| Message ID | 20220425112444.3890059-1-ross.burton@arm.com |
|---|---|
| State | Accepted, archived |
| Commit | 85fac8408baf92d8b71946f5bfea92952b7eab01 |
| Headers | show |
| Series | python3: ignore CVE-2015-20107 | expand |
diff --git a/meta/recipes-devtools/python/python3_3.10.4.bb b/meta/recipes-devtools/python/python3_3.10.4.bb index 7eaafe34ad..d678d55083 100644 --- a/meta/recipes-devtools/python/python3_3.10.4.bb +++ b/meta/recipes-devtools/python/python3_3.10.4.bb @@ -55,6 +55,9 @@ CVE_CHECK_IGNORE += "CVE-2007-4559" CVE_CHECK_IGNORE += "CVE-2019-18348" # These are specific to Microsoft Windows CVE_CHECK_IGNORE += "CVE-2020-15523 CVE-2022-26488" +# The mailcap module is insecure by design, so this can't be fixed in a meaningful way. +# The module will be removed in the future and flaws documented. +CVE_CHECK_IGNORE += "CVE-2015-20107" PYTHON_MAJMIN = "3.10"
CVE-2015-20107 describes an arbitrary command execution in the mailcap module, but this is by design in mailcap and needs to be worked around by the calling application. Upstream Python will be documenting this flaw in the library reference, and it is likely that the mailcap module will be deprecated and removed in the future. Signed-off-by: Ross Burton <ross.burton@arm.com> --- meta/recipes-devtools/python/python3_3.10.4.bb | 3 +++ 1 file changed, 3 insertions(+)