template replaced one placeholder at a time across the whole +template, so a placeholder name inside an already quoted value, such as a +parent directory named __VIRTUAL_NAME__, was rewritten from inside the +finished literal. The second value's quotes closed the first, and the rest +of the path ran as code in bash, fish, xonsh and activate_this.py; in csh +the prompt display tokens broke activate.csh the same way. + +Build every token's final text first and substitute them in one regex pass, +with the csh display tokens joining that pass through substitutions(). + +CVE: CVE-2026-113776 +Upstream-Status: Backport [https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74] + +Backport Changes: +- Omit the Csh display-token override and its specific test: 21.2.1 has + no separate display-token substitution or prompt-literal helpers. + Its Csh activator uses the corrected shared template substitution. +- Exercise upstream's placeholder-in-parent-directory regression through + the existing Bash relocation fixture, since 21.2.1 lacks the later + prompt-test fixture. Add direct one-pass substitution checks for the + existing Bash, Csh, Fish and Python activators, and retain the 21.2.1 + special-character fixture's other characters. + +Signed-off-by: Hetvi Thakar +--- + src/virtualenv/activation/via_template.py | 21 +++++++++++++++++---- + tests/conftest.py | 3 ++- + tests/unit/activation/test_activator.py | 16 ++++++++++++++++ + tests/unit/activation/test_bash.py | 1 + + 4 files changed, 36 insertions(+), 5 deletions(-) + +diff --git a/src/virtualenv/activation/via_template.py b/src/virtualenv/activation/via_template.py +index 926c2b0..3af9dc5 100644 +--- a/src/virtualenv/activation/via_template.py ++++ b/src/virtualenv/activation/via_template.py +@@ -1,6 +1,7 @@ + from __future__ import annotations + + import os ++import re + import shlex + import sys + from abc import ABC, abstractmethod +@@ -84,10 +85,22 @@ class ViaTemplateActivator(Activator, ABC): + # read content as binary to avoid platform specific line normalization (\n -> \r\n) + binary = read_binary(self.__module__, template) + text = binary.decode("utf-8", errors="strict") +- for key, value in replacements.items(): +- value_uni = self._repr_unicode(creator, value) +- text = text.replace(key, self.quote(value_uni)) +- return text ++ substitutions = self.substitutions(replacements, creator) ++ # one pass over the template, so a placeholder name inside an already quoted value (a path component named ++ # __VIRTUAL_NAME__) stays data instead of being rewritten by a later key from inside the finished literal ++ pattern = re.compile("|".join(re.escape(key) for key in sorted(substitutions, key=len, reverse=True))) ++ return pattern.sub(lambda match: substitutions[match.group()], text) ++ ++ def substitutions(self, replacements: dict[str, str], creator: Creator) -> dict[str, str]: ++ """Map each placeholder to the final text that replaces it in the template. ++ ++ :param replacements: the raw placeholder values ++ :param creator: the creator of the environment ++ ++ :returns: the placeholder to substituted text mapping ++ ++ """ ++ return {key: self.quote(self._repr_unicode(creator, value)) for key, value in replacements.items()} + + @staticmethod + def _repr_unicode(creator: Creator, value: str) -> str: # noqa: ARG004 +diff --git a/tests/conftest.py b/tests/conftest.py +index 3ec4147..f27c450 100644 +--- a/tests/conftest.py ++++ b/tests/conftest.py +@@ -279,7 +279,8 @@ def is_inside_ci(): + + @pytest.fixture(scope="session") + def special_char_name(): +- base = "'\";&&e-$ èрт From patchwork Thu Nov 5 08:59:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103095 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30043.1793869213943589263 for ; Thu, 05 Nov 2026 01:00:14 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=FeYunsF+; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=15622; q=dns/txt; s=iport01; t=1793869214; x=1795078814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=M3nweJTNEzrV6xj68EGGXJ79wkeBfRQ2Ih9kJwa8T0I=; b=FeYunsF+a0XuqJPl2vDt/IL0LqhCYsihq68Z+1VO8Xv/IEIy4AG4ceIp Q0OZ7XNPQsk+wxAXC1hp5NzUJF4h2wWOlPoC1Hhp4thVYQYGDrI86lnbc +xDLuCCEhxAq1TtaN40Cq5hW26ttrTsi2lqIayHcRXallEvsmZyqYHEwS +IQxUmL2dqdJuvIADFmdtx9n/DgRubWeweLd0+jPIwKNk7HzlMfkr+A+b wHpjXrxCRkur7BWT1SMSBK9Oh3c6Kwk5F/bxlbWaS8YjCy3wfQxHaHi9Y 99wR6C9AE5EDyodlRUvvWyFQz3b0mOYgcmWUgUlxEJnInqKDDQUyncOfa g==; X-CSE-ConnectionGUID: rNPPvyWCRTecre8l5SoYpA== X-CSE-MsgGUID: 2Z1+fUOkTleEnS6Q0uE3FA== X-IPAS-Result: A0AnAABHRexq/5D/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJA4RUiBuHOIIhA4tlkjyBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDIwQLARgBHh8JEwMBAgMCJgICIAsjCBAJgwIBgjoDNwMRoQ2bJHp/M4EBgykBgVTYTA2CWgELFAGBCi4BhT+CfyABhQNdGAGEfScbG4FygRWDaYEFgRpCAoEqhBKCagSCIoEMgVoeMoxIAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgnEgAV8fDwErgVpSHJJwkEmCIaAgcQoog3iKFIIQjz6FfBozhASBV6N/gRcLmH2CWYsxhAqRXxhQhGmBaDyBWXAVgyIJShkPjjmDa4ZQyAsmMgIJAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:B+ynmqowdzCpK8T42e/mMJcRytleBmJIZBIvgKrLsJaIsI4StFCzt garIBmOPKnbZjT9KdlyO96/pE0O7MPTnNVjGQVprHg9EyxD9OPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8E835pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0vxROVlQ5 MMzEgwAZQqO1+br+7WKUsA506zPLOGzVG8ekmtrwTecCbMtRorOBv2Vo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVPrSn8/w7pX7Wz1EqFuWrLAf6GnIxws327/oWDbQUoHWGZsMwhzF/ Qoq+UyjMEhZOuG4ygaB/1+qvbH2xT7WA6w7QejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dTJ lIZ/gIqrLMu7wqsVtT7UhiyrXKIsxJaXMBfe9DW8ymXwabSpgLcDW8eQ3sZN5ottdQ9Qnoh0 Vrhc87VOAGDeYa9ERq1nop4ZxvrYUD58Udqifc4cDY4 IronPort-HdrOrdr: A9a23:+xTR/6GMsOIx6pZ+pLqEyseALOsnbusQ8zAXPidKOHtom62j5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:zjAhmmzE0gnD7TR7osJiBgUOPPgdbGzi503sLkSiBDZtFYaSeEe5rfY= X-Talos-MUID: 9a23:Th6G3wnK4XQBhHPTq6xjdno4Bp4r7ZmJC3wJnLgAgJe9bTFdYBm02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544614253" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 28BBE180003C1 for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 7B26CCBF234; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 06/18] python3-virtualenv: fix CVE-2026-113726 Date: Thu, 5 Nov 2026 00:59:55 -0800 Message-Id: <20261105090007.351866-7-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131897 From: Hetvi Thakar Backport the upstream Zsh prompt fix [1] identified by advisory [3]. Include prerequisite [2] to provide the prompt-escaping block and regression-test fixture that the fix uses but 21.2.1 does not contain. Escape prompt values before Zsh expands PS1, including when PROMPT_SUBST is enabled