Bug 2440397

Summary:	Dependency on python-diskcache CVE-2025-69872
Product:	[Fedora] Fedora	Reporter:	Benson Muite <benson_muite>
Component:	python-py-key-value	Assignee:	RHEL Lightspeed Maint <rhel-lightspeed>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	carl, carlwgeorge, rhel-lightspeed
Target Milestone:	---	Flags:	fedora-admin-xmlrpc: mirror+
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-29 19:12:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Benson Muite 2026-02-17 17:10:14 UTC

python3-py-key-value-aio+disk has a dependency on python-diskcache and maybe affected by the above CVE.

Reproducible: Always

Comment 1 Fedora Admin user for bugzilla script actions 2026-02-24 01:02:22 UTC

This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.

Comment 2 Carl George 🤠 2026-05-29 19:12:18 UTC

This was fixed in python-diskcache (bug 2439090).

https://src.fedoraproject.org/rpms/python-diskcache/c/59e1e8b8975688967bb7c248f0666dad005fc834?branch=rawhide

There is no reason to also have a bug for this package.  The dependency has no upper bound so it isn't blocked.  We're not going to arbitrarily set a higher minimum version to force the security update.