Re: [OE-core] [scarthgap][PATCH 2/3] python3: fix CVE-2026-11972

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Jul 6, 2026 at 1:01 PM CEST, Benjamin Robin via lists.openembedded.org wrote:
> When using the "tarfile" module with a file opened in "streaming mode"
> (mode="r|") the tarfile module did not properly handle EOF, making archive
> parsing take exponentially longer.
>
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> ---
>  .../python/python3/CVE-2026-11972.patch            | 58 ++++++++++++++++++++++
>  meta/recipes-devtools/python/python3_3.12.13.bb    |  1 +
>  2 files changed, 59 insertions(+)
>
> diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch
> new file mode 100644
> index 000000000000..0752ba372dcc
> --- /dev/null
> +++ b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch
> @@ -0,0 +1,58 @@
> +From a83ebdb495a9cbd28a03675acdeda235fade90b3 Mon Sep 17 00:00:00 2001
> +From: Petr Viktorin <encukou@gmail.com>
> +Date: Tue, 23 Jun 2026 15:13:30 +0200
> +Subject: [PATCH] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982)
> +
> +CVE: CVE-2026-11972
> +Upstream-Status: Backport [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896]
> +
> +Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>

Hello,

Like we discussed for wrynose, this patch lacks the co-authored-by it
has upstream. Can you send a v2 with this fixed?

Thanks!
-- 
Yoann Congal
Smile ECS