RE: [OE-core][whinlatter 04/11] python3-urllib3: patch

Marko, Peter
2026-01-07T12:19:55Z

> -----Original Message-----
> From: Paul Barker <paul@pbarker.dev>
> Sent: Wednesday, January 7, 2026 12:49
> To: yoann.congal@smile.fr; openembedded-core@lists.openembedded.org;
> Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> Subject: Re: [OE-core][whinlatter 04/11] python3-urllib3: patch
>
> On Wed, 2026-01-07 at 09:08 +0100, Yoann Congal via
> lists.openembedded.org wrote:
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > Pick patch per [1].
> >
> > [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66471
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> > .../python3-urllib3/CVE-2025-66471.patch | 930 ++++++++++++++++++
> > .../python/python3-urllib3_2.5.0.bb | 1 +
> > 2 files changed, 931 insertions(+)
> > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-
> 66471.patch
>
> This seems like a very large patch for a CVE issue. The changelog entry
> in the patch also says that the API of urllib3.response.ContentDecoder
> is changed.
>
> We should look for a narrower fix, and only take this if there is no
> other option.

I originally didn't want to patch this CVE due to this reason (and didn't patch it in kirkstone).
But since this has landed in scarthgap, I decided for the same in whinlatter for consistency.
Should we revert it from scartghap?

Peter

>
> Thanks,
>
> --
> Paul Barker