linux/poky.git/meta/recipes-devtools/python, branch scarthgap-5.0.16

python-urllib3: Backport fix for CVE-2026-21441

2026-02-16T09:52:35+00:00

Include the patch linked in the NVD report : https://nvd.nist.gov/vuln/detail/CVE-2026-21441 (From OE-Core rev: bf85dff7bf4340a691df3da21f04a651fff11a17) Signed-off-by: Adarsh Jagadish Kamini Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: patch CVE-2025-13837

2026-02-16T09:52:35+00:00

Pick patch from 3.12 branch per NVD report. (From OE-Core rev: 37936e0e93ab5c236d8cc8e709ba1faf8380577c) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: patch CVE-2025-13836

2026-01-26T09:45:38+00:00

Pick commit from branch 3.12 mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-13836 (From OE-Core rev: 05aa143fb5f63de0f53e916daa3392917da46131) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: patch CVE-2025-12084

2026-01-26T09:45:38+00:00

Pick patch from 3.12 branch according to [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-12084 (From OE-Core rev: c3ed0dfa3a7b8716008968b0d7f80885b2f61a84) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3-urllib3: fix CVE-2025-66418 CVE-2025-66471

2025-12-31T15:49:31+00:00

References: https://nvd.nist.gov/vuln/detail/CVE-2025-66418 https://nvd.nist.gov/vuln/detail/CVE-2025-66471 (From OE-Core rev: d9f52c5f86bcc4716e384fe5c01c03d386d60446) Signed-off-by: Jiaying Song Signed-off-by: Steve Sakoman

python3: fix CVE-2025-6075

2025-12-05T15:13:42+00:00

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742 (From OE-Core rev: 5313fa5236cd3943f90804de2af81358971894bc) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

python3: upgrade 3.12.11 -> 3.12.12

2025-10-24T13:23:40+00:00

Drop upstreamed patch and refresh remaining patches. Release information: * https://www.python.org/downloads/release/python-31212/ * The release you're looking at is Python 3.12.12, a security bugfix release for the legacy 3.12 series. Handles CVE-2025-59375. (From OE-Core rev: f1234b8451ba843b5f9ec1d2066c21f54d6bc3b8) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3-xmltodict: fix CVE-2025-9375

2025-10-24T13:23:39+00:00

Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9375 https://security-tracker.debian.org/tracker/CVE-2025-9375 https://git.launchpad.net/ubuntu/+source/python-xmltodict/commit/?id=e8110a20e00d80db31d5fc9f8f4577328385d6b6 Upstream-patch: https://github.com/martinblech/xmltodict/commit/ecd456ab88d379514b116ef9293318b74e5ed3ee https://github.com/martinblech/xmltodict/commit/f98c90f071228ed73df997807298e1df4f790c33 (From OE-Core rev: 30624cce634cade0b030aa71a03be754abbf3da9) Signed-off-by: Saravanan Signed-off-by: Steve Sakoman

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-22T20:17:52+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4cf131ebd157b79226533b5a5074691dd0e1a4ab) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman

python3: patch CVE-2025-8194

2025-08-20T14:37:19+00:00

Pick commit from 3.12 branch mentioned in NVD report. https://nvd.nist.gov/vuln/detail/CVE-2025-8194 (From OE-Core rev: 34f1b4877a0601d2057453c159c76a54754f229a) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman