[Buildroot] [PATCH] package/python3: drop CVE-2022-45061 from IGNORE_CVES

[Buildroot] [PATCH] package/python3: drop CVE-2022-45061 from IGNORE_CVES

[Daniel Lang]

CVE-2022-45061 affects python <= 3.7.15, 3.8.0 through 3.8.15,
3.9.0 through 3.9.15, 3.10.0 through 3.10.8
The mentioned patch was removed in c38de813 when bumping to 3.11.1.

Signed-off-by: Daniel Lang <dalang@gmx.at>
---
 package/python3/python3.mk | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/package/python3/python3.mk b/package/python3/python3.mk
index 5f8fa5b58d..cfe5e1ee6e 100644
--- a/package/python3/python3.mk
+++ b/package/python3/python3.mk
@@ -13,9 +13,6 @@ PYTHON3_LICENSE_FILES = LICENSE
 PYTHON3_CPE_ID_VENDOR = python
 PYTHON3_CPE_ID_PRODUCT = python
 
-# 0033-3.11-gh-98433-Fix-quadratic-time-idna-decoding.-GH-9.patch
-PYTHON3_IGNORE_CVES += CVE-2022-45061
-
 # This host Python is installed in $(HOST_DIR), as it is needed when
 # cross-compiling third-party Python modules.
 
-- 
2.42.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/python3: drop CVE-2022-45061 from IGNORE_CVES

[Thomas Petazzoni via buildroot]

On Thu, 21 Sep 2023 06:11:51 +0200
Daniel Lang <dalang@gmx.at> wrote:

> CVE-2022-45061 affects python <= 3.7.15, 3.8.0 through 3.8.15,
> 3.9.0 through 3.9.15, 3.10.0 through 3.10.8
> The mentioned patch was removed in c38de813 when bumping to 3.11.1.
> 
> Signed-off-by: Daniel Lang <dalang@gmx.at>
> ---
>  package/python3/python3.mk | 3 ---
>  1 file changed, 3 deletions(-)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/python3: drop CVE-2022-45061 from IGNORE_CVES

[Peter Korsgaard]

>>>>> "Daniel" == Daniel Lang <dalang@gmx.at> writes:

 > CVE-2022-45061 affects python <= 3.7.15, 3.8.0 through 3.8.15,
 > 3.9.0 through 3.9.15, 3.10.0 through 3.10.8
 > The mentioned patch was removed in c38de813 when bumping to 3.11.1.

 > Signed-off-by: Daniel Lang <dalang@gmx.at>

Committed to 2023.02.x, 2023.05.x and 2023.08.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot