Re: [scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 2666 bytes --]

On Tue, Aug 25, 2026 at 06:56 PM, Yoann Congal wrote:

> 
> On Tue Aug 25, 2026 at 3:07 PM CEST, Hetvi Thakar -X (hthakar - E
> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> 
>> On Tue, Aug 25, 2026 at 05:01 PM, Yoann Congal wrote:
>> 
>>> Le jeu. 20 août 2026 à 11:11, Hetvi Thakar -X (hthakar - E INFOCHIPS
>>> PRIVATE LIMITED at Cisco) < hthakar@cisco.com > a écrit :
>>> 
>>> 
>>>> Hi Yoann,
>>>> I hope you're doing well.
>>>> I wanted to follow up on the patch below. It appears it may have been
>>>> missed during the review process. Could you please take a look when you
>>>> have a chance and share your feedback?
>>>> Thank you for your time.
>>> 
>>> It was not missed. I've answered that it lacked a master equivalent before
>>> 
>>> I can consider it for wrynose.
>>> Has this changed? In that case, can you provide a link to the master
>>> commit equivalent to this patch?
>> 
>> Hi,
> 
> Hello,
> 
> 
>> This was a series of four CVE fixes. The patches for the following
>> three CVEs have already been merged into master:
>> 
>> CVE-2026-58469:
>> https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042
>> 
>> 
>> CVE-2026-58471:
>> https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e
>> 
>> 
>> CVE-2026-58472:
>> https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632
>> 
> 
> I can consider those 3 (hoping for not conflict).
> 
> 
>> The remaining patch for CVE-2026-58470 has also been proposed for
>> master:
>> 
>> https://patchwork.yoctoproject.org/project/oe-core/patch/20260722081735.14807-1-amaury.couderc@est.tech/
>> 
>> 
>> May you please review the remaining patch?
> 
> This patch is in the "Superseeded" state and is from a month ago. You
> can answer on it asking for its status.
> 
> 
>> Once it is reviewed, could you also proceed with the review of the
>> corresponding wrynose and Scarthgap patches?
> 
> I regularly re-evaluate the "Awaiting Upstream" patches but you can
> expedite this process by pinging here when you see the patch landing on
> master.
> In this case, we wait for "wget: fix CVE-2026-58470" landing on master.
> 
> Regards,
> --
> Yoann Congal
> Smile ECS

Hi Yoann,

Thanks for the review.
I have submitted the master patch for CVE-2026-58470
wget: Fix CVE-2026-58470 - Patchwork ( https://patchwork.yoctoproject.org/project/oe-core/patch/20260827062321.3825085-1-hthakar@cisco.com/ )
Could you please take a look at it at your convenience?

Regards,
Hetvi

[-- Attachment #2: Type: text/html, Size: 3473 bytes --]