 Hetvi Thakar
|
81c4f97c54
|
python3-mako: Fix CVE-2026-41205
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].
The backport makes Template URI normalization strip all leading
slashes, preventing a double-slash URI from bypassing the path
traversal check while keeping Mako at version 1.3.2.
[1] https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
[2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm
(From OE-Core rev: 0c13fdc7798a24dadb60b7dba60049558bf5c021)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
2026-09-11 14:32:08 +01:00 |
|