Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-5.0.14 2025-06-11T15:17:34+00:00 2025-06-11T15:17:34+00:00 Vijay Anusuri vanusuri@mvista.com 2025-06-05T07:14:10+00:00 urn:sha1:6ba8b8a487f61d511904dd7263a58a794d3d3bb5 Upstream-Status: Backport from https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a & https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b (From OE-Core rev: 9769cd99c32faf7d95a7cab07b8550b438ccaf0c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-10-30T15:30:00+00:00 Shunsuke Tokumoto s-tokumoto@fujitsu.com 2024-09-26T11:01:03+00:00 urn:sha1:8dae11e0b5294a07b320ab8987eff6a598546374 Since there are vulnerabilities that cannot be detected by the existing CVE_PRODUCT, add "python:setuptools" to CVE_PRODUCT. https://nvd.nist.gov/vuln/detail/CVE-2013-1633 https://nvd.nist.gov/vuln/detail/CVE-2022-40897 (From OE-Core rev: 85b61bf9cefc024faefa083c37ce88ba9c7355e1) Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aa1c8d97efc6640a1cffa2459d9b20ad1f7309b0) Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-09-09T13:08:10+00:00 Soumya Sambu soumya.sambu@windriver.com 2024-09-01T17:17:26+00:00 urn:sha1:67aa29393db111a67b64f3394a0c490c33946c02 A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. References: https://nvd.nist.gov/vuln/detail/CVE-2024-6345 Upstream-patch: https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0 (From OE-Core rev: 468c5a4e12b9d38768b00151c55fd27b2b504f3b) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-07-09T13:02:55+00:00 Guðni Már Gilbert gudni.m.g@gmail.com 2024-07-02T22:31:29+00:00 urn:sha1:b0ab1c80fc5787d4eb43a443afe0979d56c930bc 2to3 module was dropped as a dependency in setuptools 58.0 (From OE-Core rev: 0d5cd1d867a826cf83fcaee3e8390b9defec47d1) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-03-07T17:25:02+00:00 Alexander Kanavin alex.kanavin@gmail.com 2024-03-06T15:42:22+00:00 urn:sha1:51460be41f5c9a047a6da3ebf1dcaa7d331352fe (From OE-Core rev: a953d88346d4ee93b5669c079586ae27d71552dc) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>