mirror of
https://git.yoctoproject.org/poky
synced 2026-05-29 12:09:36 +00:00
Hongxu Jia
af06cbf82b
According to [1] which provided the fix link [2], but upstream author reworked it later [3][4][5] Backport and rebase all the patches for tracing [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5569 [2] https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd [3] https://github.com/jaraco/zipp/commit/3cb5609002263eb19f7b5efda82d96f1f57fe876 [4] https://github.com/jaraco/zipp/commit/f89b93f0370dd85d23d243e25dfc1f99f4d8de48 [5] https://github.com/jaraco/zipp/commit/cc61e6140f0dfde2ff372db932442cf6df890f09 (From OE-Core rev: 13bd99e17f0aca108839e81e9aa0b14351116fdf) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
31 lines
916 B
Diff
31 lines
916 B
Diff
From 8b09dbf95b3ba78a63f220941e31ac92f4ad192c Mon Sep 17 00:00:00 2001
|
|
From: "Jason R. Coombs" <jaraco@jaraco.com>
|
|
Date: Wed, 27 Nov 2024 23:31:57 -0800
|
|
Subject: [PATCH 2/5] Employ SanitizedNames in CompleteDirs. Fixes broken test.
|
|
|
|
Upstream-Status: Backport [https://github.com/jaraco/zipp/commit/58115d2be968644ce71ce6bcc9b79826c82a1806]
|
|
Remove test code
|
|
Rebase to v3.7.0
|
|
CVE: CVE-2024-5569
|
|
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
|
---
|
|
zipp.py | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/zipp.py b/zipp.py
|
|
index 8f0950f..29d2572 100644
|
|
--- a/zipp.py
|
|
+++ b/zipp.py
|
|
@@ -130,7 +130,7 @@ class SanitizedNames:
|
|
return joined + '/' * name.endswith('/')
|
|
|
|
|
|
-class CompleteDirs(zipfile.ZipFile):
|
|
+class CompleteDirs(SanitizedNames, zipfile.ZipFile):
|
|
"""
|
|
A ZipFile subclass that ensures that implied directories
|
|
are always included in the namelist.
|
|
--
|
|
2.25.1
|
|
|