From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51B47C61DD3 for ; Thu, 3 Sep 2026 06:43:18 +0000 (UTC) Subject: Re: [wrynose][PATCH] python3-pip: Fix CVE-2026-8643 To: openembedded-core@lists.openembedded.org From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.21) X-Originating-Platform: Windows Edge 152 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Wed, 02 Sep 2026 23:43:10 -0700 References: <20260817044231.127184-1-hthakar@cisco.com> In-Reply-To: Message-ID: <3112418.1788417790407544509@lists.openembedded.org> Content-Type: multipart/alternative; boundary="lvuzMrbH057zVD35ucow" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 03 Sep 2026 06:43:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245005 --lvuzMrbH057zVD35ucow Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Wed, Sep 2, 2026 at 02:04 PM, Yoann Congal wrote: >=20 > On Mon Aug 17, 2026 at 6:42 AM CEST, Hetvi Thakar -X (hthakar - E > INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: >=20 >> From: Hetvi Thakar >>=20 >> This patch backports the upstream fix for CVE-2026-8643. The >> commit is included in pip 26.1.2 and referenced in [1]. The public >> CVE advisory is referenced in [2]. >>=20 >> The selected commit is self-contained. Later upstream commits refactor >> the validation to use a shared containment helper and update release >> notes; they are not prerequisites for this fix. >>=20 >> [1] https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b26= 5158dfb >>=20 >> [2] https://github.com/advisories/GHSA-wf93-45jw-7689 >>=20 >> Signed-off-by: Hetvi Thakar >> --- >> .../python/python3-pip/CVE-2026-8643.patch | 80 +++++++++++++++++++ >> .../python/python3-pip_26.0.1.bb | 4 +- >> 2 files changed, 83 insertions(+), 1 deletion(-) >> create mode 100644 >> meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch >=20 > Hello, >=20 > Thanks for the patch. >=20 > The scarthgap fix for this CVE[0] has 2 regression patches in addition to > the CVE fix itself. Don't we need those for wrynose as well? >=20 > I'll hold CVE-2026-8643 patches (scarthgap/wrynose) in the meantime. >=20 > [0]: https://patchwork.yoctoproject.org/project/oe-core/patch/20260817044= 429.62418-1-hthakar@cisco.com/ >=20 >=20 > Regards, > -- > Yoann Congal > Smile ECS Hi Yoann, Thanks for pointing this out. You=E2=80=99re right the Wrynose backport sho= uld include the two upstream regression fixes as well. I=E2=80=99ll update Wrynose patch and sent v2 patch accordingly. Regards, Hetvi --lvuzMrbH057zVD35ucow Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
On Wed, Sep 2, 2026 at 02:04 PM, Yoann Congal wrote:
On Mon Aug 17, 2026 at 6:42 AM CEST, Hetvi Thakar -X (hthakar -= E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
From: Hetvi Thakar <hthakar@cisco.com>

This pa= tch backports the upstream fix for CVE-2026-8643. The
commit is includ= ed in pip 26.1.2 and referenced in [1]. The public
CVE advisory is ref= erenced in [2].

The selected commit is self-contained. Later ups= tream commits refactor
the validation to use a shared containment help= er and update release
notes; they are not prerequisites for this fix.<= br />
[1] https://gith= ub.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb
[2= ] https://github.com/advisories/GHSA-wf93-45jw-7689

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
--= -
.../python/python3-pip/CVE-2026-8643.patch | 80 +++++++++++++++++++<= br />.../python/python3-pip_26.0.1.bb | 4 +-
2 files changed, 83 inser= tions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/pytho= n/python3-pip/CVE-2026-8643.patch
Hello,

Thanks for the patch.

The scarthgap fix for th= is CVE[0] has 2 regression patches in addition to
the CVE fix itself. = Don't we need those for wrynose as well?

I'll hold CVE-2026-8643= patches (scarthgap/wrynose) in the meantime.

[0]: https://patchwork= .yoctoproject.org/project/oe-core/patch/20260817044429.62418-1-hthakar@cisc= o.com/

Regards,
--
Yoann Congal
Smile ECS
Hi Yoann,

Thanks for pointing this out. You’re right= the Wrynose backport should include the two upstream regression fixes as w= ell.
I’ll update Wrynose patch and sent v2 patch accordingly.
 Regards,
 Hetvi
--lvuzMrbH057zVD35ucow--