mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 18:50:13 +00:00
Code Issues Projects Releases Wiki Activity

python3-aiohttp: fix CVE-2025-69223

Browse Source 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The python3-brotli 1.2.0 upgrade commit [4] is omitted because
Scarthgap currently provides python3-brotli 1.1.0. Brotli 1.2.0
adds the bounded decompression API required by the upstream aiohttp
fix. Consequently, this backport disables optional Brotli response
decoding while retaining bounded decompression for the supported
zlib path.

[1] https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
[2] https://github.com/aio-libs/aiohttp/commit/92477c5a74c43dfe0474bd24f8de11875daa2298
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69223
[4] https://github.com/openembedded/meta-openembedded/commit/382e4de7d8b7d0e980fefcda7a06e5f20f5f26c0

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya
2026-09-01 10:18:04 +05:30
committed by Anuj Mittal
parent 10aeacf39f
commit 12088f5bdd
2 changed files with 849 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
+1
View File
@@ -15,6 +15,7 @@ SRC_URI += "file://CVE-2024-52304.patch \
file://CVE-2025-69229_p1.patch \
file://CVE-2025-69229_p2.patch \
file://CVE-2025-69227.patch \
file://CVE-2025-69223.patch \
"
CVE_STATUS[CVE-2026-34515] = "not-applicable-platform: Vulnerability only affects applications running on Windows"