Re: [wrynose][PATCH] python3-pip: Fix CVE-2026-8643

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 1757 bytes --]

On Wed, Sep 2, 2026 at 02:04 PM, Yoann Congal wrote:

> 
> On Mon Aug 17, 2026 at 6:42 AM CEST, Hetvi Thakar -X (hthakar - E
> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> 
>> From: Hetvi Thakar <hthakar@cisco.com>
>> 
>> This patch backports the upstream fix for CVE-2026-8643. The
>> commit is included in pip 26.1.2 and referenced in [1]. The public
>> CVE advisory is referenced in [2].
>> 
>> The selected commit is self-contained. Later upstream commits refactor
>> the validation to use a shared containment helper and update release
>> notes; they are not prerequisites for this fix.
>> 
>> [1] https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb
>> 
>> [2] https://github.com/advisories/GHSA-wf93-45jw-7689
>> 
>> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
>> ---
>> .../python/python3-pip/CVE-2026-8643.patch | 80 +++++++++++++++++++
>> .../python/python3-pip_26.0.1.bb | 4 +-
>> 2 files changed, 83 insertions(+), 1 deletion(-)
>> create mode 100644
>> meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch
> 
> Hello,
> 
> Thanks for the patch.
> 
> The scarthgap fix for this CVE[0] has 2 regression patches in addition to
> the CVE fix itself. Don't we need those for wrynose as well?
> 
> I'll hold CVE-2026-8643 patches (scarthgap/wrynose) in the meantime.
> 
> [0]: https://patchwork.yoctoproject.org/project/oe-core/patch/20260817044429.62418-1-hthakar@cisco.com/
> 
> 
> Regards,
> --
> Yoann Congal
> Smile ECS

Hi Yoann,

Thanks for pointing this out. You’re right the Wrynose backport should include the two upstream regression fixes as well.
I’ll update Wrynose patch and sent v2 patch accordingly.

Regards,
Hetvi

[-- Attachment #2: Type: text/html, Size: 2274 bytes --]