mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 06:40:17 +00:00
Code Issues Projects Releases Wiki Activity
31,152 Commits 64 Branches 0 Tags
b9534a154d688228417e8467b7f72d4e5759eba0
Commit Graph
7 Commits
Author SHA1 Message Date
Gyorgy Sarvari d348bf9a61 python3-twisted: set CVE_PRODUCT 
The related CVEs are tracked with twisted:twisted CPE, so the
default python:twisted CPE doesn't match any entries.

See CVE db query:
sqlite> select * from products where PRODUCT = 'twisted';
CVE-2014-7143|twisted|twisted|14.0.0|=||
CVE-2016-1000111|twisted|twisted|||16.3.1|<
CVE-2019-12387|twisted|twisted|||19.2.1|<
CVE-2019-12855|twisted|twisted|||19.2.1|<=
CVE-2020-10108|twisted|twisted|||19.10.0|<=
CVE-2020-10109|twisted|twisted|||19.10.0|<=
CVE-2022-21712|twisted|twisted|11.1.0|>=|22.1.0|<
CVE-2022-21716|twisted|twisted|21.7.0|>=|22.2.0|<
CVE-2022-24801|twisted|twisted|||22.4.0|<
CVE-2022-39348|twisted|twisted|0.9.4|>=|22.10.0|<
CVE-2023-46137|twisted|twisted|||22.8.0|<=
CVE-2024-41810|twisted|twisted|||24.3.0|<=

Set the CVE_PRODUCT accordingly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a89ab32230)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Hetvi Thakar 35f85f87b8 python3-twisted: Fix CVE-2026-42304 
This patch applies the upstream 26.4.0rc2 backport for
CVE-2026-42304. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch header
because the fix expands to multiple commits.

[1] https://github.com/twisted/twisted/commit/2d196123264efb0027eecfe1b430be4a9babdbd8
[2] https://github.com/advisories/GHSA-grgv-6hw6-v9g4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Ankur Tyagi cb4570120b python3-twisted: patch CVE-2024-41810 
Though nvd[1] mentions commit[2] as part of the fix for CVE-2024-41671, but
it is actually a fix[3] for CVE-2024-41810.

Rename patch files accordingly.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-41671
[2] https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33
[3] https://nvd.nist.gov/vuln/detail/CVE-2024-41810

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-26 10:04:49 +05:30
Soumya Sambu 1235dd4ed4 python3-twisted: Fix CVE-2024-41671 
Twisted is an event-based framework for internet applications, supporting
Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process
pipelined HTTP requests out-of-order, possibly resulting in information
disclosure. This vulnerability is fixed in 24.7.0rc1.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-41671

Upstream-patches:
https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33
https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2024-08-25 15:15:10 -04:00
Guðni Már Gilbert 4d17537719 python3-twisted: remove obsolete python3-twisted-flow 
The flow module was removed in Twisted 9.0.0 a long time
and currently does not install anything. Let's remove it
to cleanup the recipe.

This commit also removes python3-twisted-news package because
the source files were removed in Twisted 21.2.0. All other
files which no longer exist in the source are also removed from FILES.

Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2024-06-17 09:01:41 -04:00
Guðni Már Gilbert 3a0c50ec5e python3-twisted: prepend split PACKAGES 
Fixes an issue where split packages were no populated since all the files
were picked up by FILES:${PN}

Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2024-06-17 09:01:27 -04:00
Guðni Már Gilbert a57eea75cd python3-twisted: upgrade 22.10.0 -> 24.3.0 
Changelogs between 22.10.0 and 24.3.0 can be found here:

https://github.com/twisted/twisted/releases/tag/twisted-24.3.0
https://github.com/twisted/twisted/releases/tag/twisted-23.10.0
https://github.com/twisted/twisted/releases/tag/twisted-23.8.0

Summary of changes relevant for the Yocto build:
- Brings official support for Python 3.11 and 3.12, only Python 3.8 and above supported.
- python3-twisted-conch: python3-pyasn1 is no longer a runtime dependency (23.8.0)
- build backend changed from setuptools.build_meta to hatchling.build

Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2024-04-30 10:59:07 -07:00