Hello, I reviewed the patches from Hetvi and they seem good to me. I would propose to go forward with them instead of mine for scarthgap and wrynose branches. For the master branch I can send a v2 of the patches which include the follow-up regression fixes so that everything is covered.
Would it be fine for you? Kind Regards, Amaury ________________________________________ From: Yoann Congal <[email protected]> Sent: Sunday, 26 July 2026 22:48 To: Amaury Couderc; [email protected] Cc: Hetvi Thakar Subject: Re: [OE-core] [PATCH 1/5] wget: fix CVE-2026-58469 On Wed Jul 22, 2026 at 10:16 AM CEST, Amaury Couderc via lists.openembedded.org wrote: > From: Amaury Couderc <[email protected]> > > Backport patch to fix CVE-2026-58469. > > References: > https://nvd.nist.gov/vuln/detail/CVE-2026-58469 > https://www.cve.org/CVERecord?id=CVE-2026-58469 > https://security-tracker.debian.org/tracker/CVE-2026-58469 > https://ubuntu.com/security/CVE-2026-58469 > https://osv.dev/list?q=CVE-2026-58469 > > Upstream fix: > > https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 > [nvd] > > Signed-off-by: Amaury Couderc <[email protected]> > --- > .../wget/wget/CVE-2026-58469.patch | 52 +++++++++++++++++++ > meta/recipes-extended/wget/wget_1.25.0.bb | 1 + > 2 files changed, 53 insertions(+) > create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch Hello, Hetvi Thakar wrote[0] about a related series to wrynose: > I reviewed the earlier series. > It looks like the follow-up upstream regression fixes for > CVE-2026-58469 and CVE-2026-58472 were not included in the backport. > These follow-up commits are required to complete the backport, and I > have included them in my series . Hetvi, do you confirm this is missing here as well? In the meantime, I think we should hold this series since we suspect it's missing regression patches. [0]: https://lore.kernel.org/all/ph7pr11mb8598ab8f89b7886fd3ec9148ad...@ph7pr11mb8598.namprd11.prod.outlook.com/ Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242079): https://lists.openembedded.org/g/openembedded-core/message/242079 Mute This Topic: https://lists.openembedded.org/mt/120390806/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
