[OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-56005

[OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-56005

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

PLY 3.11 contains the picklefile parameter described by
CVE-2025-56005, but exploitation requires an application to
explicitly pass an attacker-controlled pickle file to yacc().

No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
the same reason [1], and NVD records the CVE as disputed [2].

[1] https://ubuntu.com/security/CVE-2025-56005
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/python/python3-ply_3.11.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb
index 0855c871cf..5bed977158 100644
--- a/meta/recipes-devtools/python/python3-ply_3.11.bb
+++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
@@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\
 "
 
 CVE_PRODUCT = "dabeaz:ply"
+CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-specific use of PLY's picklefile parameter with attacker-controlled pickle data"
 
 BBCLASSEXTEND = "native nativesdk"
-- 
2.35.6

Re: [OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-56005

[Yoann Congal]

On Thu Sep 3, 2026 at 7:19 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> PLY 3.11 contains the picklefile parameter described by
> CVE-2025-56005, but exploitation requires an application to
> explicitly pass an attacker-controlled pickle file to yacc().
>
> No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
> the same reason [1], and NVD records the CVE as disputed [2].
>
> [1] https://ubuntu.com/security/CVE-2025-56005
> [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  meta/recipes-devtools/python/python3-ply_3.11.bb | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb
> index 0855c871cf..5bed977158 100644
> --- a/meta/recipes-devtools/python/python3-ply_3.11.bb
> +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
> @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\
>  "
>  
>  CVE_PRODUCT = "dabeaz:ply"
> +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-specific use of PLY's picklefile parameter with attacker-controlled pickle data"
>  
>  BBCLASSEXTEND = "native nativesdk"

Hello,

As fas as I can tell, this patch is also needed on wrynose.
I can't merge here until this is fixed there.

Can you send a patch to fix this on this branch and then, ping back
here?

Thanks!
-- 
Yoann Congal
Smile ECS

RE: [OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-56005

[Marko, Peter]

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Yoann Congal via
> lists.openembedded.org
> Sent: Friday, September 11, 2026 11:03 AM
> To: hthakar@cisco.com; openembedded-core@lists.openembedded.org
> Cc: xe-linux-external@cisco.com
> Subject: Re: [OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-
> 56005
> 
> On Thu Sep 3, 2026 at 7:19 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS
> PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> > From: Hetvi Thakar <hthakar@cisco.com>
> >
> > PLY 3.11 contains the picklefile parameter described by
> > CVE-2025-56005, but exploitation requires an application to
> > explicitly pass an attacker-controlled pickle file to yacc().
> >
> > No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
> > the same reason [1], and NVD records the CVE as disputed [2].
> >
> > [1] https://ubuntu.com/security/CVE-2025-56005
> > [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
> >
> > Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> > ---
> >  meta/recipes-devtools/python/python3-ply_3.11.bb | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-
> devtools/python/python3-ply_3.11.bb
> > index 0855c871cf..5bed977158 100644
> > --- a/meta/recipes-devtools/python/python3-ply_3.11.bb
> > +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
> > @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\
> >  "
> >
> >  CVE_PRODUCT = "dabeaz:ply"
> > +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-
> specific use of PLY's picklefile parameter with attacker-controlled pickle data"
> >
> >  BBCLASSEXTEND = "native nativesdk"
> 
> Hello,
> 
> As fas as I can tell, this patch is also needed on wrynose.
> I can't merge here until this is fixed there.
> 
> Can you send a patch to fix this on this branch and then, ping back
> here?

Hello Yoann,

In wrynose this will be fixed by update of sbom-cve-check tooling.

Peter

> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

Re: [OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-56005

[Yoann Congal]

On Sat Sep 12, 2026 at 4:37 PM CEST, Peter Marko wrote:
>
>
>> -----Original Message-----
>> From: openembedded-core@lists.openembedded.org <openembedded-
>> core@lists.openembedded.org> On Behalf Of Yoann Congal via
>> lists.openembedded.org
>> Sent: Friday, September 11, 2026 11:03 AM
>> To: hthakar@cisco.com; openembedded-core@lists.openembedded.org
>> Cc: xe-linux-external@cisco.com
>> Subject: Re: [OE-core][scarthgap][PATCH] python3-ply: set status for CVE-2025-
>> 56005
>> 
>> On Thu Sep 3, 2026 at 7:19 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS
>> PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> > From: Hetvi Thakar <hthakar@cisco.com>
>> >
>> > PLY 3.11 contains the picklefile parameter described by
>> > CVE-2025-56005, but exploitation requires an application to
>> > explicitly pass an attacker-controlled pickle file to yacc().
>> >
>> > No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
>> > the same reason [1], and NVD records the CVE as disputed [2].
>> >
>> > [1] https://ubuntu.com/security/CVE-2025-56005
>> > [2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
>> >
>> > Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
>> > ---
>> >  meta/recipes-devtools/python/python3-ply_3.11.bb | 1 +
>> >  1 file changed, 1 insertion(+)
>> >
>> > diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-
>> devtools/python/python3-ply_3.11.bb
>> > index 0855c871cf..5bed977158 100644
>> > --- a/meta/recipes-devtools/python/python3-ply_3.11.bb
>> > +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
>> > @@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\
>> >  "
>> >
>> >  CVE_PRODUCT = "dabeaz:ply"
>> > +CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-
>> specific use of PLY's picklefile parameter with attacker-controlled pickle data"
>> >
>> >  BBCLASSEXTEND = "native nativesdk"
>> 
>> Hello,
>> 
>> As fas as I can tell, this patch is also needed on wrynose.
>> I can't merge here until this is fixed there.
>> 
>> Can you send a patch to fix this on this branch and then, ping back
>> here?
>
> Hello Yoann,
>
> In wrynose this will be fixed by update of sbom-cve-check tooling.
>
> Peter

Right, thanks Peter!

>
>> 
>> Thanks!
>> --
>> Yoann Congal
>> Smile ECS


-- 
Yoann Congal
Smile ECS