RE: [OE-core][whinlatter 04/11] python3-urllib3: patch

Marko, Peter
2026-03-04T11:11:04Z

[-- Attachment #1: Type: text/plain, Size: 4122 bytes --]

Hello Yoann, Paul,

What shall we do with this patch?
Drop or take?

I also think that it’s intrusive, however having this fixed on older Yocto release and not fixed in newer is weird.
https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=d9f52c5f86bcc4716e384fe5c01c03d386d60446

Peter

From: Yoann Congal <yoann.congal@smile.fr>
Sent: Friday, January 30, 2026 11:34
To: Paul Barker <paul@pbarker.dev>
Cc: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>; openembedded-core@lists.openembedded.org; Jiaying Song <jiaying.song.cn@windriver.com>
Subject: Re: [OE-core][whinlatter 04/11] python3-urllib3: patch

Le mer. 7 janv. 2026 à 15:05, Paul Barker <paul@pbarker.dev<mailto:paul@pbarker.dev>> a écrit :
On Wed, 2026-01-07 at 13:47 +0100, Yoann Congal wrote:
>
> Le 07/01/2026 à 13:32, Paul Barker a écrit :
> > On Wed, 2026-01-07 at 12:19 +0000, Marko, Peter wrote:
> > >
> > > > -----Original Message-----
> > > > From: Paul Barker <paul@pbarker.dev<mailto:paul@pbarker.dev>>
> > > > Sent: Wednesday, January 7, 2026 12:49
> > > > To: yoann.congal@smile.fr<mailto:yoann.congal@smile.fr>; openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>;
> > > > Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com<mailto:Peter.Marko@siemens.com>>
> > > > Subject: Re: [OE-core][whinlatter 04/11] python3-urllib3: patch
> > > >
> > > > On Wed, 2026-01-07 at 09:08 +0100, Yoann Congal via
> > > > lists.openembedded.org<http://lists.openembedded.org> wrote:
> > > > > From: Peter Marko <peter.marko@siemens.com<mailto:peter.marko@siemens.com>>
> > > > >
> > > > > Pick patch per [1].
> > > > >
> > > > > [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66471
> > > > >
> > > > > Signed-off-by: Peter Marko <peter.marko@siemens.com<mailto:peter.marko@siemens.com>>
> > > > > ---
> > > > > .../python3-urllib3/CVE-2025-66471.patch | 930 ++++++++++++++++++
> > > > > .../python/python3-urllib3_2.5.0.bb<http://python3-urllib3_2.5.0.bb> | 1 +
> > > > > 2 files changed, 931 insertions(+)
> > > > > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-
> > > > 66471.patch
> > > >
> > > > This seems like a very large patch for a CVE issue. The changelog entry
> > > > in the patch also says that the API of urllib3.response.ContentDecoder
> > > > is changed.
> > > >
> > > > We should look for a narrower fix, and only take this if there is no
> > > > other option.
> > >
> > > I originally didn't want to patch this CVE due to this reason (and didn't patch it in kirkstone).
> > > But since this has landed in scarthgap, I decided for the same in whinlatter for consistency.
> > > Should we revert it from scartghap?
> >
> > I don't think we need to rush to a decision.
>
> On my side, I need to do the whinlatter 5.3.1 release build on Monday.
> I propose to set this patch aside to not block the release and the other
> patches.

Agreed.

> For scarthgap, we can revert the current fix and add the "proper" fix
> when we have it. I'd rather avoid a patched->applicable transition on a CVE.

We don't need to do this immediately, let's take a little time to think
and see if others have any thoughts.

Ubuntu seem to have applied the patch with post-fixes :
https://git.launchpad.net/ubuntu/+source/python-urllib3/tree/debian/patches?h=ubuntu%2Fnoble-security
CVE-2025-66471.patch # the upstream patch
CVE-2025-66471-post1.patch # Remove brotli version warning
CVE-2025-66471-fix1.patch # Revert fix for zstd
CVE-2025-66471-fix2.patch # Fix zstandard using unknown attribute

but also, has deem the fix too intrusive for most maintained releases: https://ubuntu.com/security/CVE-2025-66471#status

Debian has not patched: https://security-tracker.debian.org/tracker/CVE-2025-66471
Intrusive to backport; requires update for src:brotli for effective fix
The fix requires an updated src:brotli >= 1.2.0 for the fix to be effective,
which adds the optional output_buffer_limit option to avoid these attacks.

--
Yoann Congal
Smile ECS

[-- Attachment #2: Type: text/html, Size: 10241 bytes --]