From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A398C79F9E for ; Mon, 7 Sep 2026 09:26:34 +0000 (UTC) Subject: Re: [scarthgap][PATCH] python3-click: fix CVE-2026-7246 To: openembedded-core@lists.openembedded.org From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.83) X-Originating-Platform: Windows Edge 152 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Mon, 07 Sep 2026 02:26:32 -0700 References: <20260821163206.882233-1-dkelaiya@cisco.com> In-Reply-To: Message-ID: <199240.1788773192713715859@lists.openembedded.org> Content-Type: multipart/alternative; boundary="4D6Fnjsn2E4opAndR1bZ" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 07 Sep 2026 09:26:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245242 --4D6Fnjsn2E4opAndR1bZ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Sun, Sep 6, 2026 at 04:46 AM, Yoann Congal wrote: >=20 > On Fri Aug 21, 2026 at 6:32 PM CEST, Darsh Kelaiya -X (dkelaiya - E > INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: >=20 >> From: Darsh Kelaiya >>=20 >> This patch applies the upstream fix for CVE-2026-7246 as referenced >> in [2], using the upstream commit identified in [1]. >>=20 >> The backport also adapts editor regression tests from the upstream >> test and documentation follow-up identified in [3]. This follow-up >> does not contain an additional production security fix. >>=20 >> [1] https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494= ebee4aef8f42 >>=20 >> [2] https://github.com/tsigouris007/security-advisories/security/advisor= ies/GHSA-47fr-3ffg-hgmw >>=20 >> [3] https://github.com/pallets/click/commit/b55294797ef32e22eb41e7d9657e= db8faefa4976 >>=20 >>=20 >> Signed-off-by: Darsh Kelaiya >> --- >> .../python/python3-click/CVE-2026-7246.patch | 245 ++++++++++++++++++ >> .../python/python3-click_8.1.7.bb | 5 +- >> 2 files changed, 249 insertions(+), 1 deletion(-) >> create mode 100644 >> meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >>=20 >> diff --git >> a/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >> b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >> new file mode 100644 >> index 0000000000..47ee1a551f >> --- /dev/null >> +++ b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >> @@ -0,0 +1,245 @@ >> +From cb30f575b1a251e8698909bca2a443d41dad1824 Mon Sep 17 00:00:00 2001 >> +From: Kevin Deldycke >> +Date: Wed, 4 Mar 2026 14:51:58 +0400 >> +Subject: [PATCH] Document and fix command string sanitizing with >> `shlex.split` >> + >> +Removes last use of `shell=3DTrue` use for command invokation for >> defense-in-depth. >> +Refs: #1026, #1477 and #2775 >> + >> +CVE: CVE-2026-7246 >> +Upstream-Status: Backport [ https://github.com/pallets/click/commit/b96= c2601af4e01341b4d2c0db494ebee4aef8f42 >> ] >> + >> +Backport Changes: >> +- Click 8.1.7 uses Editor.edit_file(filename), not the newer >> + Editor.edit_files(filenames) API. Apply the argv-list change >> + to one filename without adding the multi-file API. >> +- Adapt editor tests from b96c2601 and follow-up b5529479 to >=20 > Hello, >=20 > This commit has both b96c2601 and b5529479 squashed. Please keep > upstream backport patches split. >=20 > Can you send a v2 with as the CVE fix (b96c2601) and its followup > (b5529479)? >=20 > Thanks! >=20 > -- > Yoann Congal > Smile ECS Hi Yoann, While preparing v2, I noticed that NVD now marks CVE-2026-7246 as disputed = and states that the Pallets Click project does not consider it a valid vuln= erability: https://nvd.nist.gov/vuln/detail/CVE-2026-7246 However, the published advisory identifies upstream commit b96c2601 as the = fix: https://github.com/tsigouris007/security-advisories/security/advisories/GHS= A-47fr-3ffg-hgmw Upstream describes the removal of shell=3DTrue as defense-in-depth, so I wa= nted to confirm the preferred handling. Should I replace the backport patch= es with a status entry such as: CVE_STATUS[CVE-2026-7246] =3D "disputed: Pallets Click does not consider th= is a valid vulnerability" Or should I continue with the split v2 backport patches as hardening? Thanks, Darsh --4D6Fnjsn2E4opAndR1bZ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
On Sun, Sep 6, 2026 at 04:46 AM, Yoann Congal wrote:
On Fri Aug 21, 2026 at 6:32 PM CEST, Darsh Kelaiya -X (dkelaiya= - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:<= br />
From: Darsh Kelaiya <dkelaiya@cisco.com>