after activation, and preserve literal percent signs in the displayed environment name. [1] https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2 [2] https://github.com/pypa/virtualenv/commit/a70c1dac43e2ee7e618132b572072395af5d8a9b [3] https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q Signed-off-by: Hetvi Thakar --- .../CVE-2026-113726-dependent.patch | 168 ++++++++++++++++++ .../python3-virtualenv/CVE-2026-113726.patch | 149 ++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 2 + 3 files changed, 319 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch new file mode 100644 index 0000000000..3c43b70fe8 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch @@ -0,0 +1,168 @@ +From a70c1dac43e2ee7e618132b572072395af5d8a9b Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 26 Sep 2026 09:35:09 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103083 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30039.1793869208884754057 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=U9NJWKo+; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6123; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=jr78Psx0EA+J8L1RsAkrZ+h2IBxFB8DqSejh7vMQg5k=; b=U9NJWKo+sKsGDuKIPnpJntxt3g4Nm9LCrFuQ0qQVweTSRCWrzMyIU/E1 /WaZAtlM676BQPzRs6tSQKuA8EyV1eBdVfCV132sMBeG73V6ojt5iDFG2 qz6kP0bfCBbsYogQ5IWQmlFyWKaYE44Y5pA1DsvOu0nOR4LQ4k5T8s9u2 CAeRDPn2dvE0Fnc3TVZqQF7zW0TrM6LxKkNhelr9gceRyuUKNRp/t2LRq atSJehj83o8riYbVtyRmk/jUvgZ6B/sHdQgVZFES6Lm0/1yrVY1tDLVu/ 1rY/gzeCV7crGny5c9RsJ5ByMg8njZm7r/+IZiwpPNWAyoxfMNS5NmvlY A==; X-CSE-ConnectionGUID: 1gI1LRw+QOe0i65W6V00wg== X-CSE-MsgGUID: Wy4M6ih8TAujowXVj6hv7w== X-IPAS-Result: A0BCAwBRROxq/43/Ja1aHgEBCxIMggULgld1YENJA4RUj1OCIQOLZZQ6DwEBAQ9EDQQBAYQ/RgKOHQImNwYOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjDwEYAR4CChMJEwMBAgMCJgICIAsjCBAJgwIBgjoDNwMRoQabJHqBMoEBgykBgVTYTA2CWgELFAGBCi6FQIJ/IAGFA10YAYR9JxsbgXKBFYNpgQWBGkICgScDhBKCagSCIoEMgVoejHoCgVKGcUiBAhwDWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XL1gbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ9AW4Hki+DEWAfDwErgSCBDByScJBJgiGgIHEKKIN4ihSCEI8+hXwaM4VbpRYLmH2OCoQKkV9ohGmBfiaBWXAVgyIJShkPjjmDa4ZQyAsmMgIJAy8BAQcCBwEMAQMLgWiQAIF+AQE IronPort-Data: A9a23:EsV2FKwEAs5qB0firtl6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUCy GFLDz2OPq6OZmWhc9Bzao22phgOucXXn9VqTlBprVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj5MscpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJBg5HNQ8wPk0OEZDr f1GdQ9TUEjbmO3jldpXSsE07igiBNPgMIVavjRryivUSK56B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OWxbYONI4XSHK25mG6nt z7joWX5Ui0zKd6Y1gq78CysmLDQyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWi4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:3Uf9Mqr/cNUUJo24rg+cdyAaV5oJeYIsimQD101hICG9Ffbo8P xG/c5rsSMc5wx+ZJhNo7290ey7MBDhHP1OkOws1MmZPTUO0VHAROoJ0WKh+UyDJ8SUzIFgPM lbH5SWcOeRMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ANV0mlhD0Jcjpy1SZNNXB7OaY= X-Talos-CUID: 9a23:NsruvmvK1Cd2u+cEQYY3knOu6It8fVyE6E3PYHafBD5oFuCqF2HIoLxrxp8= X-Talos-MUID: 9a23:QC4U+Aq6tHkG8IFItwIezw5zaOI24qT+NGkQk5IZi/eGayxuZCjI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="545101101" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 297CE180005CE for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 7E993CBEF8A; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 07/18] python3-virtualenv: fix CVE-2026-113725 Date: Thu, 5 Nov 2026 00:59:56 -0800 Message-Id: <20261105090007.351866-8-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131886 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Escape the Bash prompt for both its backslash decoding and expansion passes so backslashes cannot undo quoting. [1] https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932 [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7 Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113725.patch | 88 +++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 89 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113725.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113725.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113725.patch new file mode 100644 index 0000000000..56bc9a41eb --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113725.patch @@ -0,0 +1,88 @@ +From c3104e02474b652832a9bbaae79f6e1696296932 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sun, 11 Oct 2026 17:36:53 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103087 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30267.1793869209536501694 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=dWpo9kG+; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=32232; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=tBFJ/6kABc/Pmtn7+nOcyzdyEyROqXz7cC1HvpsLN40=; b=dWpo9kG+ebtw8TzgfV6G8ucrL7fwEgLd0tsU1gBLxTvYL7j/Qja/Lij8 /DMyE51Lg5Xy108cktCUcKFeTMKjfMWsdme1Qz1rtyjYZNY1CZKCqoQDA AvsXMlYFzMejuuku8mmRtkig6iQXynFfgpWp25btJg9MBIvT5AzAfgiqC 98kHgJvo9AI+2QTFPQM5U8jf58IF1ZZaQbm0JzxCak9mj/jrud0H0lW8q IKKDlDVr8048QL2/OEL0+XjMEFnuiS6futWjXCtrNhtggwgXW1BxpvXh1 ZmuQpl9POmAx8w/av+2nhIidTVv0Yio/PVP9K28SfKrRVOUPTqdpoQQSW g==; X-CSE-ConnectionGUID: cnHrb/lFTG+o44hf0j70GA== X-CSE-MsgGUID: gUIXfdMaTVeYAn40sRAVHQ== X-IPAS-Result: A0D7AgDGROxq/4//Ja1aglmCV3VgQ0kDhFSPU4IhA4MciEmDJoJBjFWBfg8BAQEPRA0EAQGEP0YCjh0CJjUIDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDGgEIBAsBGAEeHwkTAwECAwImAgIgCyMIEAmDAgGCOgM3AxGhDZsken8zgQGDKQGBVNhMDYJaAQsUAYEKLoVAgn8gAYUDXRgBhH0nGxuBcoEVgReCUoEFgRpCAoEqhBKCagSCDRWBDIFaHjIzgiKDG4ZYAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvghUvLRkGAQEwKSUPAQckgQUbLQQPDBgBGg0OAQ0ykj4TklegIHEKKIN4ihSCEI8+hXwaM4QEgVeSQpJUC5h9glmLMYQKkV8LEE2EaYFpATqBWXAVO4JnCUoZD445g2uCWYN3yAsmMgIJAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:dP5P8awDMO+0U+yfQSR6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUAx 2sWCzyFa6vbZ2GmeIwib4W38EhUsJ7cm9YyGQZtr1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj5MscpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJEowHZcSveJZPU4N8 qBEKD5VbE/bqMvjldpXSsE07igiBNPgMIVavjRryivUSK54B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOHWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OWxa4uKIIPXFK25mG6Xm 0P28WjcCy0kOe22z2bd6UiFuM/2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:kBHvEKikJeaflj3hIPROKdac/3BQXvgji2hC6mlwRA09TyX+rb HIoB17726RtN9/Yh8dcLy7VZVoBEmslqKdgrNhWItKIjOGhILAFugLhuHfKn/bak/DH4Vmup uIHZITNDSJNzhHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGsddB8MTMHfiLqWwLzM2fKYEKA == X-Talos-CUID: 9a23:alC+8mgqd0G9zmXGjj8LH3cknTJueXv91n2XJ2GEJiVuFOGVRweSp/tLup87 X-Talos-MUID: 