* [OE-core][wrynose][PATCH 1/3] python3: upgrade 3.14.7 -> 3.14.8
2026-10-16 5:39 [Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-16 5:39 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 14:18 ` Yoann Congal
2026-10-16 5:39 ` [OE-core][wrynose][PATCH 2/3] python3: fix CVE-2025-15367 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-16 5:39 UTC (permalink / raw)
To: openembedded-core; +Cc: Vijay Anusuri, Darsh Kelaiya
From: Vijay Anusuri <vanusuri@mvista.com>
Release information:
* https://www.python.org/downloads/release/python-3148/
* Python 3.14.8 is an expedited security release and the eighth
maintenance release of 3.14, containing around 354 bugfixes,
build improvements and documentation changes from 142 contributors
since 3.14.7.
Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-15310
CVE-2026-15806 CVE-2026-17084
Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-14-8-final
Backport Changes:
- The new test_append_limited_history ptest fails on musl with the
default libedit backend. libedit opens the history file for
appending, then emits a header if ftell() reports offset zero.
musl leaves the initial append stream at that offset, so a second
_HiStOrY_V2_ header is appended and CPython's truncation keeps it
in place of the expected history entry. Skip only that test on musl
until the libedit interaction is fixed.
OE-Core failure report:
https://patchwork.yoctoproject.org/project/oe-core/patch/010101a0f6296539-d5cd290b-b68d-4632-a774-5263fa10249e-000000@us-west-2.amazonses.com/
Upstream issue:
https://github.com/python/cpython/issues/123018
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../python/{python3_3.14.7.bb => python3_3.14.8.bb} | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)
diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
similarity index 98%
rename from meta/recipes-devtools/python/python3_3.14.7.bb
rename to meta/recipes-devtools/python/python3_3.14.8.bb
index e73dc8d772..f10d6a5f4d 100644
--- a/meta/recipes-devtools/python/python3_3.14.7.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \
file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
"
-SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
+SRC_URI[sha256sum] = "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
# exclude pre-releases for both python 2.x and 3.x
UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
@@ -263,6 +263,8 @@ SKIPPED_TESTS += " \
--ignore test.test_tracemalloc.TestCAPI.test_tracemalloc_track_race \
"
+# libedit treats musl's initial append-stream offset as an empty file,
+# appending a second history header (gh-123018).
SKIPPED_TESTS:append:class-target:libc-musl = " \
-x test__locale \
-x test_c_locale_coercion \
@@ -272,6 +274,7 @@ SKIPPED_TESTS:append:class-target:libc-musl = " \
-x test_threading \
--ignore test.test_strptime.StrptimeTests.test_date_locale2 \
--ignore test.test_ctypes.test_dlerror.TestNullDlsym.test_null_dlsym \
+ --ignore test.test_readline.TestHistoryManipulation.test_append_limited_history \
"
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread* [OE-core][wrynose][PATCH 2/3] python3: fix CVE-2025-15367
2026-10-16 5:39 [Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 5:39 ` [OE-core][wrynose][PATCH 1/3] python3: upgrade 3.14.7 -> 3.14.8 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-16 5:39 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 5:39 ` [OE-core][wrynose][PATCH 3/3] python3: fix CVE-2026-87910 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 5:54 ` [OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
3 siblings, 0 replies; 6+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-16 5:39 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].
CPython kept this change on main and deferred maintenance-branch
backports [3] because passwords containing control characters
such as tab or backspace could previously work. Wrynose takes the
compatibility change to prevent user-controlled POP3 arguments from
injecting extra commands. The new validation rejects C0 and DEL bytes
before sending a command.
Clients with affected stored credentials must replace those credentials
with ones free of control characters and handle the new ValueError with
a clear credential error. They must not silently strip password
characters or retry by bypassing the check.
