2 Commits

Author	SHA1	Message	Date
mark.yang	59e6bf89f6	python3-aiodns: set CVE_PRODUCT and set status for CVE-2025-48945 ... The pypi class default python:aiodns doesn't match how aiodns is tracked in the CVE databases. NVD has no CPE for aiodns yet; the only existing record (CVE-2025-48945) carries aio-libs:aiodns in its CNA affected entry [1], so set that pair. CVE-2025-48945 itself is a use-after-free in pycares: the GHSA lives in the pycares repository [2] and the affected range "< 4.9.0" uses pycares version numbers (fixed in pycares 4.9.0 [3], we ship 5.0.1). Mark it cpe-incorrect so it doesn't get reported against aiodns. [1] https://www.cve.org/CVERecord?id=CVE-2025-48945 [2] https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35 [3] https://github.com/saghul/pycares/releases/tag/v4.9.0 Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>	2026-07-22 02:01:51 -07:00
Leon Anavi	c6c350150a	python3-aiodns: Upgrade 4.0.0 -> 4.0.4 ... Upgrade to release 4.0.4: - Raise DNSError(ARES_ENODATA) from query() when the answer section has no records of the requested qtype, restoring the pycares 4.x NODATA contract and avoiding AttributeError for CNAME/SOA/PTR callers - Add the missing build-backend entry to pyproject.toml so PEP 517 builds from the sdist work without falling back to the deprecated legacy setuptools backend Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>	2026-06-20 23:41:41 -07:00