mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 06:40:17 +00:00
Code Issues Projects Releases Wiki Activity
31,177 Commits 64 Branches 0 Tags
b1fdc4d1790879a97a42ffcc78af04c37dd4a986
Commit Graph
3 Commits
Author SHA1 Message Date
Devansh Patel 5891d513a9 python3-web3: add CVE_PRODUCT mapping 
The current inherited "python:web3" mapping does not match the web3.py
identities used by NVD and CVE List V5, so its source-aligned CVE is
missed.

Use "ethereum:web3.py" for the CNA affected-data identity and
"apeworx:web3.py" for the NVD dictionary CPE and NVD configuration
identity.

Backport note: Scarthgap has web3.py 6.17.0 rather than 7.16.0;
CVE-2026-40072 applies to this release and is reported as unpatched.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 19ecb40f50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Hetvi Thakar 016908224f python3-web3: Fix CVE-2026-40072 
This patch applies the v7 upstream fix for CVE-2026-40072 shown in [1].
The security advisory [2] references the patch-equivalent v8/main fix [3].
The v7 commit was selected because it is the nearest source baseline to
Scarthgap's web3.py 6.17.0 recipe.

[1] https://github.com/ApeWorX/web3.py/commit/d62e67d3b636bd4c5a929696c0f5c4167c31625b
[2] https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2
[3] https://github.com/ApeWorX/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Wang Mingyu ebe7193982 python3-web3: upgrade 6.16.0 -> 6.17.0 
Changelog:
===========
-Add feedback survey banner to docs
-Fix eth_createAccessList docs to reflect the correct behavior.
-Add request formatter for maxFeePerBlobGas when sending blob transactions. Add
 formatters for blobGasPrice and blobGasUsed for eth_getTransactionReceipt.
-Add formatters to ensure that the result of a eth_createAccessList response
 can be plugged directly into an accessList in a transaction.
-Add Cancun support to EthereumTesterProvider; update Cancun-related fields in
 some internal types.
-Use pre-commit for linting the v6 branch
-Add an upperpin at eth-typing<4.2.0 due to removal of EthPM types in that lib

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2024-04-21 10:52:48 -07:00