[1] https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7
[2] https://nvd.nist.gov/vuln/detail/cve-2025-15367
[3] https://github.com/python/cpython/pull/143924
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../python/python3/CVE-2025-15367.patch | 66 +++++++++++++++++++
.../recipes-devtools/python/python3_3.14.8.bb | 1 +
2 files changed, 67 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2025-15367.patch b/meta/recipes-devtools/python/python3/CVE-2025-15367.patch
new file mode 100644
index 0000000000..21f2dfa7ed
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2025-15367.patch
@@ -0,0 +1,66 @@
+From cf799923a7a039d52432629c45ae7c603cc0b2d6 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 14:46:32 -0600
+Subject: [PATCH] gh-143923: Reject control characters in POP3 commands
+
+CVE: CVE-2025-15367
+Upstream-Status: Backport [https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7]
+
+(cherry picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/poplib.py | 2 ++
+ Lib/test/test_poplib.py | 8 ++++++++
+ .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst | 1 +
+ 3 files changed, 11 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+
+diff --git a/Lib/poplib.py b/Lib/poplib.py
+index 4469bff..b97274c 100644
+--- a/Lib/poplib.py
++++ b/Lib/poplib.py
+@@ -122,6 +122,8 @@ class POP3:
+ def _putcmd(self, line):
+ if self._debugging: print('*cmd*', repr(line))
+ line = bytes(line, self.encoding)
++ if re.search(b'[\x00-\x1F\x7F]', line):
++ raise ValueError('Control characters not allowed in commands')
+ self._putline(line)
+
+
+diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
+index ef2da97..18ca7cb 100644
+--- a/Lib/test/test_poplib.py
++++ b/Lib/test/test_poplib.py
+@@ -17,6 +17,7 @@ from test.support import socket_helper
+ from test.support import threading_helper
+ from test.support import asynchat
+ from test.support import asyncore
++from test.support import control_characters_c0
+
+
+ test_support.requires_working_socket(module=True)
+@@ -395,6 +396,13 @@ class TestPOP3Class(TestCase):
+ self.assertIsNone(self.client.sock)
+ self.assertIsNone(self.client.file)
+
++ def test_control_characters(self):
++ for c0 in control_characters_c0():
++ with self.assertRaises(ValueError):
++ self.client.user(f'user{c0}')
++ with self.assertRaises(ValueError):
++ self.client.pass_(f'{c0}pass')
++
+ @requires_ssl
+ def test_stls_capa(self):
+ capa = self.client.capa()
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+new file mode 100644
+index 0000000..3cde4df
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.
+--
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3_3.14.8.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
index f10d6a5f4d..6aa5514246 100644
--- a/meta/recipes-devtools/python/python3_3.14.8.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -35,6 +35,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-Skip-flaky-test_default_timeout-tests.patch \
file://0001-test_only_active_thread-skip-problematic-test.patch \
file://0001-prefer-valid-entrypoints.patch \
+ file://CVE-2025-15367.patch \
"
SRC_URI:append:class-native = " \
file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread* [OE-core][wrynose][PATCH 3/3] python3: fix CVE-2026-87910
2026-10-16 5:39 [Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 5:39 ` [OE-core][wrynose][PATCH 1/3] python3: upgrade 3.14.7 -> 3.14.8 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 5:39 ` [OE-core][wrynose][PATCH 2/3] python3: fix CVE-2025-15367 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-16 5:39 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 5:54 ` [OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
3 siblings, 0 replies; 6+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-16 5:39 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix shown in [1]. The Windows test
correction is applied from [2]. The advisory identifying the fix is
referenced in [3].
