Re: [OE-core][wrynose][PATCH] python3: CVE-2026-3087 not applicable

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Jun 3, 2026 at 12:51 PM CEST, Adarsh Jagadish Kamini via lists.openembedded.org wrote:
> From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
>
> CVE link: https://nvd.nist.gov/vuln/detail/CVE-2026-3087
>
> The CVE is only applicable to Windows OS
>
> Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
> ---

Hello,

Thanks for the patch, but I preferred to go with the 3.14.5 upgrade,
which includes the fix.

Regards,

>  meta/recipes-devtools/python/python3_3.14.4.bb | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/meta/recipes-devtools/python/python3_3.14.4.bb b/meta/recipes-devtools/python/python3_3.14.4.bb
> index 71f590f630..84cd770f3b 100644
> --- a/meta/recipes-devtools/python/python3_3.14.4.bb
> +++ b/meta/recipes-devtools/python/python3_3.14.4.bb
> @@ -48,6 +48,8 @@ UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
>  
>  CVE_PRODUCT = "python:python python_software_foundation:python cpython"
>  
> +CVE_STATUS[CVE-2026-3087] = "not-applicable-platform: Issue only applies on Windows"
> +
>  PYTHON_MAJMIN = "3.14"
>  
>  S = "${UNPACKDIR}/Python-${PV}"


-- 
Yoann Congal
Smile ECS