[OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225

[OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

CVE-2018-20225 describes pip selecting the highest-version candidate
across configured package indexes. Exploitation requires use of
--extra-index-url with a private package absent from the public index,
allowing an attacker to publish that package with an arbitrary version.

Commit [1] documents the dependency-confusion risk and recommends using
--index-url for private packages. It does not change pip's candidate-
selection behavior. This change records the CVE as disputed.

[1] https://github.com/pypa/pip/commit/fe2721893636aa15ef04d02e9beb52f7fe9a0d27
[2] https://nvd.nist.gov/vuln/detail/CVE-2018-20225

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/python/python3-pip_24.0.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb
index 1b6281c81f..7107b1c8df 100644
--- a/meta/recipes-devtools/python/python3-pip_24.0.bb
+++ b/meta/recipes-devtools/python/python3-pip_24.0.bb
@@ -43,6 +43,7 @@ do_install:append() {
 }
 
 CVE_PRODUCT = "pypa:pip"
+CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes"
 
 do_install:append(){
 	# pip vendors distlib which ships Windows launcher templates (*.exe).
-- 
2.35.6

Re: [OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225

[Yoann Congal]

On Mon Sep 7, 2026 at 10:21 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> CVE-2018-20225 describes pip selecting the highest-version candidate
> across configured package indexes. Exploitation requires use of
> --extra-index-url with a private package absent from the public index,
> allowing an attacker to publish that package with an arbitrary version.
>
> Commit [1] documents the dependency-confusion risk and recommends using
> --index-url for private packages. It does not change pip's candidate-
> selection behavior. This change records the CVE as disputed.
>
> [1] https://github.com/pypa/pip/commit/fe2721893636aa15ef04d02e9beb52f7fe9a0d27
> [2] https://nvd.nist.gov/vuln/detail/CVE-2018-20225
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  meta/recipes-devtools/python/python3-pip_24.0.bb | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb
> index 1b6281c81f..7107b1c8df 100644
> --- a/meta/recipes-devtools/python/python3-pip_24.0.bb
> +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb
> @@ -43,6 +43,7 @@ do_install:append() {
>  }
>  
>  CVE_PRODUCT = "pypa:pip"
> +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes"
>  
>  do_install:append(){
>  	# pip vendors distlib which ships Windows launcher templates (*.exe).

Hello,

You sent this patch for both wrynose and scarthgap:
* [OE-core][scarthgap][PATCH] python3-pip: set status for CVE-2018-20225
  https://lore.kernel.org/openembedded-core/20260907082127.471223-1-hthakar@cisco.com/T/#u
* [OE-core][wrynose][PATCH] python3-pip: set CVE_STATUS for CVE-2018-20225
  https://lore.kernel.org/openembedded-core/20260907082218.2177656-1-hthakar@cisco.com/T/#u

... but these are not similar: title and commit message changed (diff
content looks similar).

During reviews, I often get identical patches between wrynose and
scarthgap and I can, then, review both at the same time which helps me
decrease the patch queue length.
If you modify patches between wrynose and scarthgap (apart from normal
backporting modification), then, I have to review both separately.

So, this is not a strict rule but it would help me if the
wrynose/scarthgap patches were as similar as possible.

Also, the fact that the work was done twice *differently* looks like
agentic/LLM output (I think a human would copy-paste, at least). If
that's the case, remember that you have to mark it as such.

Thanks & regards,
-- 
Yoann Congal
Smile ECS