]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core.git/commit
python3: update CVE product
authorPeter Marko <peter.marko@siemens.com>
Wed, 9 Jul 2025 18:51:41 +0000 (20:51 +0200)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Mon, 14 Jul 2025 16:49:06 +0000 (17:49 +0100)
commit446df2e29495e615dd6d95b158dd37363830cd3e
tree2afc11901deecac253e8e1549187d5b18471565b
parenta3cc5038ea10a4857627e6f4de25bdc43023a349
python3: update CVE product

There are two "new" CVEs reported for python3, their CPEs are:
* CVE-2020-1171: cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:* (< 2020.5.0)
* CVE-2020-1192: cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:* (< 2020.5.0)
These are for "Visual Studio Code Python extension".

Solve this by addding CVE vendor to python CVE product to avoid
confusion with Microsoft as vendor.

Examining CVE DB for historical python entries shows:
sqlite> select vendor, product, count(*) from products where product = 'python' or product = 'cpython'
   ...> or product like 'python%3' group by vendor, product;
microsoft|python|2
python|python|1054
python_software_foundation|python|2

Note that this already shows that cpython product is not used, so
CVE-2023-33595 mentioned in 62598e1138f21a16d8b1cdd1cfe902aeed854c5c
was updated.
But let's keep it for future in case new CVE starts with that again.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/recipes-devtools/python/python3_3.13.5.bb