From 53abba638b08b5efb36f3a763d86a0a1fa085eec Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Wed, 7 Jan 2026 10:27:48 +0100 Subject: [PATCH] python3-m2crypto: ignore CVE-2009-0127 Details: https://nvd.nist.gov/vuln/detail/CVE-2009-0127 The vulnerability is disputed[1] by upstream: "There is no vulnerability in M2Crypto. Nowhere in the functions are the return values of OpenSSL functions interpreted incorrectly. The functions provide an interface to their users that may be considered confusing, but is not incorrect, nor it is a vulnerability." [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0127 Signed-off-by: Gyorgy Sarvari --- meta-python/recipes-devtools/python/python3-m2crypto_0.38.0.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-m2crypto_0.38.0.bb b/meta-python/recipes-devtools/python/python3-m2crypto_0.38.0.bb index 155a9066ca..8fc9c9ce4f 100644 --- a/meta-python/recipes-devtools/python/python3-m2crypto_0.38.0.bb +++ b/meta-python/recipes-devtools/python/python3-m2crypto_0.38.0.bb @@ -45,4 +45,7 @@ export SWIG_FEATURES export STAGING_DIR +# disputed, upstream claims there is no bug +CVE_CHECK_IGNORE = "CVE-2009-0127" + BBCLASSEXTEND = "native"