From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2591FC88E53 for ; Tue, 15 Sep 2026 06:33:37 +0000 (UTC) Subject: Re: [scarthgap][PATCH] python3-click: fix CVE-2026-7246 To: openembedded-core@lists.openembedded.org From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.21) X-Originating-Platform: Windows Edge 153 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Mon, 14 Sep 2026 23:33:33 -0700 References: <20260821163206.882233-1-dkelaiya@cisco.com> <199240.1788773192713715859@lists.openembedded.org> In-Reply-To: <199240.1788773192713715859@lists.openembedded.org> Message-ID: <506499.1789454013183428091@lists.openembedded.org> Content-Type: multipart/alternative; boundary="02DkGapemGvJD2Htrrhr" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 15 Sep 2026 06:33:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245820 --02DkGapemGvJD2Htrrhr Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Mon, Sep 7, 2026 at 02:56 PM, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS P= RIVATE LIMITED at Cisco) wrote: >=20 > On Sun, Sep 6, 2026 at 04:46 AM, Yoann Congal wrote: >=20 >> On Fri Aug 21, 2026 at 6:32 PM CEST, Darsh Kelaiya -X (dkelaiya - E >> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: >>=20 >>> From: Darsh Kelaiya >>>=20 >>> This patch applies the upstream fix for CVE-2026-7246 as referenced >>> in [2], using the upstream commit identified in [1]. >>>=20 >>> The backport also adapts editor regression tests from the upstream >>> test and documentation follow-up identified in [3]. This follow-up >>> does not contain an additional production security fix. >>>=20 >>> [1] https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db49= 4ebee4aef8f42 >>>=20 >>> [2] https://github.com/tsigouris007/security-advisories/security/adviso= ries/GHSA-47fr-3ffg-hgmw >>>=20 >>> [3] https://github.com/pallets/click/commit/b55294797ef32e22eb41e7d9657= edb8faefa4976 >>>=20 >>>=20 >>> Signed-off-by: Darsh Kelaiya >>> --- >>> .../python/python3-click/CVE-2026-7246.patch | 245 ++++++++++++++++++ >>> .../python/python3-click_8.1.7.bb | 5 +- >>> 2 files changed, 249 insertions(+), 1 deletion(-) >>> create mode 100644 >>> meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >>>=20 >>> diff --git >>> a/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >>> b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >>> new file mode 100644 >>> index 0000000000..47ee1a551f >>> --- /dev/null >>> +++ b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch >>> @@ -0,0 +1,245 @@ >>> +From cb30f575b1a251e8698909bca2a443d41dad1824 Mon Sep 17 00:00:00 2001 >>> +From: Kevin Deldycke >>> +Date: Wed, 4 Mar 2026 14:51:58 +0400 >>> +Subject: [PATCH] Document and fix command string sanitizing with >>> `shlex.split` >>> + >>> +Removes last use of `shell=3DTrue` use for command invokation for >>> defense-in-depth. >>> +Refs: #1026, #1477 and #2775 >>> + >>> +CVE: CVE-2026-7246 >>> +Upstream-Status: Backport [ https://github.com/pallets/click/commit/b9= 6c2601af4e01341b4d2c0db494ebee4aef8f42 >>> ] >>> + >>> +Backport Changes: >>> +- Click 8.1.7 uses Editor.edit_file(filename), not the newer >>> + Editor.edit_files(filenames) API. Apply the argv-list change >>> + to one filename without adding the multi-file API. >>> +- Adapt editor tests from b96c2601 and follow-up b5529479 to >>=20 >> Hello, >>=20 >> This commit has both b96c2601 and b5529479 squashed. Please keep >> upstream backport patches split. >>=20 >> Can you send a v2 with as the CVE fix (b96c2601) and its followup >> (b5529479)? >>=20 >> Thanks! >>=20 >> -- >> Yoann Congal >> Smile ECS >=20 > Hi Yoann, >=20 > While preparing v2, I noticed that NVD now marks CVE-2026-7246 as dispute= d > and states that the Pallets Click project does not consider it a valid > vulnerability: >=20 > https://nvd.nist.gov/vuln/detail/CVE-2026-7246 >=20 > However, the published advisory identifies upstream commit b96c2601 as th= e > fix: >=20 > https://github.com/tsigouris007/security-advisories/security/advisories/G= HSA-47fr-3ffg-hgmw >=20 >=20 > Upstream describes the removal of shell=3DTrue as defense-in-depth, so I > wanted to confirm the preferred handling. Should I replace the backport > patches with a status entry such as: >=20 > CVE_STATUS[CVE-2026-7246] =3D "disputed: Pallets Click does not consider > this a valid vulnerability" >=20 > Or should I continue with the split v2 backport patches as hardening? >=20 > Thanks, > Darsh >=20 Hello, Yoann I hope you are doing well. Could you please share if there are any updates = on this? Thanks, Darsh --02DkGapemGvJD2Htrrhr Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
On Mon, Sep 7, 2026 at 02:56 PM, Darsh Kelaiya -X (dkelaiya - E INFOCH= IPS PRIVATE LIMITED at Cisco) wrote:
On Sun, Sep 6, 2026 at 04:46 AM, Yoann Congal wrote:
On Fri Aug 21, 2026 at 6:32 PM CEST, Darsh Kelaiya -X (dkelaiya= - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:<= br />
From: Darsh Kelaiya <dkelaiya@cisco.com>

