Hello Yoann, I'll refresh the patch and send it again. Regards, Devansh Patel ________________________________ From: Yoann Congal <[email protected]> Sent: Wednesday, September 16, 2026 18:12 To: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Cc: xe-linux-external (Internal Group) <[email protected]> Subject: Re: [OE-core][wrynose][PATCH] vim: Fix CVE-2026-28417 hostname regression
On Wed Aug 26, 2026 at 7:30 AM CEST, Devansh Patel via lists.openembedded.org wrote: > From: Devansh Patel <[email protected]> > > The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw > hostname validation. That CVE fix requires follow-up regression patches > because it rejects valid hostnames containing optional ports or > underscores. > > Vim 9.2.0340 already contains that CVE fix and patch 9.2.0089, which > corrects optional-port handling. It still needs patch 9.2.0553 to accept > underscores, so backport that commit and retain its _gateway regression > test. > > The netrw history hunk is adapted to preserve Wrynose's existing > multi-line history and append the upstream 2026 May 28 entry. The > src/version.c hunk is omitted because this backport does not change the > recipe version or Vim's upstream patch-number table. > > [1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1 > [2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda > [3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11 > [4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336 > > Signed-off-by: Devansh Patel <[email protected]> > --- > .../files/CVE-2026-28417-regression_p1.patch | 64 +++++++++++++++++++ > meta/recipes-support/vim/vim.inc | 1 + > 2 files changed, 65 insertions(+) > create mode 100644 > meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch > > diff --git > a/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch > b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch > new file mode 100644 > index 0000000000..e6b81cc0ae > --- /dev/null > +++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch > @@ -0,0 +1,64 @@ > +From 2a49c9624cdd552ec975ee8b4f1853a0e4c2a78e Mon Sep 17 00:00:00 2001 > +From: Christian Brabandt <[email protected]> > +Date: Thu, 28 May 2026 20:53:53 +0000 > +Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames > + containing _ > + > +Problem: runtime(netrw): netrw rejects hostnames containing _ > + (lilydjwg) > +Solution: Relax the restriction and allow the underscore > + > +fixes: #20344 > + > +CVE: CVE-2026-28417 > +Upstream-Status: Backport > [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11] > + > +Backport Changes: > +- Preserved Wrynose's multi-line netrw change history and appended the > + upstream 2026 May 28 change instead of replacing it with a single date. > +- Omitted src/version.c because this backport does not change the recipe's > + Vim version or its upstream patch-number table. > + > +Signed-off-by: Christian Brabandt <[email protected]> > +(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11) > +Signed-off-by: Devansh Patel <[email protected]> > +--- > + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++-- > + src/testdir/test_plugin_netrw.vim | 1 + > + 2 files changed, 4 insertions(+), 2 deletions(-) Hello, Sorry, but this patch now fails to apply: ERROR: vim-9.2.0340-r0 do_patch: Applying patch 'meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch' on target directory 'bitbake-builds/wrynose/tmp/work/x86-64-v3-oe-linux/vim/9.2.0340/sources/vim-9.2.0340' CmdError('quilt --quiltrc bitbake-builds/wrynose/tmp/work/x86-64-v3-oe-linux/vim/9.2.0340/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-28417-regression_p1.patch patching file runtime/pack/dist/opt/netrw/autoload/netrw.vim Hunk #1 FAILED at 24. Hunk #2 succeeded at 2604 (offset 1 line). 1 out of 2 hunks FAILED -- rejects in file runtime/pack/dist/opt/netrw/autoload/netrw.vim patching file src/testdir/test_plugin_netrw.vim Patch CVE-2026-28417-regression_p1.patch does not apply (enforce with -f) stderr: ') Can you refresh and resend? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246191): https://lists.openembedded.org/g/openembedded-core/message/246191 Mute This Topic: https://lists.openembedded.org/mt/120932972/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