9a23:Mk9RcAyZGzAcecLPWuZXJtJVTqaaqKuTKXADnbAPh/eJBAV2Z2+Gth2JYrZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="543972759" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 2DC241800025F for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 828DDCBEF98; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 08/18] python3-virtualenv: fix CVE-2026-113723 Date: Thu, 5 Nov 2026 00:59:57 -0800 Message-Id: <20261105090007.351866-9-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131889 From: Hetvi Thakar Backport the upstream prompt-handling fix [1] identified by advisory [3]. Preserve literal prompts across Bash compatibility modes and leave PS1 unchanged in unsupported POSIX shells. Include follow-up [2], identified by advisory [4], so later prompt option changes and child shells cannot execute the stored prompt. This also fixes CVE-2026-115586, a regression in the initial fix. Keep only the required Bash/Zsh security changes and regression tests. [1] https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22 [2] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 [3] https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp [4] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113723.patch | 233 ++++++++ .../python3-virtualenv/CVE-2026-115586.patch | 526 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 2 + 3 files changed, 761 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113723.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-115586.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113723.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113723.patch new file mode 100644 index 0000000000..d38b22a29a --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113723.patch @@ -0,0 +1,233 @@ +From 5f48d711731311428aebfae61d46957762155b22 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 02:35:17 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103099 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30041.1793869209251710244 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=A1/YK71m; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8611; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=3zUjOajfTpz6JCpHRPfgNz+qg9TFbfv0WDhRwfAwajE=; b=A1/YK71mbbIQjG3KoikgzUEST60iO/pbBCQBg3FhJ3wyFLppw2oQN4+d LG87vxAMX7R7axpSRe4eAd3YUtxIisFMj8PqCuNqemfgzBxQKMXez9oWV zS6+zhYJkol+LmMAQdNuF1LaShW1tf+4A3RAfPngTQWtYUu5d81gdhfHt 1SZfN7mmDjalKwV5QKnxl0bBvOOE0lBZbcwZA4b4hVa0dm8+wn7zqmI/U eqSXjv2YEkj3LrCF7jKzlJkkq2CjCMVCBxlyHfCfVLmQ4nuZKuObmaL07 IoODFTn9KNimvZ0i1Via4tXRjJ5KNqLO31iL1XmMfvxLR7Aewzuf+fDzc w==; X-CSE-ConnectionGUID: gihlA6dISyiuCXtIAIXSKg== X-CSE-MsgGUID: PXJoTMBaS76zFQK29vnvHA== X-IPAS-Result: A0BOAgDGROxq/5D/Ja1aHgEBCxIMggULgld1YENJA4RUj1OCIQOLZZI8gX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMECwEYAT0JEwMBAgMCJgICIAsdAQUIEAmDAgGCOgM3AxGhDZsken8zgQGDKQGBVNhMDYJaAQsUAYEKLoVAgn8gAYUDXRgBRIQ5JxsbgXKBFYNpgQWBGkIChTyCagSCIoEMgVqBAwmMDAKBUoZxSIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD0BbgeSL4MRMQw+EwEKIQQTP4EWGScFCZNvj1iCIaAgcQoog3iMJI8+hXwaM4QEgVeSQpJUC5h9glmLMYQKkV9ohGmBaDyBWXAVO4JnCUoZD445g2uFZMh3JjICCQMvAQEHAgcBDAEDC4FokAItgU8BAQ IronPort-Data: A9a23:HpqwHamZjj0TuVDUvkTphkro5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIeDzyGaKuIZGenLdBzaYm0oUsEvpPSmtJiGwBu/npkE1tH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs/7b8nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FYIZ+uJeX21vz u0ZNRs9cjGqptKN473uH4GAhux7RCXqFJkUtnclyXTSCuwrBMicBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZj/7C7pm9AusrnnjczRboUi9rqss6G+Vxwt0uFToGIeOIofRFZ8Pwi50o Er+z0b+PjQwPefAlyiry1H21/HJgwPSDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hguyVsxSL 2QQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cEXhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Oxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:NKGRuamA8ASMW+qRcgKPl8e1m1fpDfIO3DAbv31ZSRFFG/Fw8P re+8jztCWE7Ar5N0tPpTntAsS9qDbnhP1ICOoqTNKftXfd2VdARbsKheCJ/9SjIVydygc378 hdmsZFZOEYdWIbse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAH0++8YTzranGfg2J9dOMEKK Y= X-Talos-CUID: 9a23:eSy/pWwCVd0nq3aYViCvBgUbG8AhWyPR7UzBIlKTOXpIYZylcnyfrfY= X-Talos-MUID: 9a23:VLsOgw/D5pxgwUBSQ+Ds48yQf/9YwaOSLWoEqspYqee9FnYhJTGDrB3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="530338224" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 30430180004BC for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 85F93CBEFAB; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 09/18] python3-virtualenv: fix CVE-2026-113715 Date: Thu, 5 Nov 2026 00:59:58 -0800 Message-Id: <20261105090007.351866-10-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131883 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Reject line boundaries in stdlib venv paths and regenerate pyvenv.cfg from the selected interpreter and options, instead of merging potentially injected configuration read back from the intermediate file. [1] https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113715.patch | 165 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 166 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113715.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113715.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113715.patch new file mode 100644 index 0000000000..8ab16b5d93 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113715.patch @@ -0,0 +1,165 @@ +From b0008a58885ded9227faf8f910c6c402712c750a Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 02:56:02 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 08:59:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103097 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30266.1793869209181269794 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=R+sYfznT; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7675; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=K68hVde4MGi0CY/HOyI6PwT5yhC9Y3B8pWmZBzHwIA4=; b=R+sYfznTpqUp8prIssl75FU21XkaUPY239+6VVQgEdSXxMBWqiGfD1Mn kqEk3ebpxcWl1M1RlVWZTG72YBgri1MwWdGfFmTlrRfFAtH90HxIA9bTO EX9IanSogBBb392NDHxcD0AGyRtmFRgmtHDVx2gwqB0ybPFv6StQYoTrx crMeqP3JV0TsKT/ixcZecckVJ7fLPVe/fXroQZopjvnuPopJd9SttwPAD o1frd8c7DcFcgaV9LVgqg251HdK6tAM3Zt66/ZvssQIMZlFa8/sjJsQ5R SUuCFO+sn8MQDkkSLjsurVhhrY1zSkiV4oULdBYcjbG3r0hJRSFIg7z28 g==; X-CSE-ConnectionGUID: wFk19N9YSuCRtn736GUaTQ== X-CSE-MsgGUID: skrOjAGkRtGDTETzOhBumw== X-IPAS-Result: A0AqAABHRexq/4//Ja1aHAEBAQEBAQcBARIBAQQEAQGBfQYBAQsBglZ1YENJA4RUj1OCIQOBE4pSkjyBfg8BAQEPRA0EAQGEP0YCjh0CJjUIDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDIwQLARgBPQkTAwECAwImAgIgCyMIEAmDAgGCOgM3AxGhDZsken8zgQGDKQGBVNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAYR9JxsbgXKBFYEXgVx2gQWBGkIChTyCagSCIoEMgVqBDIwMAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgnEgMQxRAStUAjsKFB4wL06ScZAWgiGgIHEKKIN4jCSPPoV8GjOEBJQZklQLmH2OCoQKhQeMJIEchGmBagI4gVlwFYMiCUoZD405cg4Lg2CEUMoLJjICCQMvAQEHAgcBDAEDC4FokX4BAQ IronPort-Data: A9a23:N0WSA6vP5u9lEY+Q5yP+bquuR+fnVAdfMUV32f8akzHdYApBsoF/q tZmKW3XOv3YNGemc4ojYYnn9R8O7JHXz4dmSQRtpXs9RHwUgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Es11BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw5ch0WDBop M0jNRs3chbc3LyZ/buHc7w57igjBJGD0II3oHpsy3TdSP0hW52GG/uM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtMYH49tL/Aan3XcyFYoVGcv4I84nPYy0p6172F3N/9J4DWGJsNxBrBz o7A13/6GDYYHfOc8yaq3k6Buv3onQnmXZ1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YfLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:1u1qc6q5HsG73ROerne1sc4aV5oJeYIsimQD101hICG9Ffbo8P xG/c5rsSMc5wx+ZJhNo7290ey7MBDhHP1OkOws1MmZPTUO0VHAROoJ0WKh+UyDJ8SUzIFgPM lbH5SWcOeRMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ANV0mlhD0Jcjpy1SZNNXB7OaY= X-Talos-CUID: 9a23:sV4sBmHr5gZZMBqvqmJ42k1NS+Z0Q0bA503MJRDjV0lUQYGsHAo= X-Talos-MUID: 9a23:aq4CVgXE4iudtejq/CTvnhZgHehr2biBJHwgrYchu+OZMDMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544560241" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 30841180003AC for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 89E62CBEFBF; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 10/18] python3-virtualenv: fix CVE-2026-113720 Date: Thu, 5 Nov 2026 00:59:59 -0800 Message-Id: <20261105090007.351866-11-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131884 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Apply the current umask when copying interpreter and seed-package files instead of inheriting cached permission bits. Do not grant group or world write access to copied files. [1] https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1 [2] https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113720.patch | 156 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 157 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113720.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113720.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113720.patch new file mode 100644 index 0000000000..dad52942aa --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113720.patch @@ -0,0 +1,156 @@ +From 35f0b33562790176dd186d0a3c517af3acc7a0e1 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 02:57:36 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 09:00:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103088 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30041.1793869209251710244 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=bEuNHtfj; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9803; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=pV5r2fu2IX51bbaXWkzsv6S+6dOC3FmxzqJmEdqVulE=; b=bEuNHtfj7b4Hvw0Bs/ZqVh8FYkYOQibKS3dL50dw5X8g8U4+Bjnsc1TD q+yxPOnEdx3WBDVrJIJ/fIPZEz3s9MwhzoXhoqSsWFWsta0HdnTIEj1Zw xD0qq0agRkiUAyoYuq2dIsvri5EXCq59hmZtG5bMN8kRX6u8yjfPoxvwo LDS5vZ69bnELP8viIvnxvzuPfveRbK9ltgtp3L1iV7GehP9XCT1WTvE6Q MRAlzjsKgMH5LhulrpfWof1TumrlfRtl009/HH7TYR/buHXlTrHCfalrR GkhgP21k5VNioEyKgK+Ubh988EJRyr+yfaUOTz07MtX+wd06yO7JNJGRZ g==; X-CSE-ConnectionGUID: ufcTfPObSJ6HQlF4zGuAWw== X-CSE-MsgGUID: U8NJJGXxSXq0OLFoNsvxSQ== X-IPAS-Result: A0AnAADGROxq/4v/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJhFeIG4c4giEDgROKUpI8gX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMECwEYAT0JEwMBAgMCJgICIAsjCBAJgwIBgjoDNwMRoQ2bJHp/M4EBgykBPwJDUNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAUSEOScbG4FygRWBF4FcdoEFgRpCAQGFPIJqBIIigQyBWo0YAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5IvgkRNMRkWLgErUEtREQcEMqNHgiGgIHEKKIN4jCSPPoV8GjOEBIFXpRYLmH2CWYsxhAqRVAsxN4RpgWg8gUcLB3AVgyIJShkPji4LC4NggX+CUYEUyHcmMgIJMgEBBwIHAQwBAwuBaJF+AQE IronPort-Data: A9a23:hRIPuqA+qqZE9BVW/3jiw5YqxClBgxIJ4kV8jS/XYbTApGt00GdRx 2YXX2jUO/qKM2rzLosjbIqzpxsPvMWEx4dhOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9h2YuWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE3vtlME8OGocj2LhXOGVgq e43NRkycUXW7w626OrTpuhEnM8vKozveYgYoHwllWufBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGE+BPjDS0Un1lM/CI4+leShnFH0ciZTrxSeoq9fD237kVcpi+O9aoGPEjCMbfgFuGS6i VLWxFTgWjY+Gtu50iSVyUv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFe2v/S9okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KOpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOb9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:uBKpPqx2zyHzeVrC1+gAKrPwDr1zdoMgy1knxilNoHtuA6ulfq GV7ZAmPHDP5gr5NEtMpTnEAtjifZq+z+8R3WBuB9aftWDd0QPCRr2Kr7GSoQEIcBeQygcy78 tdmtBFaOHYPBxdkdvw5hW+HpILxdmK973tuMLlpk0dKz2Dr8pbnn9E4sHxKDwOeDV7 X-Talos-CUID: 9a23:MVgfCG/oiLGTOQUgU3WVv1MaEfwrSlrX91WOA3a8Jzp7Z6C8dkDFrQ== X-Talos-MUID: 9a23:4Xj1mQ9ybFYxK14BHQf+CDaQf/o4xYaMJ3AdqqUf4+6gGytWICmNtw3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="530338232" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 893D0180007DB for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 8E0F1CBEF6B; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 11/18] python3-virtualenv: fix CVE-2026-113719 Date: Thu, 5 Nov 2026 01:00:00 -0800 Message-Id: <20261105090007.351866-12-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131890 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Restrict seed-package metadata cleanup to entries inside the environment, without deleting the environment itself or directories containing the metadata. Unlink final symlinks without following their targets. [1] https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f [2] https://nvd.nist.gov/vuln/detail/CVE-2026-113719 Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113719.patch | 207 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 208 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113719.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113719.