From 4dfdb53c8ac5bfd525b45686279ac5891aabd872 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Mon, 25 Apr 2022 12:24:44 +0100 Subject: [PATCH] python3: ignore CVE-2015-20107 CVE-2015-20107 describes an arbitrary command execution in the mailcap module, but this is by design in mailcap and needs to be worked around by the calling application. Upstream Python will be documenting this flaw in the library reference, and it is likely that the mailcap module will be deprecated and removed in the future. (From OE-Core rev: 1ed7bb74d35f08af3babf73c68ee01af5f28a50b) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 85fac8408baf92d8b71946f5bfea92952b7eab01) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- meta/recipes-devtools/python/python3_3.8.13.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-devtools/python/python3_3.8.13.bb b/meta/recipes-devtools/python/python3_3.8.13.bb index d7f6e9155d..040bacf97c 100644 --- a/meta/recipes-devtools/python/python3_3.8.13.bb +++ b/meta/recipes-devtools/python/python3_3.8.13.bb @@ -57,6 +57,9 @@ CVE_CHECK_WHITELIST += "CVE-2019-18348" # This is windows only issue. CVE_CHECK_WHITELIST += "CVE-2020-15523 CVE-2022-26488" +# The mailcap module is insecure by design, so this can't be fixed in a meaningful way. +# The module will be removed in the future and flaws documented. +CVE_CHECK_WHITELIST += "CVE-2015-20107" PYTHON_MAJMIN = "3.8"