Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=kirkstone-4.0.25 2024-12-02T14:23:20+00:00 2024-12-02T14:23:20+00:00 Jiaying Song jiaying.song.cn@windriver.com 2024-11-25T07:46:11+00:00 urn:sha1:53801adf752419eb84504f007af4fdbe0cd43ce1 When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial. References: https://nvd.nist.gov/vuln/detail/CVE-2023-5752 Upstream patches: https://github.com/pypa/pip/pull/12306/commits/389cb799d0da9a840749fcd14878928467ed49b4 (From OE-Core rev: 862c0338fba06077a26c775b49f993eac63762c9) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>