mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-18 07:10:32 +00:00
Gyorgy Sarvari
0febf2f87d
The default "python:tornado" CVE_PRODUCT doesn't match relevant CVEs, because
the project's CPE is "tornadoweb:tornado".
See cve db query (docmosis is an irrelevant vendor):
sqlite> select * from products where PRODUCT = 'tornado';
CVE-2012-2374|tornadoweb|tornado|||2.2|<=
CVE-2012-2374|tornadoweb|tornado|1.0|=||
CVE-2012-2374|tornadoweb|tornado|1.0.1|=||
CVE-2012-2374|tornadoweb|tornado|1.1|=||
CVE-2012-2374|tornadoweb|tornado|1.1.1|=||
CVE-2012-2374|tornadoweb|tornado|1.2|=||
CVE-2012-2374|tornadoweb|tornado|1.2.1|=||
CVE-2012-2374|tornadoweb|tornado|2.0|=||
CVE-2012-2374|tornadoweb|tornado|2.1|=||
CVE-2012-2374|tornadoweb|tornado|2.1.1|=||
CVE-2014-9720|tornadoweb|tornado|||3.2.2|<
CVE-2023-25264|docmosis|tornado|||2.9.5|<
CVE-2023-25265|docmosis|tornado|||2.9.5|<
CVE-2023-25266|docmosis|tornado|||2.9.5|<
CVE-2023-28370|tornadoweb|tornado|||6.3.2|<
CVE-2024-42733|docmosis|tornado|||2.9.7|<=
CVE-2024-52804|tornadoweb|tornado|||6.4.2|<
CVE-2025-47287|tornadoweb|tornado|||6.5.0|<
CVE-2025-67724|tornadoweb|tornado|||6.5.3|<
CVE-2025-67725|tornadoweb|tornado|||6.5.3|<
CVE-2025-67726|tornadoweb|tornado|||6.5.3|<
Set the CVE_PRODUCT accordingly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 139cc15de3)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
50 lines
1.5 KiB
BlitzBasic
50 lines
1.5 KiB
BlitzBasic
SUMMARY = "Tornado is an open source version of the scalable, non-blocking web server and tools that power FriendFeed."
|
|
DESCRIPTION = "Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. \
|
|
By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long \
|
|
polling, WebSockets, and other applications that require a long-lived connection to each user."
|
|
HOMEPAGE = "http://www.tornadoweb.org/en/stable/"
|
|
LICENSE = "Apache-2.0"
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
|
|
|
|
SRC_URI[sha256sum] = "92bad5b4746e9879fd7bf1eb21dce4e3fc5128d71601f80005afa39237ad620b"
|
|
|
|
SRC_URI += "file://CVE-2025-47287.patch \
|
|
file://CVE-2025-67724.patch \
|
|
file://CVE-2025-67726.patch \
|
|
file://CVE-2026-35536.patch \
|
|
"
|
|
|
|
inherit pypi python_setuptools_build_meta
|
|
|
|
# Requires _compression which is currently located in misc
|
|
RDEPENDS:${PN} += " \
|
|
python3-asyncio \
|
|
python3-certifi \
|
|
python3-compression \
|
|
python3-ctypes \
|
|
python3-email \
|
|
python3-html \
|
|
python3-json \
|
|
python3-misc \
|
|
python3-multiprocessing \
|
|
python3-numbers \
|
|
python3-pkgutil \
|
|
python3-pycurl \
|
|
python3-threading \
|
|
python3-unittest \
|
|
"
|
|
|
|
RDEPENDS:${PN}-test += "python3-unittest"
|
|
|
|
PACKAGES =+ "\
|
|
${PN}-test \
|
|
"
|
|
|
|
FILES:${PN}-test = " \
|
|
${PYTHON_SITEPACKAGES_DIR}/*/test \
|
|
"
|
|
|
|
CVE_PRODUCT = "tornadoweb:tornado"
|
|
|
|
BBCLASSEXTEND += "native nativesdk"
|