mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-13 03:37:15 +00:00
python3-virtualenv: Ignore CVE-2026-113718
Analysis: - The advisory [1] limits this issue to Xonsh activation in versions 21.3.0 through 21.14.8. - Version 21.2.1 has no Xonsh activator, activate.xsh template or registered entry point. None of the existing backports adds them. - The upstream fix [2] changes the absent Xonsh quoting code, so it is not applicable to this recipe. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf [2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
1 parent
45909e98d3
commit
c50217eae4
1 file changed
+1
@@ -55,3 +55,4 @@ CVE_PRODUCT = "virtualenv"
|
||||
|
||||
# The batch activator only supports Windows interpreters.
|
||||
CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}"
|
||||
CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1"
|
||||
Reference in new issue
Block a user