Re: [OE-core][kirkstone 08/18] python3: Fix CVE-2025-15282

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 1206 bytes --]

On Mon, 2026-04-06 at 17:14 +0530, Vijay Anusuri via
lists.openembedded.org wrote:
> On Mon, Apr 6, 2026 at 2:39 PM Paul Barker via lists.openembedded.org <paul=
> pbarker.dev@lists.openembedded.org> wrote:
> 
> > On Mon, 2026-04-06 at 08:26 +0200, Yoann Congal via
> > lists.openembedded.org wrote:
> > > From: Vijay Anusuri <vanusuri@mvista.com>
> > > 
> > > Pick patch from 3.10 branch
> > > 
> > > [1] https://nvd.nist.gov/vuln/detail/CVE-2025-15282
> > > [2] https://security-tracker.debian.org/tracker/CVE-2025-15282
> > > 
> > > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > > Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
> > 
> > The fix for this issue (referred to as gh-143925 upstream) looks to be
> > part of Python 3.10.20 [1]. Should we take a final Python stable update
> > instead of this patch?
> > 
> > [1]: https://www.python.org/downloads/release/python-31020/
> > 
> > 
> --> Along with this CVE, Python 3.10.20 includes multiple security bug
> fixes. I think it's good to go with Python stable update to 3.10.20 .

Hi Vijay,

Are you able to send a patch to update to Python 3.10.20 on kirkstone?

Best regards,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]