* [OE-core][wrynose][PATCH v2] vim: Fix CVE-2026-28417 hostname regression
@ 2026-09-18 10:06 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-18 10:10 ` Devansh Patel
0 siblings, 1 reply; 3+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-18 10:06 UTC (permalink / raw)
To: openembedded-devel; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw
hostname validation. That CVE fix requires follow-up regression patches
because it rejects valid hostnames containing optional ports or
underscores.
Vim 9.2.0340 already contains that CVE fix and patch 9.2.0089, which
corrects optional-port handling. It still needs patch 9.2.0553 to accept
underscores, so backport that commit and retain its _gateway regression
test.
The netrw history hunk is adapted to preserve Wrynose's existing
multi-line history and append the upstream 2026 May 28 entry. The
src/version.c hunk is omitted because this backport does not change the
recipe version or Vim's upstream patch-number table.
[1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1
[2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda
[3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11
[4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
Changes in v2:
- Refreshed the patch against current Wrynose so the netrw history hunk applies cleanly.
- Renamed the embedded patch because Wrynose requires only one regression commit.
- Clarified the netrw header adaptation in Backport Changes.
.../vim/files/CVE-2026-28417-regression.patch | 65 +++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 66 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch b/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
new file mode 100644
index 0000000000..e5d947b737
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
@@ -0,0 +1,65 @@
+From a058d0dcd289ddb934b30125ac732f737bf89eb7 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 28 May 2026 20:53:53 +0000
+Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames
+ containing _
+
+Problem: runtime(netrw): netrw rejects hostnames containing _
+ (lilydjwg)
+Solution: Relax the restriction and allow the underscore
+
+fixes: #20344
+
+CVE: CVE-2026-28417
+Upstream-Status: Backport [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11]
+
+Backport Changes:
+- Wrynose's netrw header uses a chronological change-history list instead
+ of upstream's "Last Change:" field, so add the equivalent 2026 May 28
+ history entry.
+- Omitted src/version.c because this backport does not change the recipe's
+ Vim version or its upstream patch-number table.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++--
+ src/testdir/test_plugin_netrw.vim | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index c240bbd13..54be15b3f 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -24,6 +24,7 @@
+ " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
+ " 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit()
+ " 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913
++" 2026 May 28 by Vim Project allow underscores in hostname checking #20344
+ " 2026 Jun 16 by Vim Project Fix filename escaping in local file deletion
+ " Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
+ " Permission is hereby granted to use and distribute this code,
+@@ -2604,8 +2605,8 @@ function s:NetrwValidateHostname(hostname)
+ " Username:
+ let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
+ " Hostname: 1-64 chars, alphanumeric/dots/hyphens.
+- " No underscores. No leading/trailing dots/hyphens.
+- let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
++ " No leading/trailing dots/hyphens.
++ let host_pat = '[a-zA-Z0-9_]\%([-a-zA-Z0-9._]\{0,62}[a-zA-Z0-9_]\)\?'
+ " Port: 16 bit unsigned integer
+ let port_pat = '\%(:\d\{1,5\}\)\?$'
+
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index a0a3915f5..8d7167793 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -574,6 +574,7 @@ endfunc
+ func Test_netrw_hostname()
+ let valid_hostnames = [
+ \ 'localhost',
++ \ '_gateway',
+ \ '127.0.0.1',
+ \ '::1',
+ \ '0:0:0:0:0:0:0:1',
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 77f681410a..ce02c8b92d 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -45,6 +45,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-73076.patch \
file://CVE-2026-73077.patch \
file://CVE-2026-73078.patch \
+ file://CVE-2026-28417-regression.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 3+ messages in thread* [OE-core][wrynose][PATCH v2] vim: Fix CVE-2026-28417 hostname regression
@ 2026-09-18 10:12 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 0 replies; 3+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-18 10:12 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw
hostname validation. That CVE fix requires follow-up regression patches
because it rejects valid hostnames containing optional ports or
underscores.
Vim 9.2.0340 already contains that CVE fix and patch 9.2.0089, which
corrects optional-port handling. It still needs patch 9.2.0553 to accept
underscores, so backport that commit and retain its _gateway regression
test.
The netrw history hunk is adapted to preserve Wrynose's existing
multi-line history and append the upstream 2026 May 28 entry. The
src/version.c hunk is omitted because this backport does not change the
recipe version or Vim's upstream patch-number table.
[1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1
[2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda
[3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11
[4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
Changes in v2:
- Refreshed the patch against current Wrynose so the netrw history hunk applies cleanly.
- Renamed the embedded patch because Wrynose requires only one regression commit.
- Clarified the netrw header adaptation in Backport Changes.
.../vim/files/CVE-2026-28417-regression.patch | 65 +++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 66 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch b/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
new file mode 100644
index 0000000000..e5d947b737
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
@@ -0,0 +1,65 @@
+From a058d0dcd289ddb934b30125ac732f737bf89eb7 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 28 May 2026 20:53:53 +0000
+Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames
+ containing _
+
+Problem: runtime(netrw): netrw rejects hostnames containing _
+ (lilydjwg)
+Solution: Relax the restriction and allow the underscore
+
+fixes: #20344
+
+CVE: CVE-2026-28417
+Upstream-Status: Backport [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11]
+
+Backport Changes:
+- Wrynose's netrw header uses a chronological change-history list instead
+ of upstream's "Last Change:" field, so add the equivalent 2026 May 28
+ history entry.
+- Omitted src/version.c because this backport does not change the recipe's
+ Vim version or its upstream patch-number table.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++--
+ src/testdir/test_plugin_netrw.vim | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index c240bbd13..54be15b3f 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -24,6 +24,7 @@
+ " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
+ " 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit()
+ " 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913
++" 2026 May 28 by Vim Project allow underscores in hostname checking #20344
+ " 2026 Jun 16 by Vim Project Fix filename escaping in local file deletion
+ " Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
+ " Permission is hereby granted to use and distribute this code,
+@@ -2604,8 +2605,8 @@ function s:NetrwValidateHostname(hostname)
+ " Username:
+ let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
+ " Hostname: 1-64 chars, alphanumeric/dots/hyphens.
+- " No underscores. No leading/trailing dots/hyphens.
+- let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
++ " No leading/trailing dots/hyphens.
++ let host_pat = '[a-zA-Z0-9_]\%([-a-zA-Z0-9._]\{0,62}[a-zA-Z0-9_]\)\?'
+ " Port: 16 bit unsigned integer
+ let port_pat = '\%(:\d\{1,5\}\)\?$'
+
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index a0a3915f5..8d7167793 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -574,6 +574,7 @@ endfunc
+ func Test_netrw_hostname()
+ let valid_hostnames = [
+ \ 'localhost',
++ \ '_gateway',
+ \ '127.0.0.1',
+ \ '::1',
+ \ '0:0:0:0:0:0:0:1',
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 77f681410a..ce02c8b92d 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -45,6 +45,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-73076.patch \
file://CVE-2026-73077.patch \
file://CVE-2026-73078.patch \
+ file://CVE-2026-28417-regression.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-18 10:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-18 10:06 [OE-core][wrynose][PATCH v2] vim: Fix CVE-2026-28417 hostname regression Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-18 10:10 ` Devansh Patel
-- strict thread matches above, loose matches on Subject: below --
2026-09-18 10:12 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.