mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-15 04:57:15 +00:00
Code Issues Projects Releases Wiki Activity

python3-ply: set status for CVE-2025-56005

Browse Source 
PLY 3.11 contains the picklefile parameter described by
CVE-2025-56005, but exploitation requires an application to
explicitly pass an attacker-controlled pickle file to yacc().

No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
the same reason [1], and NVD records the CVE as disputed [2].

[1] https://ubuntu.com/security/CVE-2025-56005
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005

(From OE-Core rev: 9bce52b90a6783e0ba23ff048209ea88922fd1da)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hetvi Thakar authored and Paul Barker committed 2026-09-28 10:17:42 +01:00
1 parent 973d27f11f
commit 93ee59254c
1 file changed
+1
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/python/python3-ply_3.11.bb
+1
View File
@@ -16,5 +16,6 @@ RDEPENDS:${PN}:class-target += "\
"
CVE_PRODUCT = "dabeaz:ply"
CVE_STATUS[CVE-2025-56005] = "disputed: Exploitation requires application-specific use of PLY's picklefile parameter with attacker-controlled pickle data"
BBCLASSEXTEND = "native nativesdk"