This = patch applies the upstream fix for CVE-2026-7246 as referenced
in [2],= using the upstream commit identified in [1].

The backport also = adapts editor regression tests from the upstream
test and documentatio= n follow-up identified in [3]. This follow-up
does not contain an addi= tional production security fix.

[1] https://github.com/pallets/click/commit/b96c2601af= 4e01341b4d2c0db494ebee4aef8f42
[2] https://github.com/tsigouris007/security-a= dvisories/security/advisories/GHSA-47fr-3ffg-hgmw
[3] https://github.com/pallets/click/c= ommit/b55294797ef32e22eb41e7d9657edb8faefa4976

Signed-off-by= : Darsh Kelaiya <dkelaiya@cisco.com>
---
.../python/python3= -click/CVE-2026-7246.patch | 245 ++++++++++++++++++
.../python/python3= -click_8.1.7.bb | 5 +-
2 files changed, 249 insertions(+), 1 deletion(= -)
create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2= 026-7246.patch

diff --git a/meta/recipes-devtools/python/python3= -click/CVE-2026-7246.patch b/meta/recipes-devtools/python/python3-click/CVE= -2026-7246.patch
new file mode 100644
index 0000000000..47ee1a551= f
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-click/= CVE-2026-7246.patch
@@ -0,0 +1,245 @@
+From cb30f575b1a251e869890= 9bca2a443d41dad1824 Mon Sep 17 00:00:00 2001
+From: Kevin Deldycke <= ;kevin@deldycke.com>
+Date: Wed, 4 Mar 2026 14:51:58 +0400
+Su= bject: [PATCH] Document and fix command string sanitizing with `shlex.split= `
+
+Removes last use of `shell=3DTrue` use for command invokatio= n for defense-in-depth.
+Refs: #1026, #1477 and #2775
+
+CVE= : CVE-2026-7246
+Upstream-Status: Backport [https://github.com/pallets/click/commit/b96c26= 01af4e01341b4d2c0db494ebee4aef8f42]
+
+Backport Changes:
+- Click 8.1.7 uses Editor.edit_file(filename), not the newer
+ Edito= r.edit_files(filenames) API. Apply the argv-list change
+ to one filen= ame without adding the multi-file API.
+- Adapt editor tests from b96c= 2601 and follow-up b5529479 to
Hello,

This commit has both b96c2601 and b5529479 squashed. Plea= se keep
upstream backport patches split.

Can you send a v2 = with as the CVE fix (b96c2601) and its followup
(b5529479)?

Thanks!

--
Yoann Congal
Smile ECS
Hi Yoann,

While preparing v2, I noticed that NVD now marks CVE-2= 026-7246 as disputed and states that the Pallets Click project does not con= sider it a valid vulnerability:

https://nvd.n= ist.gov/vuln/detail/CVE-2026-7246

However, the published adv= isory identifies upstream commit b96c2601 as the fix:

https://github.com/ts= igouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw<= br />
Upstream describes the removal of shell=3DTrue as defense-in-dep= th, so I wanted to confirm the preferred handling. Should I replace the bac= kport patches with a status entry such as:

CVE_STATUS[CVE-2026-7= 246] =3D "disputed: Pallets Click does not consider this a valid vulnerabil= ity"

Or should I continue with the split v2 backport patches as = hardening?

Thanks,
Darsh
--4D6Fnjsn2E4opAndR1bZ--