mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-12 15:31:45 +00:00
a8369be5ee
As per CVE reference, version 3.2.1 fixes the CVE-2022-36087 issue. But after upgrading the python3-oauthlib version
to 3.2.1, observed that the vulnerable code lines are still available. The same observations were reported here in github at
https://github.com/oauthlib/oauthlib/issues/837 and found that it was a mistake during 3.2.1 release preparation and due to
which vulnerable code was still existing in 3.2.1 source code.
To fix CVE-2022-36087 issue, we need to upgrade python3-oauthlib to 3.2.2 version and here are the changelog of version 3.2.2
https://github.com/oauthlib/oauthlib/blob/v3.2.2/CHANGELOG.rst
Reference :
https://nvd.nist.gov/vuln/detail/CVE-2022-36087
Upstream fix :
2e40b412c8
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
23 lines
1.1 KiB
BlitzBasic
23 lines
1.1 KiB
BlitzBasic
SUMMARY = "A generic, spec-compliant, thorough implementation of the OAuth request-signing logic"
|
|
HOMEPAGE = "https://github.com/idan/oauthlib"
|
|
|
|
LICENSE = "BSD-3-Clause"
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=abd2675e944a2011aed7e505290ba482"
|
|
|
|
SRC_URI[sha256sum] = "9859c40929662bec5d64f34d01c99e093149682a3f38915dc0655d5a633dd918"
|
|
|
|
inherit pypi setuptools3
|
|
|
|
# The following configs & dependencies are from setuptools extras_require.
|
|
# These dependencies are optional, hence can be controlled via PACKAGECONFIG.
|
|
# The upstream names may not correspond exactly to bitbake package names.
|
|
#
|
|
# Uncomment this line to enable all the optional features.
|
|
#PACKAGECONFIG ?= "test signedtoken signals rsa"
|
|
PACKAGECONFIG[test] = ",,,${PYTHON_PN}-blinker ${PYTHON_PN}-cryptography ${PYTHON_PN}-pytest ${PYTHON_PN}-pyjwt"
|
|
PACKAGECONFIG[signedtoken] = ",,,${PYTHON_PN}-cryptography ${PYTHON_PN}-pyjwt"
|
|
PACKAGECONFIG[signals] = ",,,${PYTHON_PN}-blinker"
|
|
PACKAGECONFIG[rsa] = ",,,${PYTHON_PN}-cryptography"
|
|
|
|
RDEPENDS:${PN} += "${PYTHON_PN}-core ${PYTHON_PN}-crypt ${PYTHON_PN}-datetime ${PYTHON_PN}-json ${PYTHON_PN}-logging ${PYTHON_PN}-math ${PYTHON_PN}-netclient ${PYTHON_PN}-unittest"
|