[1] https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2
[2] https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b
[3] https://nvd.nist.gov/vuln/detail/cve-2026-87910
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../python/python3/CVE-2026-87910_p1.patch | 98 +++++++++++++++++++
.../python/python3/CVE-2026-87910_p2.patch | 55 +++++++++++
.../recipes-devtools/python/python3_3.14.8.bb | 2 +
3 files changed, 155 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch b/meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
new file mode 100644
index 0000000000..9786e82619
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
@@ -0,0 +1,98 @@
+From 19b8b2011fd1743841510e44b8e9e87f3a3f4ba0 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Fri, 11 Sep 2026 14:19:35 +0200
+Subject: [PATCH] gh-157265: tarfile: Honor None result of filter for link
+ fallbacks (GH-157266)
+
+Co-authored-by: Stan Ulbrych <stan@python.org>
+
+CVE: CVE-2026-87910
+Upstream-Status: Backport [https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2]
+
+(cherry picked from commit fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/tarfile.py | 4 ++-
+ Lib/test/test_tarfile.py | 31 +++++++++++++++++--
+ ...-09-10-13-38-11.gh-issue-157265.-vYuMp.rst | 3 ++
+ 3 files changed, 34 insertions(+), 4 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index b7b4af15b1..89e1e9b218 100644
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -2818,9 +2818,11 @@ class TarFile(object):
+ "makelink_with_filter: if filter_function is not None, "
+ + "extraction_root must also not be None")
+ try:
+- filter_function(
++ filtered = filter_function(
+ unfiltered.replace(name=tarinfo.name, deep=False),
+ extraction_root)
++ if filtered is None:
++ return
+ filtered = filter_function(unfiltered, extraction_root)
+ except _FILTER_ERRORS as cause:
+ raise LinkFallbackError(tarinfo, unfiltered.name) from cause
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index ab13ab34fc..c09592075b 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4395,9 +4395,15 @@ class TestExtractionFilters(unittest.TestCase):
+ for filter in 'tar', 'fully_trusted':
+ with self.subTest(filter), self.check_context(arc.open(), filter):
+ if not os_helper.can_symlink():
+- self.expect_file("a/t/dummy")
+- self.expect_file("b/")
+- self.expect_file("c/")
++ if filter == 'tar':
++ self.expect_exception(
++ tarfile.LinkFallbackError,
++ "link 'boom' would be extracted as a copy of "
++ + "'c/escape', which was rejected")
++ else:
++ self.expect_file("a/t/dummy")
++ self.expect_file("b/")
++ self.expect_file("c/")
+ else:
+ self.expect_file("a/t/dummy")
+ self.expect_file("b/")
+@@ -4576,6 +4582,25 @@ class TestExtractionFilters(unittest.TestCase):
+ if os_helper.can_chmod():
+ self.assertFalse(path.stat().st_mode & stat.S_IWUSR)
+
++ @symlink_test
++ def test_extract_filters_target_none(self):
++ # Test that when extract() falls back to extracting (rather than
++ # linking) a hardlink target, the member is skipped if the filter
++ # returns None.
++ with ArchiveMaker() as arc:
++ arc.add('a/b/s', symlink_to='../escape')
++ arc.add('q', hardlink_to='a/b/s')
++ def filter_unsafe_members(member, path):
++ try:
++ return tarfile.data_filter(member, path)
++ except tarfile.FilterError as error:
++ return None
++ with self.check_context(arc.open(), filter_unsafe_members):
++ if os_helper.can_symlink():
++ self.expect_file('a/b/s', symlink_to='../escape')
++ else:
++ self.expect_file('a/b/') # symlink is not extracted
++
+ def test_link_fallback_normalizes(self):
+ # Make sure hardlink fallbacks work for non-normalized paths for all
+ # filters
+diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst
+new file mode 100644
+index 0000000000..ba27e47f73
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst
+@@ -0,0 +1,3 @@
++In :mod:`tarfile`, when extracting a link falls back to extracting a member
++of the archive, skip the member when the filter function returns None when
++called with the extracted member's name replaced with the link's.
