mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-07 13:44:50 +00:00
Darsh Kelaiya
0517530717
This patch applies the reviewed upstream fix shown in [1]. The advisory identifying the fix is referenced in [4]. The follow-up from [2] is kept as a separate recipe patch. It adapts the declined WebSocket-upgrade replay from [3], applies the queue pause after replay, and includes the corresponding regression tests. The generated aiohttp/_http_parser.c changes are omitted. The recipe-time Cython regeneration introduced with CVE-2025-69224 regenerates that file from the patched _http_parser.pyx before the accelerated parser is compiled. [1] https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf [2] https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7 [3] https://github.com/aio-libs/aiohttp/commit/8943d34337c133aa2a33f1fd10a30950d8dcb20e [4] https://nvd.nist.gov/vuln/detail/CVE-2026-54273 Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
66 lines
2.2 KiB
BlitzBasic
66 lines
2.2 KiB
BlitzBasic
SUMMARY = "Async http client/server framework"
|
|
DESCRIPTION = "Asynchronous HTTP client/server framework for asyncio and Python"
|
|
HOMEPAGE = "https://github.com/aio-libs/aiohttp"
|
|
LICENSE = "Apache-2.0"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=748073912af33aa59430d3702aa32d41"
|
|
|
|
SRC_URI[sha256sum] = "edea7d15772ceeb29db4aff55e482d4bcfb6ae160ce144f2682de02f6d693551"
|
|
|
|
SRC_URI += "file://CVE-2024-52304.patch \
|
|
file://CVE-2025-53643.patch \
|
|
file://CVE-2025-69224.patch \
|
|
file://CVE-2025-69225.patch \
|
|
file://CVE-2025-69226.patch \
|
|
file://CVE-2025-69228.patch \
|
|
file://CVE-2025-69229_p1.patch \
|
|
file://CVE-2025-69229_p2.patch \
|
|
file://CVE-2025-69227.patch \
|
|
file://CVE-2025-69223.patch \
|
|
file://CVE-2026-22815.patch \
|
|
file://CVE-2026-34514.patch \
|
|
file://CVE-2026-34513.patch \
|
|
file://CVE-2026-34993.patch \
|
|
file://CVE-2026-34518.patch \
|
|
file://CVE-2026-34519.patch \
|
|
file://CVE-2026-34516.patch \
|
|
file://CVE-2026-34517.patch \
|
|
file://CVE-2026-34520.patch \
|
|
file://CVE-2026-34525_p1.patch \
|
|
file://CVE-2026-34525_p2.patch \
|
|
file://CVE-2026-47265.patch \
|
|
file://CVE-2026-50269.patch \
|
|
file://CVE-2026-54274.patch \
|
|
file://CVE-2026-54275.patch \
|
|
file://CVE-2026-54277.patch \
|
|
file://CVE-2026-54278.patch \
|
|
file://CVE-2026-54279.patch \
|
|
file://CVE-2026-54273_p1.patch \
|
|
file://CVE-2026-54273_p2.patch \
|
|
"
|
|
|
|
CVE_STATUS[CVE-2026-34515] = "not-applicable-platform: Vulnerability only affects applications running on Windows"
|
|
|
|
PYPI_PACKAGE = "aiohttp"
|
|
inherit python_setuptools_build_meta pypi
|
|
|
|
DEPENDS += "python3-cython-native"
|
|
|
|
do_configure:prepend() {
|
|
cython3 -3 -Werror \
|
|
-I ${S}/aiohttp \
|
|
-o ${S}/aiohttp/_http_parser.c \
|
|
${S}/aiohttp/_http_parser.pyx
|
|
}
|
|
|
|
RDEPENDS:${PN} = "\
|
|
python3-aiohappyeyeballs \
|
|
python3-aiosignal \
|
|
python3-async-timeout \
|
|
python3-attrs \
|
|
python3-frozenlist \
|
|
python3-misc \
|
|
python3-multidict \
|
|
python3-yarl \
|
|
python3-aiodns \
|
|
"
|