[OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

CVE-2018-20225 describes pip selecting the highest-version candidate
across configured package indexes. Exploitation requires use of
--extra-index-url with a private package absent from the public index,
allowing an attacker to publish that package with an arbitrary version.

Commit [1] documents the dependency-confusion risk and recommends using
--index-url for private packages. It does not change pip's candidate-
selection behavior. This change records the CVE as disputed.

[1] https://github.com/pypa/pip/commit/fe2721893636aa15ef04d02e9beb52f7fe9a0d27
[2] https://nvd.nist.gov/vuln/detail/CVE-2018-20225

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/python/python3-pip_24.0.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb
index 1b6281c81f..7107b1c8df 100644
--- a/meta/recipes-devtools/python/python3-pip_24.0.bb
+++ b/meta/recipes-devtools/python/python3-pip_24.0.bb
@@ -43,6 +43,7 @@ do_install:append() {
 }
 
 CVE_PRODUCT = "pypa:pip"
+CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes"
 
 do_install:append(){
 	# pip vendors distlib which ships Windows launcher templates (*.exe).
-- 
2.35.6