+--
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch b/meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
new file mode 100644
index 0000000000..fc97378719
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
@@ -0,0 +1,55 @@
+From 8dd3fcd26e7effd2de3b3ec7709d80632b6acfc7 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Fri, 11 Sep 2026 19:54:41 +0200
+Subject: [PATCH] gh-157265: Adjust test for Windows (GH-157334)
+
+gh-157266: Adjust test for Windows
+
+On Windows (no symlinks, no hardlinks), the behaviour is
+the same as without the fix in GH-157266:
+- a/t/dummy is extracted
+- b/ is extracted
+- c/ is *not* created (the target, a/t, is not in the archive)
+- c/escape: c/ is created; escape is skipped (target,
+ c/../../link_here, is not in archive)
+- c is not recreated as a directory
+- boom is not created (target is c/escape, which falls back to
+ ..\..\link_here, which does not exist in archive)
+
+CVE: CVE-2026-87910
+Upstream-Status: Backport [https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b]
+
+(cherry picked from commit d9565e54b1fc6d63c5be9afd58114499128fa57b)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/test/test_tarfile.py | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index c09592075b..7e072d9090 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4395,15 +4395,15 @@ class TestExtractionFilters(unittest.TestCase):
+ for filter in 'tar', 'fully_trusted':
+ with self.subTest(filter), self.check_context(arc.open(), filter):
+ if not os_helper.can_symlink():
+- if filter == 'tar':
++ if filter == 'fully_trusted' or sys.platform == "win32":
++ self.expect_file("a/t/dummy")
++ self.expect_file("b/")
++ self.expect_file("c/")
++ else:
+ self.expect_exception(
+ tarfile.LinkFallbackError,
+ "link 'boom' would be extracted as a copy of "
+ + "'c/escape', which was rejected")
+- else:
+- self.expect_file("a/t/dummy")
+- self.expect_file("b/")
+- self.expect_file("c/")
+ else:
+ self.expect_file("a/t/dummy")
+ self.expect_file("b/")
+--
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3_3.14.8.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
index 6aa5514246..2bf2806ee8 100644
--- a/meta/recipes-devtools/python/python3_3.14.8.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -36,6 +36,8 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-test_only_active_thread-skip-problematic-test.patch \
file://0001-prefer-valid-entrypoints.patch \
file://CVE-2025-15367.patch \
+ file://CVE-2026-87910_p1.patch \
+ file://CVE-2026-87910_p2.patch \
"
SRC_URI:append:class-native = " \
file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes
2026-10-16 5:39 [Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 preceding siblings ...)
2026-10-16 5:39 ` [OE-core][wrynose][PATCH 3/3] python3: fix CVE-2026-87910 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-16 5:54 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
3 siblings, 0 replies; 6+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-16 5:54 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 2310 bytes --]
Hi all,
The [Internal Review] prefix in the cover-letter subject was
included by mistake. This series is intended for review and
inclusion in Wrynose.
Sorry for the confusion.
Regards,
Darsh
________________________________
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) <dkelaiya@cisco.com>
Sent: 16 October 2026 11:09
To: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) <dkelaiya@cisco.com>
Subject: [Internal Review][OE-core][wrynose][PATCH 0/3] python3: upgrade to 3.14.8 and backport security fixes
From: Darsh Kelaiya <dkelaiya@cisco.com>
Upgrade Python 3.14.7 to 3.14.8 on Wrynose and backport fixes for
CVE-2025-15367 and CVE-2026-87910.
The 3.14.8 release addresses CVE-2026-19445, CVE-2026-19553,
CVE-2026-19672, CVE-2026-15310, CVE-2026-15806 and CVE-2026-17084.
The new test_append_limited_history ptest fails with the default
libedit backend on musl. Patch 1 skips only that test on musl while
the libedit interaction remains unresolved.
Patch 2 rejects control characters in POP3 commands to prevent command
injection. This changes behavior for clients whose passwords contain
those characters: they must replace the credentials and handle the new
ValueError as a credential error.
Patch 3 fixes tarfile extraction so a filter rejecting a link fallback
is honored. It also includes the upstream Windows test correction.
Darsh Kelaiya (2):
python3: fix CVE-2025-15367
python3: fix CVE-2026-87910
Vijay Anusuri (1):
python3: upgrade 3.14.7 -> 3.14.8
.../python/python3/CVE-2025-15367.patch | 66 +++++++++++++
.../python/python3/CVE-2026-87910_p1.patch | 98 +++++++++++++++++++
.../python/python3/CVE-2026-87910_p2.patch | 55 +++++++++++
.../{python3_3.14.7.bb => python3_3.14.8.bb} | 8 +-
4 files changed, 226 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)
--
2.35.6
[-- Attachment #2: Type: text/html, Size: 4965 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread