On Mon Jul 6, 2026 at 1:01 PM CEST, Benjamin Robin via lists.openembedded.org wrote: > When using the "tarfile" module with a file opened in "streaming mode" > (mode="r|") the tarfile module did not properly handle EOF, making archive > parsing take exponentially longer. > > Signed-off-by: Benjamin Robin (Schneider Electric) > <[email protected]> > --- > .../python/python3/CVE-2026-11972.patch | 58 > ++++++++++++++++++++++ > meta/recipes-devtools/python/python3_3.12.13.bb | 1 + > 2 files changed, 59 insertions(+) > > diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch > b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch > new file mode 100644 > index 000000000000..0752ba372dcc > --- /dev/null > +++ b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch > @@ -0,0 +1,58 @@ > +From a83ebdb495a9cbd28a03675acdeda235fade90b3 Mon Sep 17 00:00:00 2001 > +From: Petr Viktorin <[email protected]> > +Date: Tue, 23 Jun 2026 15:13:30 +0200 > +Subject: [PATCH] gh-151981: Make tarfile._Stream.seek break at EOF > (GH-151982) > + > +CVE: CVE-2026-11972 > +Upstream-Status: Backport > [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896] > + > +Signed-off-by: Benjamin Robin <[email protected]>
Hello, Like we discussed for wrynose, this patch lacks the co-authored-by it has upstream. Can you send a v2 with this fixed? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241301): https://lists.openembedded.org/g/openembedded-core/message/241301 Mute This Topic: https://lists.openembedded.org/mt/120137555/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
