mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-23 06:37:12 +00:00
mark.yang
59e6bf89f6
The pypi class default python:aiodns doesn't match how aiodns is tracked in the CVE databases. NVD has no CPE for aiodns yet; the only existing record (CVE-2025-48945) carries aio-libs:aiodns in its CNA affected entry [1], so set that pair. CVE-2025-48945 itself is a use-after-free in pycares: the GHSA lives in the pycares repository [2] and the affected range "< 4.9.0" uses pycares version numbers (fixed in pycares 4.9.0 [3], we ship 5.0.1). Mark it cpe-incorrect so it doesn't get reported against aiodns. [1] https://www.cve.org/CVERecord?id=CVE-2025-48945 [2] https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35 [3] https://github.com/saghul/pycares/releases/tag/v4.9.0 Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
22 lines
679 B
BlitzBasic
22 lines
679 B
BlitzBasic
SUMMARY = "Simple DNS resolver for asyncio"
|
|
DESCRIPTION = "aiodns provides a simple way for doing asynchronous DNS resolutions using pycares."
|
|
HOMEPAGE = "https://github.com/saghul/aiodns"
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=d574ab425d1fcb37c9f1ad3961f18527"
|
|
|
|
SRC_URI[sha256sum] = "cb10e0c0d2591636716ad2fe402e977c16d71bdaf76bb8cb49e8a6633596f736"
|
|
|
|
inherit pypi python_setuptools_build_meta
|
|
|
|
DEPENDS += "python3-pycares-native"
|
|
|
|
RDEPENDS:${PN} += " \
|
|
python3-asyncio \
|
|
python3-pycares \
|
|
"
|
|
|
|
CVE_PRODUCT = "aio-libs:aiodns"
|
|
CVE_STATUS[CVE-2025-48945] = "cpe-incorrect: this CVE is for pycares, fixed in pycares 4.9.0"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|