mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-21 22:50:24 +00:00
Code Issues Projects Releases Wiki Activity

python3-simpleeval: Fix CVE-2026-32640

Browse Source 
Manually backport the three upstream security fixes for
CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3].

Include the required unhashable-container correction [4], which
prevents the recursive security checks from raising TypeError on
legitimate list and tuple values.

Harden the recursive callback-argument validation to inspect sets,
frozensets, and dictionary keys, and safely handle cyclic containers.
Add regression coverage for each of these cases.

Do not include the separate generator/coroutine hardening or the
optional performance follow-up. Omit the new ModuleWrapper API so this
stable-branch fix adds no unrelated public feature.

[1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498
[2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193
[3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5
[4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-09-01 06:57:22 +05:30
committed by Anuj Mittal
parent 97131550a8
commit 6752204aad
5 changed files with 824 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-python/recipes-devtools/python/python3-simpleeval_0.9.13.bb
+7 -1
View File
@@ -9,7 +9,13 @@ inherit pypi python_setuptools_build_meta ptest
BBCLASSEXTEND = "native nativesdk"
SRC_URI += "file://run-ptest"
SRC_URI += " \
file://CVE-2026-32640_p1.patch \
file://CVE-2026-32640_p2.patch \
file://CVE-2026-32640_p3.patch \
file://CVE-2026-32640_p4.patch \
file://run-ptest \
"
RDEPENDS:${PN} += " \
python3-math \