From 1f86ceb4c8bcf8713063d719aac55de0613abb13 Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Tue, 3 Nov 2026 12:23:41 +0200 Subject: [PATCH] python3-oauthlib: Upgrade 4.0.0 -> 4.0.1 Upgrade to release 4.0.1: - CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the device_code parameter. A request with a known client_id and a bogus device_code could obtain a bearer token. DeviceCodeGrant.validate_token_request now calls DeviceCodeGrant.validate_device_code(), which rejects missing or unknown device codes (invalid_request / invalid_grant) and delegates the code's authorization status to the new RequestValidator.validate_device_code() hook, per RFC 8628 Section 3.5. Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- .../{python3-oauthlib_4.0.0.bb => python3-oauthlib_4.0.1.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-oauthlib_4.0.0.bb => python3-oauthlib_4.0.1.bb} (92%) diff --git a/meta-python/recipes-devtools/python/python3-oauthlib_4.0.0.bb b/meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb similarity index 92% rename from meta-python/recipes-devtools/python/python3-oauthlib_4.0.0.bb rename to meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb index 8c6252595b..b3a7281aa6 100644 --- a/meta-python/recipes-devtools/python/python3-oauthlib_4.0.0.bb +++ b/meta-python/recipes-devtools/python/python3-oauthlib_4.0.1.bb @@ -4,7 +4,7 @@ HOMEPAGE = "https://github.com/idan/oauthlib" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=2699a9fb0d71d5eafd75d8d7c302f7df" -SRC_URI[sha256sum] = "efb274799819440f95b4ab3b818869f1ce9ae26c5beacba0201d1a1b76b54f86" +SRC_URI[sha256sum] = "3d73febdb6faa00f277c81fb04be7b7586fb96fc3b7f0b9c772dada69a25ede7" CVE_PRODUCT = "oauthlib"