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113719.patch new file mode 100644 index 0000000000..078ae3974f --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113719.patch @@ -0,0 +1,207 @@ +From e3cea6fa10a50fa29cf1fdddd772458fba076d5f Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 03:19:58 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 09:00:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103091 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30269.1793869209791001985 for ; Thu, 05 Nov 2026 01:00:10 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=SDNXJH0c; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=21333; q=dns/txt; s=iport01; t=1793869210; x=1795078810; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=NKpRlc05AfRU3iefiUsQ+fqf4vpyVUkyG1JQqAT6q6c=; b=SDNXJH0cRwvutOF9PLzGcbPWUbW843nZZY0GouLNTBTPg/VzeGJc55gO hzROIm5iBgRtDJdoAxdaBiu0YzmiW3y06vgxJnmnNSSX5d6InKJlvDsX3 6e/TxQppRf/BLHC/UrFiGnR5HndFSd1d1BXsed11cWmNQ3+O683V9hjQJ pwzHbk1PoMmjsut6BdBKTSVppUhrmbHhlfLWWXYM25uGd9LEl/k8vdGUg YTuGba2SiG1e4vKNDDSjxXkb36PnGnxVEgAMMOSS/dQNuaIhNp468MDr7 yaKZWZAhD4BuxXdvXUleBx558H/maAb3DTf5BDlP3Ok1tdTP7c+OzO7Sw g==; X-CSE-ConnectionGUID: EF8jbalgQoyh5H8pQrOMXQ== X-CSE-MsgGUID: vBrZQ+TCTHGnxLvyWjPdrQ== X-IPAS-Result: A0ApAABRROxq/4//Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YBopSYRXiBuHOIIhA4ETggmISYVnjFUUgWoPAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAxoJBAsBGAE9CRMDAQIDAiYCAiALHQEFCBAJgwIBgjoDNwMRBqEAmyR6fzOBAYMpATEFCQJDUNhMDYJaAQsUAYEKLgGFP4J/IAGFA10YAYR9JxsbgXKBFYEXgVx2gQWBGkIBAQEBgSUfg3aCagSCIoEMgVqBA4wVAoFShnFIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPQFuB5Ivgl00ATAMIxsTASkCBCshBAIpEgcDBQ8ENRUIAzIDDTCSPgUUEJAggiGgIHEKKIN4ihSCEI8+hXwaM4QEgVeSQpJUC5h9glmGG4IzgmOECoRtGoxNFhAWN4RpgWg8gUcLB3AVO4JnCUoZD44rDguDYIF/WoF3Q1HIdyYyAgEIMgEBBwIHAQwBAwuBaJAAgX4BAQ IronPort-Data: A9a23:/xS396wpBmKjIuVTmRp6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUAm DZNDWzSOqqNZGWmKtkgaN/j/EsE78fWyIc1SApsqVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj5MscpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJGwYbY8S8+J4OGZf9 aE4eCg0dDemt9vjldpXSsE07igiBNPgMIVavjRryivUSK54B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOHWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OWxbIGLJ4TaGq25mG6Gj Hj0xifFKS06G9qP7SSUzXCUivX2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:RIKcy6heiNzBg36cgRKXWDhrxHBQXvgji2hC6mlwRA09TyX+rb HIoB17726RtN9/Yh8dcLy7VZVoBEmslqKdgrNhWItKIjOGhILAFugLhuHfKn/bak/DH4Vmup uIHZITNDSJNzhHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGsddB8MTMHfiLqWwLzM2fKYEKA == X-Talos-CUID: 9a23:7F2xAG962BrK+iHbRUiVv2M6SsIve3nS9XDBIxKYWX5QUpqweWbFrQ== X-Talos-MUID: 9a23:ddxO3wbB/CxKz+BTqRX2tgghCOxUw4uoGGQTgKoEg8WeDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544365087" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 8865B180003AC for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 93480CBEF6C; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 12/18] python3-virtualenv: fix CVE-2026-113721 Date: Thu, 5 Nov 2026 01:00:01 -0800 Message-Id: <20261105090007.351866-13-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131893 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Replace existing symbolic and hard links before writing generated files, and create the replacement files exclusively. Prepare the stdlib venv executable directory before it writes files. [1] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd [2] https://nvd.nist.gov/vuln/detail/CVE-2026-113721 Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113721.patch | 477 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 478 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113721.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113721.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113721.patch new file mode 100644 index 0000000000..a2c6b7257b --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113721.patch @@ -0,0 +1,477 @@ +From d25f28699eefb1fc34a251e5adf2b5de844c36cd Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 03:25:09 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 09:00:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103098 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30043.1793869213943589263 for ; Thu, 05 Nov 2026 01:00:14 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NH3VnWaJ; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10568; q=dns/txt; s=iport01; t=1793869214; x=1795078814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=++nwjM/0TvJBwhwBxyLyPZOQnYitIFic4A16SMh957k=; b=NH3VnWaJxv+u7N85lPcuC9hkcKWK3Px7iePmDgT7Qg5bKF0YizcMSOWy caXh5Dy7KBwYK4lWDKP5ll1ZPlBD+NW5gD33X36z6mhdsd4JO8uMWRg5/ PYQlBlK//oco+vWhIIoTfUYZAcWkXzWjqTSpnLilsZ/0tngmVJzXjdJYe TJnFGm7rUmdOFVO+wxsi52NkPN4NkaJISkZfZ4dQOA1YnOmv9f+livtjz lI+gJ5OPklYOXode7j6LcRiPUr3am3vVnIUEkQKre2sYelynFbEjhP1zo 1hISsygyN+7t+xEdqzk+n6noebSrtTnqlTxe1eRRtiXjOeTsXxsOT5iS4 g==; X-CSE-ConnectionGUID: ydedooQoR3yj7bqezsL4ww== X-CSE-MsgGUID: kBBWuY50Qu+7xFxBwUlEPg== X-IPAS-Result: A0BtAgBHRexq/47/Ja1aHgEBCxIMggULgld1YENJhFePU4IhA4ETggmISZI8gX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMECwEYAT0JEwMBAgMCJgICIAsdAQUIEAmDAgGCOgM3AxGhDZsken8zgQGDKQE/AkNQ2EwNgloBCxQBgQouhUCCfyABhQNdGAGEfScbG4FygRWBF4FcdoEFgRpCAQGFPIJqBIIigQyBWoEDjBUCgVKGcUiBAhwDWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XL1gbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ9AW4Hki+DEQEwDD4TASsETASBFBUHBDJAkj6QSYIhoCBxCiiDeIwkjz6FfBozhVulFguYfY4KhAqEbxiMTRZdhGmBaDyBRwsHcBU7gmcJShkPjjmDa4F/WoF3U0HIdyYyAgkyAQEHAgcBDAEDC4FokX4BAQ IronPort-Data: A9a23:4NJddKxpAjRiVfO4Zrl6t+dnxyrEfRIJ4+MujC+fZmUNrF6WrkVWm DQcCGzUMq2MYGahKdh3PYyy8hwD6MWGydQwHFdv/FhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj5MscpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJFA6MIEf/d9wOzpf9 6MSMT0fdTTfmP3jldpXSsE07igiBNPgMIVavjRryivUSK57B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOXWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OWxbISMJobUH625mG6bj Ej54lWkWigHd4OP5yqv7U+oq9fAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEr994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:WInuyKwh26kWKR4UO4CWKrPwDr1zdoMgy1knxilNoHtuA6ulfq GV7ZAmPHDP5gr5NEtMpTnEAtjifZq+z+8R3WBuB9aftWDd0QPCRr2Kr7GSoQEIcBeQygcy78 tdmtBFaOHYPBxdkdvw5hW+HpILxdmK973tuMLlpk0dKz2Dr8pbnn9E4sHxKDwOeDV7 X-Talos-CUID: 9a23:SkL4oWyXs4FtYodgMbnGBgUFFs0pdXrky02LMk3nA39kWqaxFUCPrfY= X-Talos-MUID: 9a23:LwA+8Q541fAKYi+rOCOTo/HxxoxryY6RFXFQyawb+JaUGzxaJAqZoQy4F9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544614262" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id 8AA8C180007F9 for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 9736ECBEF6D; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 13/18] python3-virtualenv: fix CVE-2026-113716 Date: Thu, 5 Nov 2026 01:00:02 -0800 Message-Id: <20261105090007.351866-14-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131899 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Replace linked output-directory components before creating interpreter, library and activation files. Reuse ensure_within from the preceding CVE-2026-113721 backport [3]. [1] https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-113716 [3] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113716.patch | 208 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 209 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113716.