From 973d27f11f0824a8a0eaf7d092ef128668c4585c Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Mon, 7 Sep 2026 05:37:20 -0700 Subject: [PATCH] python3-pip: set CVE_STATUS for CVE-2018-20225 Analysis: - NVD marks CVE-2018-20225 as disputed. [1] - pip searches all configured package indexes without priority and selects the highest matching version. --extra-index-url adds an equal-priority package source. [2] - Exploitation requires use of --extra-index-url and an attacker-published, higher-version package with the name of a private package. [1] - Upstream closed the related report as not planned, and Red Hat classified the issue as WONTFIX because this behavior is intentional. [3][4] - Record the disputed status; no source patch is available. Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225 [2] https://pip.pypa.io/en/stable/cli/pip_install/ [3] https://github.com/pypa/pip/issues/12874 [4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736 (From OE-Core rev: 34c0972ffea7dcf4888e3bcfe0ce17206b32e408) Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- meta/recipes-devtools/python/python3-pip_24.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb index d535e1f53d..709ec9f2b6 100644 --- a/meta/recipes-devtools/python/python3-pip_24.0.bb +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb @@ -45,6 +45,7 @@ do_install:append() { } CVE_PRODUCT = "pypa:pip" +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes" do_install:append(){ # pip vendors distlib which ships Windows launcher templates (*.exe).