This = patch applies the upstream fix for CVE-2026-7246 as referenced
in [2],= using the upstream commit identified in [1].

The backport also = adapts editor regression tests from the upstream
test and documentatio= n follow-up identified in [3]. This follow-up
does not contain an addi= tional production security fix.

[1] https://github.com/pallets/click/commit/b96c2601af= 4e01341b4d2c0db494ebee4aef8f42
[2] https://github.com/tsigouris007/security-a= dvisories/security/advisories/GHSA-47fr-3ffg-hgmw
[3] https://github.com/pallets/click/c= ommit/b55294797ef32e22eb41e7d9657edb8faefa4976

Signed-off-by= : Darsh Kelaiya <dkelaiya@cisco.com>
---
.../python/python3= -click/CVE-2026-7246.patch | 245 ++++++++++++++++++
.../python/python3= -click_8.1.7.bb | 5 +-
2 files changed, 249 insertions(+), 1 deletion(= -)
create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2= 026-7246.patch

diff --git a/meta/recipes-devtools/python/python3= -click/CVE-2026-7246.patch b/meta/recipes-devtools/python/python3-click/CVE= -2026-7246.patch
new file mode 100644
index 0000000000..47ee1a551= f
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-click/= CVE-2026-7246.patch
@@ -0,0 +1,245 @@
+From cb30f575b1a251e869890= 9bca2a443d41dad1824 Mon Sep 17 00:00:00 2001
+From: Kevin Deldycke <= ;kevin@deldycke.com>
+Date: Wed, 4 Mar 2026 14:51:58 +0400
+Su= bject: [PATCH] Document and fix command string sanitizing with `shlex.split= `
+
+Removes last use of `shell=3DTrue` use for command invokatio= n for defense-in-depth.
+Refs: #1026, #1477 and #2775
+
+CVE= : CVE-2026-7246
+Upstream-Status: Backport [https://github.com/pallets/click/commit/b96c26= 01af4e01341b4d2c0db494ebee4aef8f42]
+
+Backport Changes:
+- Click 8.1.7 uses Editor.edit_file(filename), not the newer
+ Edito= r.edit_files(filenames) API. Apply the argv-list change
+ to one filen= ame without adding the multi-file API.
+- Adapt editor tests from b96c= 2601 and follow-up b5529479 to
Hello,

This commit has both b96c2601 and b5529479 squashed. Plea= se keep
upstream backport patches split.

Can you send a v2 = with as the CVE fix (b96c2601) and its followup
(b5529479)?

Thanks!

--
Yoann Congal
Smile ECS
Hi Yoann,

While preparing v2, I noticed that NVD now marks CVE-2= 026-7246 as disputed and states that the Pallets Click project does not con= sider it a valid vulnerability:

https://nvd.n= ist.gov/vuln/detail/CVE-2026-7246

However, the published adv= isory identifies upstream commit b96c2601 as the fix:

https://github.com/ts= igouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw<= br />
Upstream describes the removal of shell=3DTrue as defense-in-dep= th, so I wanted to confirm the preferred handling. Should I replace the bac= kport patches with a status entry such as:

CVE_STATUS[CVE-2026-7= 246] =3D "disputed: Pallets Click does not consider this a valid vulnerabil= ity"

Or should I continue with the split v2 backport patches as = hardening?

Thanks,
Darsh
Hello, Yoann

I hope you are doing well. Could you please share i= f there are any updates on this?

Thanks,
Darsh
--02DkGapemGvJD2Htrrhr--