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113716.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113716.patch new file mode 100644 index 0000000000..e952796dd5 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113716.patch @@ -0,0 +1,208 @@ +From 554d9f9d4f7758f5cf53f993031e29787f1f74c5 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 03:36:11 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 09:00:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103089 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30269.1793869209791001985 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VjXD8cyL; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=15204; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=myaF5RjFauFZwaXBqFJqUad1D714SIA9wcMfcdV2Jlc=; b=VjXD8cyLHpq3HUruJPEenisfczjvjYK4yntcI1hzZwhrfdhqtKngqENC +MXn0za5KdJRLMBa3+joZzUy6LloMW4u19GcALeVWu/geEDY7Sh9X/yNq dcYbV6xeiw50S4EVoYwOqr/KJ2Kl7t+XNH67QHOEzpGtBjTwm2elH2xrS MNRf5/Aevsml8ee0kRp48iQaHR0PCGALrouI4uFbB7HoSsQfy9zxp77wN zxmZ0+kIYVXbkTBCQ9HYFmlFyS+lpLs88J440b9n/YBTpSZvICEqyD+eE 6Q4++OADu7h25eWk3AEddKjtOv+LUpH5t10G6zuQ3Oyq1WFqTQ7/BHPQl A==; X-CSE-ConnectionGUID: nqH1OvrMT2S+90wnyrMvcg== X-CSE-MsgGUID: 4XATFuPWTcStt8f11w1/tA== X-IPAS-Result: A0AnAABRROxq/4v/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJhFeIG4c4giEDi2WSPIF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAEbIgkTAwECAwImAgIgCx0BBQgQCYMCAYI6AzcDEaEGmyR6fzOBAYMpAT8CQ1DYTA2CWgELFAGBCi4BhT+CfyABhQNdGAFEhDknGxuBcoEVg2mBBYEaQgEBgScRhASCagSCIoEMgVoeMjOMFQKBUoZxSIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD0BbgeSL4JkLAEBLDMuAQckBFI7CEcMGC0JQJMtj1qCIaAgcQoog3iMJI8+hXwaM4QEgVeSQpJUC5h9glmLMYQKhQeNQIRpgWg8gUcLB3AVO4JnCUoZD44rDguDYIF/glGBFMh3JjICCTIBAQcCBwEMAQMLgWiQAAEnBIFSAQE IronPort-Data: A9a23:vR219qu+zzpPmMh5QezcmTFruufnVAdfMUV32f8akzHdYApBsoF/q tZmKWyAbvuDYTT3ftgkbYmx/ENQvZLWmIM1GgBl/ik2QyITgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Es11BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw/P9XWEZQ7 9kkcgtOP0icgfOs5aywRbw57igjBJGD0II3oHpsy3TdSP0hW52GG/+M7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwxGYH49tL/Aan3XcyFYoVGcv4I84nPYy0p6172F3N/9J4DWHpsIxhfAz o7A1zjJKy00KeSg9TG+7m78iLaWgnq8RKtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YbLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWja1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:kfguvK7ekXXkNJAWTgPXwOrXdLJyesId70hD6qkXc20zTiX4rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhFQpcUAUdAZ0++/YTzra3FLeA== X-Talos-CUID: 9a23:yUDbXWPj1zinM+5DXjBHrWkKAOUZKEaenS/PJV6iLHhiR+jA X-Talos-MUID: 9a23:F/ybKQW2sDj5q5rq/GPcrQ1MKf9X36+VFFxdn8xfpJDDKQUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544365090" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 8DF36180007FA for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 9AFA0CBEF6F; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 14/18] python3-virtualenv: fix CVE-2026-113722 Date: Thu, 5 Nov 2026 01:00:03 -0800 Message-Id: <20261105090007.351866-15-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131891 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Preserve interpreter paths as literal data in POSIX console launchers for both the app-data and pip seeders, and update the pip launchers' RECORD hashes after rewriting them. Include the RECORD-writing follow-up from [3] so the new rewrite path replaces existing links and uses exclusive creation. The required write_file helper comes from the preceding CVE-2026-113721 fix [4]. Regenerate existing environments to repair their launchers. A later independent pip install or upgrade can replace the corrected launchers; this backport does not modify pip's vendored distlib. [1] https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-113722 [3] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 [4] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd Signed-off-by: Hetvi Thakar --- .../CVE-2026-113722_p1.patch | 262 ++++++++++++++++++ .../CVE-2026-113722_p2.patch | 50 ++++ .../python/python3-virtualenv_21.2.1.bb | 2 + 3 files changed, 314 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p1.patch create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p2.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p1.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p1.patch new file mode 100644 index 0000000000..26a6917c9a --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p1.patch @@ -0,0 +1,262 @@ +From 2519941bed33ee0d3ac99277f67913e439e476a9 Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 03:41:16 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 09:00:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103085 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30041.1793869209251710244 for ; Thu, 05 Nov 2026 01:00:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=OMMcfZta; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6485; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+FCHtilwsSenr9kYBM+fCZxrea5gfsy2JMSGvRvPQzE=; b=OMMcfZtaa4+XSzPYbnHYLOPjha0F8oNiS69HYMijryhBf5x0uB6OOrip iDqnrAzmNeac+rCEoQvoY9ZUfOWinIDCFj5VJcaREk6J5PM1YUh2oS70V FN8D46x5+eih6LBpc94Bo4lTdz6vJ924y/lvepb5b7uz5qlUFDSsxNPoI kRwFGpzVoBdeleeyERpFo4+9qYYEc5LNzMnaXjHF1HWANM7Kwa3FzpmNN wXMkT4G4HULBIHGhUO7s501WX1/9qtWQDdDIv2FFUXrd/bLbW42lfOSy1 NoxsfnD8fVJ99QjZdLtFv88TQ7jniNgTeZGEojlxxGskOGLcTMoRdP4NF Q==; X-CSE-ConnectionGUID: awPkm1t6S6+25pc8lJC04g== X-CSE-MsgGUID: bRQRmVDbRC6+BPuthX/FwA== X-IPAS-Result: A0BNAgDGROxq/47/Ja1aHgEBCxIMggULgld1YENJA4RUj1OCIQOLZZI8FIFqDwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAE9CRMDAQIDAiYCAiALIwgQCYMCAYI6AzcDEaENmyR6fzOBAYMpAT8CQ1DYTA2CWgELFAGBCi6FQIJ/IAGFA10YAUSEOScbG4FygRWDaYEFgRpCAQGBRoN2gmoEgiKBDIFagQMJjAwCgVKGcUiBAhwDWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XL1gbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ9AW4Hki+CZC0xXQErVoFWDqVooCBxCiiDeIwkjz6FfBozhASmbQuYfYJZizGECpEygRWEaYFoPIFHCwdwFYMiCUoZD445g2uBf8xcJjICCQMvAQEHAgcBDAEDC4FokAAsgVIBAQ IronPort-Data: A9a23:ccF2H6jiP9xkuiCbfPp07mTmX161MREKZh0ujC45NGQN5FlHY01je htvD26Faf/YamCgc91yO9jgo0IOucDcy9I1QQA9qypkE39jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvrf8EkHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUR5d50BDhSq 8dGa2pQdhvTg8CdmO60H7wEasQLdKEHPasFsX1miDWcBvE8TNWbHuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg1/5JEWxI9EglH/bz1Rq1uPjaE2+GPUigd21dABNfKIIYTRHpUPxR3wS mTu9V7AOBQkGNal4mTG2Eqxmu//2g3kcddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7V99BJ kg8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmMHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289lte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:c/dcn6FP+QVH/2aLpLqEyseALOsnbusQ8zAXPidKOHtom62j5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:bDFleW13kHx+r//2BLvA6LxfE98dcXiE0CnrfQziVH5iGLm3YgfM9/Yx X-Talos-MUID: 9a23:uTwTjA+E90B12v+3G2iOGkuQf81S2p6rNmwHq75Y+OO8KDBwC3Czkx3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="530338233" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id 9070E1800020E for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 9EE8FCBEF71; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 15/18] python3-virtualenv: fix CVE-2026-113713 Date: Thu, 5 Nov 2026 01:00:04 -0800 Message-Id: <20261105090007.351866-16-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131888 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Always copy seed packages from temporary app-data, including when environment or configuration values enable symlinks. This keeps the environment usable after the temporary cache is removed. Although NVD lists releases from 21.14.8, the project advisory [3] traces the incomplete guard to 20.0.6. The same unguarded constructor is present in 21.2.1, where the upstream regression tests reproduce dangling pip links after temporary-cache cleanup. [1] https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e [2] https://nvd.nist.gov/vuln/detail/CVE-2026-113713 [3] https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c Signed-off-by: Hetvi Thakar --- .../python3-virtualenv/CVE-2026-113713.patch | 113 ++++++++++++++++++ .../python/python3-virtualenv_21.2.1.bb | 1 + 2 files changed, 114 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113713.patch diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113713.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113713.patch new file mode 100644 index 0000000000..8c56a5c228 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113713.patch @@ -0,0 +1,113 @@ +From b81995c3feab9e1edb453c75ffc6616e1a77335e Mon Sep 17 00:00:00 2001 +From: Bernát Gábor +Date: Sat, 17 Oct 2026 10:09:55 -0700 +Subject: [PATCH] From patchwork Thu Nov 5 09:00:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103096 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30043.1793869213943589263 for ; Thu, 05 Nov 2026 01:00:14 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NBfHYeIU; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1473; q=dns/txt; s=iport01; t=1793869214; x=1795078814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=N6jH9e83XM2LeP3T5D1Qwnx0wKqPsJBDTIGGQa+byZU=; b=NBfHYeIU0rPHF2YL4Agbe/2jcKbnY3sFt9GE9OAnpGW2QH5eczHsIMov TeHB4UbTRGh6mkp31fjyLWPF1lLtp6QDJI0JXG7/+U9nZhaa/vafruaGW Zb/lE18/m34kyq7e7Klv94O+MDYEBIWZnZRXRHojax8fonRHhCcDOvRuV AnY2kgUYeWoaDjKz2VfUxoIWZPId4YrBkKkJL1s7kNILBZgOCLNKgfQVA 1PvUiSgIY8uLvDouZ85eVsRDEqQq4jKr62ir006LzHuEzerfF6je83bTN +COrZ4oC5qp7KqlkUJESOFM5uyCLtSFioIxYny/hLwrHYm+gk3sJqUXvm w==; X-CSE-ConnectionGUID: 6ITYC+HsS2aZ6MtUW59pvg== X-CSE-MsgGUID: j4ehkCqrT4GCOVhthC6nAw== X-IPAS-Result: A0D+AgBHRexq/4r/Ja1aglmCV3VgQ0kDlCeCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEwIBAzIBGAE9IDErHQENGYMCAYJ0AxG8MYIsgQGDKQGBVNszAQsUAYE4hUCII3UBhH0nGxuBcoEVg2mBBYFcAoE4dYV5BIIigQyBeIx6iEVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ+bgeSL4MRgQ4sBIIoBZMHkmqhEQoog3iKFIIQlToaM6pxC5h9jgqWUYRpgW8NKIFZcBWDIglKGQ+OOYNrzlsmMgIJAy8BAQcCBw4DC4FokAGBfQEB IronPort-Data: A9a23:J9Mp4KO9LGRXEJTvrR31lsFynXyQoLVcMsEvi/4bfWQNrUog1WZWz DAZUDqFa/iNYzaheY0kPYux809T78WDzt4ySXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2IsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj66tPMHAdfq0Dwbx+Mz9r6 cEndWEVcB/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmAS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2M0PHwsYDUXUrsTIJIinO6rj2PXeDxDo1XTrq0yi4TW5FEtjOa0bICLJrRmQ+1XwkuYp Unf5VilLTo9CtyDyRHb9Fuz07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR63rOe0jma6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MukCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMEBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:Or+nQK18AVXeW297ITcweQqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:qulvuWOLhBGysO5DBghbxWVXOtseKHTvklLMHnDlWH53R+jA X-Talos-MUID: 9a23:o642LgiFu8t6Ep76lHPC1sMpNptl46eFEVoxzbotnPeEKSxbZTG0k2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544614264" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 91466180001D0 for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id A7379CBEF72; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 16/18] python3-virtualenv: Ignore CVE-2026-102937 Date: Thu, 5 Nov 2026 01:00:05 -0800 Message-Id: <20261105090007.351866-17-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131898 From: Hetvi Thakar Analysis: - The advisory [1] describes command injection when Windows cmd.exe executes a generated activate.bat file. - BatchActivator.supports() rejects Linux interpreters, so the Linux CLI does not select this activator. - Limit the status to Linux TARGET_OS values. Leave other platforms, including MinGW SDK builds, unexcluded. - The upstream fix is [2]; no backport is needed for Linux activation. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q [2] https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6 Signed-off-by: Hetvi Thakar --- .../recipes-devtools/python/python3-virtualenv_21.2.1.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb index adeff3939a..1a8091adcc 100644 --- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb @@ -52,3 +52,6 @@ RDEPENDS:${PN} += " \ " CVE_PRODUCT = "virtualenv" + +# The batch activator only supports Windows interpreters. +CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}" From patchwork Thu Nov 5 09:00:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103092 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30270.1793869212002803767 for ; Thu, 05 Nov 2026 01:00:12 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=RasHplzn; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1516; q=dns/txt; s=iport01; t=1793869212; x=1795078812; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Y08J+mfayLUwODAdNMY1pkKkCBrtbYXQM7jNUvuBAxc=; b=RasHplznpK5crSpPpCLfuBzOV4wFfQ/hFe/m2sBb0myVO4+eknL4Q3zG +sWsJ6o/3mtvGlfGzBqEK41WBRIt8J5DIFU41+pG+e0kAHktmlLlrDxGf 8nQdW88JkNyoMocTKKCQjAYuoy3Dv5ghnQLkQ73amXYHynJYvWpOgCjEj ReAN3ebt+USyyOOHWb9fW/kunkuS6/vd9i4GscIehFRA7TjOamdKszQdH bWKPbE8KPTMvbolQV0TZzrCrN6LJbaueRZPfbMuICLO60nKo5CDhVxVGg 7ZgTIRLW0Q0BapwnJNb8jHLScTKaJ/M1of8hIIbPnORoM1WThLpYO9JXt g==; X-CSE-ConnectionGUID: 6yN1YX6UQpi5yT2pjr3jtA== X-CSE-MsgGUID: 1CakMX2zRNepCBatnH7cCg== X-IPAS-Result: