On Tue, 2026-07-21 at 21:00 +0200, Peter Marko wrote: > From: Peter Marko <[email protected]> > > The CVE has tag disputed both in NVD [1] and cvelistV5 [2]. > > [1] https://nvd.nist.gov/vuln/detail/CVE-2025-56005 > [2] > https://github.com/CVEProject/cvelistV5/blob/cve_2026-07-21_1700Z/cves/2025/56xxx/CVE-2025-56005.json#L63 > > Signed-off-by: Peter Marko <[email protected]> > --- > meta/recipes-devtools/python/python3-ply_3.11.bb | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb > b/meta/recipes-devtools/python/python3-ply_3.11.bb > index 06393ac4fe..1058697fa3 100644 > --- a/meta/recipes-devtools/python/python3-ply_3.11.bb > +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb > @@ -16,4 +16,6 @@ RDEPENDS:${PN}:class-target += "\ > > CVE_PRODUCT = "dabeaz:ply" > > +CVE_STATUS[CVE-2025-56005] = "disputed: This CVE was disputed" > +
Hi Peter, I looked in to this and replied [1] when someone previously sent a similar patch. I'm not convinced by the discussion linked to by NVD. Since the disputed tag is present in the cvelistV5 repository, I wonder if we can extend sbom-cve-check to detect that tag and set the status appropriately, instead of having to carry CVE_STATUS annotations in OE-core. One solution could be to update ply, pulling from the GitHub repo [2] instead of PyPI. There is a suggestion that the vulnerable code was removed from ply as part of the refactoring for v4.0 (which was never tagged) [3]. It's also worth noting that the only consumer of python3-ply in OE-core is python3-spdx-tools, and there is an open issue [4] for that to either fork/vendor ply or migrate to something else. [1]: https://lore.kernel.org/openembedded-core/[email protected]/ [2]: https://github.com/dabeaz/ply [3]: https://github.com/spdx/tools-python/issues/878#issuecomment-4674695551 [4]: https://github.com/spdx/tools-python/issues/878 Best regards, -- Paul Barker
signature.asc
Description: This is a digitally signed message part
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242184): https://lists.openembedded.org/g/openembedded-core/message/242184 Mute This Topic: https://lists.openembedded.org/mt/120382473/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
