Re: [scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 5074 bytes --]

On Tue, Aug 25, 2026 at 05:01 PM, Yoann Congal wrote:

> 
> 
> 
> Le jeu. 20 août 2026 à 11:11, Hetvi Thakar -X (hthakar - E INFOCHIPS
> PRIVATE LIMITED at Cisco) < hthakar@cisco.com > a écrit :
> 
>> Hi Yoann,
>> I hope you're doing well.
>> I wanted to follow up on the patch below. It appears it may have been
>> missed during the review process. Could you please take a look when you
>> have a chance and share your feedback?
>> Thank you for your time.
>> 
> 
> Hello,
> 
> It was not missed. I've answered that it lacked a master equivalent before
> I can consider it for wrynose.
> Has this changed? In that case, can you provide a link to the master
> commit equivalent to this patch?
> 
> Regards,
> 
> 
>> Regards,
>> Hetvi
>> 
>> 
>> *From:* openembedded-core@lists.openembedded.org < openembedded-core@lists.openembedded.org
>> > on behalf of Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at
>> Cisco) via lists.openembedded.org ( http://lists.openembedded.org ) <hthakar=
>> cisco.com@lists.openembedded.org >
>> *Sent:* 23 July 2026 14:15
>> *To:* Yoann Congal < yoann.congal@smile.fr >; openembedded-core@lists.openembedded.org
>> < openembedded-core@lists.openembedded.org >
>> *Cc:* xe-linux-external (Internal Group) < xe-linux-external@cisco.com >
>> *Subject:* Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469
>> 
>> Hi,
>> 
>> I reviewed the earlier series.
>> It looks like the follow-up upstream regression fixes for
>> CVE-2026-58469 and CVE-2026-58472 were not included in the backport.
>> These follow-up commits are required to complete the backport, and I
>> have included them in my series .
>> I kindly request you to review my series as well.
>> 
>> Thanks,
>> Hetvi Thakar
>> 
>> *From:* Yoann Congal < yoann.congal@smile.fr >
>> *Sent:* 22 July 2026 23:13
>> *To:* Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) < hthakar@cisco.com
>> >; openembedded-core@lists.openembedded.org < openembedded-core@lists.openembedded.org
>> >
>> *Cc:* xe-linux-external (Internal Group) < xe-linux-external@cisco.com >
>> *Subject:* Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469
>> 
>> On Wed Jul 22, 2026 at 12:12 PM CEST, Hetvi Thakar -X (hthakar - E
>> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org (
>> http://lists.openembedded.org ) wrote:
>> > From: Hetvi Thakar < hthakar@cisco.com >
>> >
>> > This patch applies the upstream fix as referenced in [2],
>> > using the commit shown in [1].
>> >
>> > It also includes the upstream follow-up fixes referenced in [3]
>> > and [4]. These correct the trailing whitespace check introduced
>> > by the original fix and add the required <ctype.h> include for
>> > isspace().
>> >
>> > [1] https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
>> (
>> https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
>> )
>> > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
>> > [3] https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
>> (
>> https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
>> )
>> > [4] https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1
>> (
>> https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1
>> )
>> >
>> > Signed-off-by: Hetvi Thakar < hthakar@cisco.com >
>> 
>> Hello,
>> 
>> I received another similar series 2 hours before yours:
>> https://patchwork.yoctoproject.org/project/oe-core/list/?series=48993
>> Can you help review it?
>> 
>> Regards,
>> --
>> Yoann Congal
>> Smile ECS
>> 
>> 
>> 
> 
> 
> 
> --
> Yoann Congal
> Smile ECS
> 
> 

Hi,

This was a series of four CVE fixes. The patches for the following
three CVEs have already been merged into master:

CVE-2026-58469:
https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042 ( https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042 )

CVE-2026-58471:
https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e ( https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e )

CVE-2026-58472:
https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632 ( https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632 )

The remaining patch for CVE-2026-58470 has also been proposed for
master:

https://patchwork.yoctoproject.org/project/oe-core/patch/20260722081735.14807-1-amaury.couderc@est.tech/ ( https://patchwork.yoctoproject.org/project/oe-core/patch/20260722081735.14807-1-amaury.couderc@est.tech/ )

May you please review the remaining patch?
Once it is reviewed, could you also proceed with the review of the
corresponding wrynose and Scarthgap patches?

Regards,
Hetvi

> 
> 
>

[-- Attachment #2: Type: text/html, Size: 12008 bytes --]