Re: [OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-56005

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Sep 3, 2026 at 7:19 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> PLY 3.11 contains the picklefile parameter described by
> CVE-2025-56005, but exploitation requires an application to
> explicitly pass an attacker-controlled pickle file to yacc().
>
> No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
> the same reason [1], and NVD records the CVE as disputed [2].
>
> [1] https://ubuntu.com/security/CVE-2025-56005
> [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  meta/recipes-devtools/python/python3-ply_3.11.bb | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb
> index 0855c871cf..5bed977158 100644
> --- a/meta/recipes-devtools/python/python3-ply_3.11.bb
> +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
> @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\
>  "
>  
>  CVE_PRODUCT = "dabeaz:ply"
> +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-specific use of PLY's picklefile parameter with attacker-controlled pickle data"
>  
>  BBCLASSEXTEND = "native nativesdk"

Hello,

As fas as I can tell, this patch is also needed on wrynose.
I can't merge here until this is fixed there.

Can you send a patch to fix this on this branch and then, ping back
here?

Thanks!
-- 
Yoann Congal
Smile ECS