On Tue, Aug 25, 2026 at 06:56 PM, Yoann Congal wrote: > > On Tue Aug 25, 2026 at 3:07 PM CEST, Hetvi Thakar -X (hthakar - E > INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > >> On Tue, Aug 25, 2026 at 05:01 PM, Yoann Congal wrote: >> >>> Le jeu. 20 août 2026 à 11:11, Hetvi Thakar -X (hthakar - E INFOCHIPS >>> PRIVATE LIMITED at Cisco) < [email protected] > a écrit : >>> >>> >>>> Hi Yoann, >>>> I hope you're doing well. >>>> I wanted to follow up on the patch below. It appears it may have been >>>> missed during the review process. Could you please take a look when you >>>> have a chance and share your feedback? >>>> Thank you for your time. >>> >>> It was not missed. I've answered that it lacked a master equivalent before >>> >>> I can consider it for wrynose. >>> Has this changed? In that case, can you provide a link to the master >>> commit equivalent to this patch? >> >> Hi, > > Hello, > > >> This was a series of four CVE fixes. The patches for the following >> three CVEs have already been merged into master: >> >> CVE-2026-58469: >> https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042 >> >> >> CVE-2026-58471: >> https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e >> >> >> CVE-2026-58472: >> https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632 >> > > I can consider those 3 (hoping for not conflict). > > >> The remaining patch for CVE-2026-58470 has also been proposed for >> master: >> >> https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ >> >> >> May you please review the remaining patch? > > This patch is in the "Superseeded" state and is from a month ago. You > can answer on it asking for its status. > > >> Once it is reviewed, could you also proceed with the review of the >> corresponding wrynose and Scarthgap patches? > > I regularly re-evaluate the "Awaiting Upstream" patches but you can > expedite this process by pinging here when you see the patch landing on > master. > In this case, we wait for "wget: fix CVE-2026-58470" landing on master. > > Regards, > -- > Yoann Congal > Smile ECS
Hi Yoann, Thanks for the review. I have submitted the master patch for CVE-2026-58470 wget: Fix CVE-2026-58470 - Patchwork ( https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ ) Could you please take a look at it at your convenience? Regards, Hetvi
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244458): https://lists.openembedded.org/g/openembedded-core/message/244458 Mute This Topic: https://lists.openembedded.org/mt/120391440/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
