Hello, On Mon Jul 6, 2026 at 1:01 PM CEST, Benjamin Robin via lists.openembedded.org wrote: > bz2.BZ2Decompressor objects could be reused after a decompression error. > If an application caught the resulting OSError and retried with the same > decompressor, crafted input could cause the decompressor to resume from an > invalid internal state and perform out-of-bounds writes to a stack buffer. > This could crash the process when processing untrusted data. > > Signed-off-by: Benjamin Robin (Schneider Electric) > <[email protected]>
More than a description of the vulnerability, what we need in the commit message is a justification for the patch: i.e. why this is the patch we should take to fix this CVE? In this case, this is trivial, this is a patch referenced from the NVD page. But better state it. > --- > .../python/python3/CVE-2026-9669.patch | 97 > ++++++++++++++++++++++ > meta/recipes-devtools/python/python3_3.12.13.bb | 1 + > 2 files changed, 98 insertions(+) > > diff --git a/meta/recipes-devtools/python/python3/CVE-2026-9669.patch > b/meta/recipes-devtools/python/python3/CVE-2026-9669.patch > new file mode 100644 > index 000000000000..933d6f410ee1 > --- /dev/null > +++ b/meta/recipes-devtools/python/python3/CVE-2026-9669.patch > @@ -0,0 +1,97 @@ > +From 5b412e1f7bdb3e0667b2bc8b216ad216d59d8373 Mon Sep 17 00:00:00 2001 > +From: "Miss Islington (bot)" > + <[email protected]> > +Date: Mon, 8 Jun 2026 11:55:32 +0200 > +Subject: [PATCH] gh-150599: Prevent bz2 decompressor reuse after errors > + (GH-150600) > + > +CVE: CVE-2026-9669 > +Upstream-Status: Backport > [https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e] > + > +Signed-off-by: Benjamin Robin <[email protected]> The upstream patch has author="Stan Ulbrych <[email protected]>". Please send a v2 with those 2 points fixed. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241302): https://lists.openembedded.org/g/openembedded-core/message/241302 Mute This Topic: https://lists.openembedded.org/mt/120137556/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
