[Buildroot] [RFC PATCH 08/14] package/python-pip: add detail to vulnerability

From: Thomas Perale via buildroot <buildroot@buildroot.org>
To: buildroot@buildroot.org
Cc: Thomas Perale <thomas.perale@mind.be>,
	Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Subject: [Buildroot] [RFC PATCH 08/14] package/python-pip: add detail to vulnerability
Date: Wed, 24 Jun 2026 16:06:39 +0200	[thread overview]
Message-ID: <20260624140645.185318-9-thomas.perale@mind.be> (raw)
In-Reply-To: <20260624140645.185318-1-thomas.perale@mind.be>

The vulnerability is marked as fixed as it work as expected according to
the upstream project.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/python-pip/python-pip.mk | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/package/python-pip/python-pip.mk b/package/python-pip/python-pip.mk
index d12bea3225..ae9a4225eb 100644
--- a/package/python-pip/python-pip.mk
+++ b/package/python-pip/python-pip.mk
@@ -12,9 +12,10 @@ PYTHON_PIP_LICENSE = MIT
 PYTHON_PIP_LICENSE_FILES = LICENSE.txt
 PYTHON_PIP_CPE_ID_VENDOR = pypa
 PYTHON_PIP_CPE_ID_PRODUCT = pip
-# Disputed CVE: things work as designed, and only affects the
-# --extra-index-url option. This CVE will never be fixed.
+
 PYTHON_PIP_IGNORE_CVES += CVE-2018-20225
+PYTHON_PIP_CVE-2018-20225_STATUS = fixed
+PYTHON_PIP_CVE-2018-20225_DETAIL = Disputed CVE: things work as designed, and only affects the --extra-index-url option. This CVE will never be fixed.
 
 $(eval $(python-package))
 $(eval $(host-python-package))
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
