From: Tim Orling Date: Sun, 9 Aug 2026 23:21:05 +0000 (-0700) Subject: python3-wheel: fix CVE_PRODUCT X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fe55278e01bbe434452191109278b436bf008ebc;p=thirdparty%2Fopenembedded%2Fopenembedded-core.git python3-wheel: fix CVE_PRODUCT The proper CVE_PRODUCT is "wheel_project:wheel". BEFORE: python:wheel -> 0 CVEs AFTER: wheel_project:wheel -> 2 CVEs * Already patched at 0.47.0. - CVE-2022-40898 — DoS in wheel CLI via malicious input. Affects <0.38.1. - CVE-2026-24049 — malicious wheel file can modify permissions of arbitrary files. Affects 0.40.0–<0.46.2. AI-Generated: Claude Sonnet 5 Signed-off-by: Tim Orling Signed-off-by: Richard Purdie --- diff --git a/meta/recipes-devtools/python/python3-wheel_0.47.0.bb b/meta/recipes-devtools/python/python3-wheel_0.47.0.bb index 88b54c2ee2..4320442729 100644 --- a/meta/recipes-devtools/python/python3-wheel_0.47.0.bb +++ b/meta/recipes-devtools/python/python3-wheel_0.47.0.bb @@ -8,6 +8,8 @@ SRC_URI[sha256sum] = "cc72bd1009ba0cf63922e28f94d9d83b920aa2bb28f798a31d0691b02f inherit python_flit_core pypi ptest-python-pytest +CVE_PRODUCT = "wheel_project:wheel" + RDEPENDS:${PN} += "python3-packaging" # One test is skipped but requires the "full" python3-flit, not just python3-flit-core