A0A5AwBHRexq/43/Ja1aglmCV3VgQ0kDlCeCIQOgHw8BAQEPRA0EAQGEP0YCjh0CJjcGDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBMCAQMyARgBPSAxKx0BDRmDAgGCdAMRvDGCLIEBgykBgVTbMwELFAGBOIVAiCN1AYR9JxsbgXKBFYNpgQWBXAKCLYV5BIIigQyBeIx6iEVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ+bgeSL4MRgQ4sBByCDAWTB5JqoREKKIN4ihSCEJU6GjOqcQuYfY4KllGEaYF+JoFZcBWDIglKGQ+OOYNrzlsmMgIJAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:wIIK+q+tPmseEX44DOdbDrUD0H+TJUtcMsCJ2f8bNWPcYEJGY0x3z mMYD2mAb/jcZDT9fox+OoSwoxwEu5SGnIU3GwBtri5EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpIs/jrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2loLKtBy9YpPFhW9 KEJFGoVbArYhf6flefTpulE3qzPLeHxN48Z/3UlxjbDALN+HdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Qn1lQ/UPrSmM+omnn2cDRCgFmUvqEwpWPUyWSd1ZCwbIGLK4bXHJw9ckCw/ 0nP/EHJWAMgEtGH4hCM7nSM2eTkknauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8hkOgVtZ3L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjRCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r+z8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:hHgNO6wb0HKuOpUjeru5KrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:jwpgX2FnF9pvQtqIqmI55WhNK/B7T0TFzSrBHxWgC3wySqG8HAo= X-Talos-MUID: 9a23:zCQ0aQ6hJUsQfCkr1uFeF2mxxowxyK2tLXBXg68gttGvHyVsPRfChx+4F9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="543692511" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 94365180015C2 for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id AB87DCBEF7A; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 17/18] python3-virtualenv: Ignore CVE-2026-113718 Date: Thu, 5 Nov 2026 01:00:06 -0800 Message-Id: <20261105090007.351866-18-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131894 From: Hetvi Thakar Analysis: - The advisory [1] limits this issue to Xonsh activation in versions 21.3.0 through 21.14.8. - Version 21.2.1 has no Xonsh activator, activate.xsh template or registered entry point. None of the existing backports adds them. - The upstream fix [2] changes the absent Xonsh quoting code, so it is not applicable to this recipe. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf [2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0 Signed-off-by: Hetvi Thakar --- meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb index 1a8091adcc..b554c3a4f8 100644 --- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb @@ -55,3 +55,4 @@ CVE_PRODUCT = "virtualenv" # The batch activator only supports Windows interpreters. CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}" +CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1" From patchwork Thu Nov 5 09:00:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103090 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30267.1793869209536501694 for ; Thu, 05 Nov 2026 01:00:10 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=FYfVxInS; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1785; q=dns/txt; s=iport01; t=1793869209; x=1795078809; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Jw3kyOtRWlv3/5EoYOakCtyLkbdiCM0QHpfYskLHZQo=; b=FYfVxInSbJJfyTDWXJfTPyzVGsKY+deRJBEHCRO2Bcg00JiNMBxfBIW+ tfX9BbaS4woSzlP6uH/KFcIE8pI2USf3kBpxVRSgJJmvcNQ3wCxIBZCKA /1wlONimro3WdyRXVuhDVnheCSoPdxl8vNcrwTXznAfNFcUbP4MwSJmWK UBgUmiPQzeZCOJlX1eeh6kEsbY3QEbfZdes/eWn4fwKz2vUxnBFcPqK1r E1Y/dSMqoDcVH9CMu2RyvQE+QurFOBokta5M3qZEu10g8+7cmuj8L3Uc+ vvYDL6oZZDs8b8MKQLuqxUMSbWiAZzlDDhJhxuDzNqaoFxHag0+rdDRvm w==; X-CSE-ConnectionGUID: NkU8UN7fQ4e5vDtB452Mtw== X-CSE-MsgGUID: VMLK904US72uFRzeCcQs5A== X-IPAS-Result: A0D+AgDGROxq/43/Ja1aglmCV3VgQ0kDlCeCIQOBE50OgX4PAQEBD0QNBAEBhD9GAo4dAiY2Bw4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZATAgEDMgEYAT0gMSsdAQ0ZgwIBgnQDEbwxgiyBAYMpAYFU2zMBCxQBgTiFQIgjdQGEfScbG4FygRWCc3aBBYFcAoEngQaFeQSCIoEMgXiMeohFSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+DEXsTLASCKAWTB5JqoREKKIN4jCSVOhozqnELmH2OCpZRhGmBbw0ogVlwFYMiCUoZD445g2vOWyYyAgkDLwEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:mZkeKaAW9716hBVW/3jiw5YqxClBgxIJ4kV8jS/XYbTApGsr12YBn GYcDDzQPq2PNjHzKY8iaork/U9Uv8fUmNNjOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9h2YuWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE5fZTXHwQYoMhpusqH01S3 6BFchURcUXW7w626OrTpuhEnM8vKozveYgYoHwllW2fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY2BPjDS0Un1lM/CI4+leShnFH0ciZTrxSeoq9fD237kVAqgee3b4WPEjCMbftwumXJ/ j77xDujHz8gJtG0wgOer1v504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFe2v/S9okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KIpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOf9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:cKdf9qC/h50p0m7lHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:YeQhKmwjrPG/25lQd4SDBgUyGf11T1uCwk6MLhKmJXpDFODPbEOPrfY= X-Talos-MUID: 9a23:kT4rHAxtBuoeEaFfhf3eTyrnq46aqJqLLGNcyck7gJbeKAJKKTq2hw2sH6Zyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="543972772" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:00:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 95BF3180015C3 for ; Thu, 5 Nov 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id AF87CCBEF7D; Thu, 5 Nov 2026 01:00:07 -0800 (PST) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 18/18] python3-virtualenv: Ignore CVE-2026-113724 Date: Thu, 5 Nov 2026 01:00:07 -0800 Message-Id: <20261105090007.351866-19-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105090007.351866-1-hthakar@cisco.com> References: <20261105090007.351866-1-hthakar@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:00:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131892 From: Hetvi Thakar Analysis: - The advisory [1] describes a deletion-error callback changing the permissions of a symlink target. - In 21.2.1, safe_delete() always passes ignore_errors=True to shutil.rmtree(), which disables the supplied error callback. This remains true after the existing security backports. - Upstream enabled that callback later in [2]. The chmod recovery path fixed by [3] is therefore unreachable in this recipe. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq [2] https://github.com/pypa/virtualenv/pull/3222 [3] https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440 Signed-off-by: Hetvi Thakar --- meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb index b554c3a4f8..d5f598e576 100644 --- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb @@ -56,3 +56,4 @@ CVE_PRODUCT = "virtualenv" # The batch activator only supports Windows interpreters. CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}" CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1" +CVE_STATUS[CVE-2026-113724] = "not-applicable-config: safe_delete() uses ignore_errors=True, so its chmod error callback is unreachable"