> -----Original Message----- > From: Paul Barker <[email protected]> > Sent: Tuesday, July 28, 2026 1:34 PM > To: Marko, Peter (FT D EU SK BFS1) <[email protected]>; > [email protected] > Subject: Re: [PATCH 4/4] python3-ply: set status for CVE-2025-56005 > > On Tue, 2026-07-21 at 21:00 +0200, Peter Marko wrote: > > From: Peter Marko <[email protected]> > > > > The CVE has tag disputed both in NVD [1] and cvelistV5 [2]. > > > > [1] https://nvd.nist.gov/vuln/detail/CVE-2025-56005 > > [2] https://github.com/CVEProject/cvelistV5/blob/cve_2026-07- > 21_1700Z/cves/2025/56xxx/CVE-2025-56005.json#L63 > > > > Signed-off-by: Peter Marko <[email protected]> > > --- > > meta/recipes-devtools/python/python3-ply_3.11.bb | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb > > b/meta/recipes- > devtools/python/python3-ply_3.11.bb > > index 06393ac4fe..1058697fa3 100644 > > --- a/meta/recipes-devtools/python/python3-ply_3.11.bb > > +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb > > @@ -16,4 +16,6 @@ RDEPENDS:${PN}:class-target += "\ > > > > CVE_PRODUCT = "dabeaz:ply" > > > > +CVE_STATUS[CVE-2025-56005] = "disputed: This CVE was disputed" > > + > > Hi Peter, > > I looked in to this and replied [1] when someone previously sent a > similar patch. I'm not convinced by the discussion linked to by NVD. > > Since the disputed tag is present in the cvelistV5 repository, I wonder > if we can extend sbom-cve-check to detect that tag and set the status > appropriately, instead of having to carry CVE_STATUS annotations in > OE-core.
I have created https://github.com/bootlin/sbom-cve-check/pull/27 Let's see how that goes... Peter > > One solution could be to update ply, pulling from the GitHub repo [2] > instead of PyPI. There is a suggestion that the vulnerable code was > removed from ply as part of the refactoring for v4.0 (which was never > tagged) [3]. > > It's also worth noting that the only consumer of python3-ply in OE-core > is python3-spdx-tools, and there is an open issue [4] for that to either > fork/vendor ply or migrate to something else. > > [1]: https://lore.kernel.org/openembedded- > core/[email protected]/ > [2]: https://github.com/dabeaz/ply > [3]: https://github.com/spdx/tools-python/issues/878#issuecomment-4674695551 > [4]: https://github.com/spdx/tools-python/issues/878 > > Best regards, > > -- > Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242201): https://lists.openembedded.org/g/openembedded-core/message/242201 Mute This Topic: https://lists.openembedded.org/mt/120382473/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
