On Thursday, July 9, 2026 at 11:05 PM, Yoann Congal wrote: > On Mon Jul 6, 2026 at 1:00 PM CEST, Benjamin Robin via lists.openembedded.org > wrote: > > When using the "tarfile" module with a file opened in "streaming mode" > > (mode="r|") the tarfile module did not properly handle EOF, making archive > > parsing take exponentially longer. > > > > Signed-off-by: Benjamin Robin (Schneider Electric) > > <[email protected]> > > --- > > .../python/python3/CVE-2026-11972.patch | 59 > > ++++++++++++++++++++++ > > meta/recipes-devtools/python/python3_3.14.6.bb | 1 + > > 2 files changed, 60 insertions(+) > > > > diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch > > b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch > > new file mode 100644 > > index 000000000000..7dc9c6697112 > > --- /dev/null > > +++ b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch > > @@ -0,0 +1,59 @@ > > +From 2d256d4bfd654bdcaf2d96733799be73b8ff8f69 Mon Sep 17 00:00:00 2001 > > +From: Petr Viktorin <[email protected]> > > +Date: Tue, 23 Jun 2026 15:13:30 +0200 > > +Subject: [PATCH 2/2] gh-151981: Make tarfile._Stream.seek break at EOF > > + (GH-151982) > > + > > +CVE: CVE-2026-11972 > > +Upstream-Status: Backport > > [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896] > > Hello, > > Upstream patch had a "Co-authored-by: Stan Ulbrych <[email protected]>" > that I readded on my branch. Can you send a patch to master to re-add it there > too?
I sent a patch to fix that, same for "glib-2.0: fix CVE-2026-58016". I am sorry, this was done due to a lack of knowledge regarding how to handle it. To summarize, do I just need to include these lines at the end of the commit message in the patch, without altering anything else? - CVE: - Upstream-Status: - My Signed-off-by In Yocto, what is the rule when backporting a commit which is in master, for example to Wrynose, regarding the Signed-off-by? I just need to add mine without touching anything else? Is there any difference if I am the author of the commit in master or not? Thanks -- Benjamin Robin, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240615): https://lists.openembedded.org/g/openembedded-core/message/240615 Mute This Topic: https://lists.openembedded.org/mt/120137537/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
