mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-11 08:43:58 -09:00
aebe1b2054
- CVE-2026-27448:
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in
version 0.14.0 and prior to version 26.0.0, if a user provided
callback to `set_tlsext_servername_callback` raised an unhandled
exception, this would result in a connection being accepted. If a user
was relying on this callback for any security-sensitive behavior, this
could allow bypassing it. Starting in version 26.0.0, unhandled
exceptions now result in rejecting the connection.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27448
- d41a814759
- CVE-2026-27459:
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in
version 22.0.0 and prior to version 26.0.0, if a user provided
callback to `set_cookie_generate_callback` returned a cookie value
greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided
buffer. Starting in version 26.0.0, cookie values that are too long
are now rejected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27459
- 57f09bb4bb
(cherry picked from commit 7bcba8498b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
23 lines
808 B
Makefile
23 lines
808 B
Makefile
################################################################################
|
|
#
|
|
# python-pyopenssl
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_PYOPENSSL_VERSION = 25.0.0
|
|
PYTHON_PYOPENSSL_SOURCE = pyopenssl-$(PYTHON_PYOPENSSL_VERSION).tar.gz
|
|
PYTHON_PYOPENSSL_SITE = https://files.pythonhosted.org/packages/9f/26/e25b4a374b4639e0c235527bbe31c0524f26eda701d79456a7e1877f4cc5
|
|
PYTHON_PYOPENSSL_LICENSE = Apache-2.0
|
|
PYTHON_PYOPENSSL_LICENSE_FILES = LICENSE
|
|
PYTHON_PYOPENSSL_CPE_ID_VENDOR = pyopenssl
|
|
PYTHON_PYOPENSSL_CPE_ID_PRODUCT = pyopenssl
|
|
PYTHON_PYOPENSSL_SETUP_TYPE = setuptools
|
|
|
|
# 0001-CVE-2026-27448.patch
|
|
PYTHON_PYOPENSSL_IGNORE_CVES += CVE-2026-27448
|
|
|
|
# 0002-CVE-2026-27459.patch
|
|
PYTHON_PYOPENSSL_IGNORE_CVES += CVE-2026-27459
|
|
|
|
$(eval $(python-package))
|