Re: [OE-core][scarthgap][PATCH] python3: fix CVE-2026-15308

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Jul 23, 2026 at 3:43 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> Backport the upstream CPython fix for CVE-2026-15308 to Python
> 3.12.13. The issue is a CPU denial of service in incremental
> html.parser.HTMLParser parsing, where repeated feed() calls with
> unterminated markup could repeatedly rescan and concatenate a growing
> buffer.
>
> The embedded patch is based on the Python 3.13 backport in [1]. The
> public CVE advisory is referenced in [2]. Scarthgap-specific source
> differences are recorded under Backport Changes in the embedded patch
> header.
>
> [1] https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-15308
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> ---
>  .../python/python3/CVE-2026-15308.patch       | 116 ++++++++++++++++++
>  .../python/python3_3.12.13.bb                 |   1 +
>  2 files changed, 117 insertions(+)
>  create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-15308.patch

Hello,

I plan to replace this patch by the 3.12.14 upgrade I received in the
meantime:
https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14
https://patchwork.yoctoproject.org/project/oe-core/patch/20260822172544.1927400-1-peter.marko@siemens.com/

Regards,
-- 
Yoann Congal
Smile ECS