On Tue, Aug 25, 2026 at 05:01 PM, Yoann Congal wrote: > > > > Le jeu. 20 août 2026 à 11:11, Hetvi Thakar -X (hthakar - E INFOCHIPS > PRIVATE LIMITED at Cisco) < [email protected] > a écrit : > >> Hi Yoann, >> I hope you're doing well. >> I wanted to follow up on the patch below. It appears it may have been >> missed during the review process. Could you please take a look when you >> have a chance and share your feedback? >> Thank you for your time. >> > > Hello, > > It was not missed. I've answered that it lacked a master equivalent before > I can consider it for wrynose. > Has this changed? In that case, can you provide a link to the master > commit equivalent to this patch? > > Regards, > > >> Regards, >> Hetvi >> >> >> *From:* [email protected] < >> [email protected] >> > on behalf of Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at >> Cisco) via lists.openembedded.org ( http://lists.openembedded.org ) <hthakar= >> [email protected] > >> *Sent:* 23 July 2026 14:15 >> *To:* Yoann Congal < [email protected] >; >> [email protected] >> < [email protected] > >> *Cc:* xe-linux-external (Internal Group) < [email protected] > >> *Subject:* Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469 >> >> Hi, >> >> I reviewed the earlier series. >> It looks like the follow-up upstream regression fixes for >> CVE-2026-58469 and CVE-2026-58472 were not included in the backport. >> These follow-up commits are required to complete the backport, and I >> have included them in my series . >> I kindly request you to review my series as well. >> >> Thanks, >> Hetvi Thakar >> >> *From:* Yoann Congal < [email protected] > >> *Sent:* 22 July 2026 23:13 >> *To:* Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) < >> [email protected] >> >; [email protected] < >> >[email protected] >> > >> *Cc:* xe-linux-external (Internal Group) < [email protected] > >> *Subject:* Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469 >> >> On Wed Jul 22, 2026 at 12:12 PM CEST, Hetvi Thakar -X (hthakar - E >> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org ( >> http://lists.openembedded.org ) wrote: >> > From: Hetvi Thakar < [email protected] > >> > >> > This patch applies the upstream fix as referenced in [2], >> > using the commit shown in [1]. >> > >> > It also includes the upstream follow-up fixes referenced in [3] >> > and [4]. These correct the trailing whitespace check introduced >> > by the original fix and add the required <ctype.h> include for >> > isspace(). >> > >> > [1] >> > https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 >> ( >> https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 >> ) >> > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469 >> > [3] >> > https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf >> ( >> https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf >> ) >> > [4] >> > https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1 >> ( >> https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1 >> ) >> > >> > Signed-off-by: Hetvi Thakar < [email protected] > >> >> Hello, >> >> I received another similar series 2 hours before yours: >> https://patchwork.yoctoproject.org/project/oe-core/list/?series=48993 >> Can you help review it? >> >> Regards, >> -- >> Yoann Congal >> Smile ECS >> >> >> > > > > -- > Yoann Congal > Smile ECS > >
Hi, This was a series of four CVE fixes. The patches for the following three CVEs have already been merged into master: CVE-2026-58469: https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042 ( https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042 ) CVE-2026-58471: https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e ( https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e ) CVE-2026-58472: https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632 ( https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632 ) The remaining patch for CVE-2026-58470 has also been proposed for master: https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ ( https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ ) May you please review the remaining patch? Once it is reviewed, could you also proceed with the review of the corresponding wrynose and Scarthgap patches? Regards, Hetvi > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244237): https://lists.openembedded.org/g/openembedded-core/message/244237 Mute This Topic: https://lists.openembedded.org/mt/120391440/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
