diff options
| author | Soumya Sambu <soumya.sambu@windriver.com> | 2024-09-03 12:50:49 +0000 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2024-09-09 06:08:10 -0700 |
| commit | 31ea437bf7785201dd4fb04622ec97feba110c93 (patch) | |
| tree | ff1cb0c80f8deb9d7219d83217b3eb980254f948 /meta/recipes-devtools/python/python3/crosspythonpath.patch | |
| parent | 9541ad965035b28697b8df400d7b9bddc4d2519a (diff) | |
| download | poky-31ea437bf7785201dd4fb04622ec97feba110c93.tar.gz | |
python3: Fix CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module. When iterating over names of entries in a zip archive (for example,
methodsof "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()",
etc) the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-8088
Upstream-Patch:
https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec
(From OE-Core rev: 2d98276ba70ed6c44afecd42a7352f1b3030438f)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-devtools/python/python3/crosspythonpath.patch')
0 files changed, 0 insertions, 0 deletions