Re: [OE-core] [PATCH 2/4] python3-ply: set CVE_PRODUCT and CVE_STATUS for CVE-2025-56005 as disputed

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 1847 bytes --]

On Fri, 2026-07-10 at 16:43 +0900, mark.yang via lists.openembedded.org
wrote:
> From: "mark.yang" <mark.yang@lge.com>
> 
> For python3-ply, the CVE_PRODUCT should be set to ply, not python:ply.
> NVD registers ply as dabeaz:ply, so the default python:ply vendor prefix never matches and no CVEs are reported.
> 
> CVE-2025-56005 is disputed.
> See https://nvd.nist.gov/vuln/detail/CVE-2025-56005
> 
> Signed-off-by: mark.yang <mark.yang@lge.com>
> ---
>  meta/recipes-devtools/python/python3-ply_3.11.bb | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb
> index 2c5fa3f215..ce45bbc1bd 100644
> --- a/meta/recipes-devtools/python/python3-ply_3.11.bb
> +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
> @@ -14,4 +14,8 @@ RDEPENDS:${PN}:class-target += "\
>      python3-shell \
>  "
>  
> +CVE_PRODUCT = "ply"
> +# https://nvd.nist.gov/vuln/detail/CVE-2025-56005 Disputed
> +CVE_STATUS[CVE-2025-56005] = "disputed: PoC fails to demonstrate code execution; picklefile is a developer-controlled parser-table cache parameter"
> +

Hi,

The NVD entry [1] says:

  A third-party states that this vulnerability should be rejected
  because the proof of concept does not demonstrate arbitrary code
  execution and fails to complete successfully.

Following the links in the NVD entry I see what I assume is the argument
to dispute this [2] and an argument to dispute the dispute [3]. It's not
very convincing to me. I think we need a more clear reason why we want
to ignore this CVE.

[1]: https://nvd.nist.gov/vuln/detail/CVE-2025-56005
[2]: https://github.com/tom025/ply_exploit_rejection
[3]: https://www.openwall.com/lists/oss-security/2026/01/29/1

Best regards,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]