Re: [wrynose][PATCH 2/4] wget: Fix CVE-2026-58470

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 1227 bytes --]

On Fri, Sep 4, 2026 at 02:48 AM, Yoann Congal wrote:

> 
> On Wed Jul 22, 2026 at 12:07 PM CEST, Hetvi Thakar -X (hthakar - E
> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> 
>> From: Hetvi Thakar <hthakar@cisco.com>
>> 
>> This patch applies the upstream fix as referenced in [2],
>> using the commit shown in [1].
>> 
>> [1] https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
>> 
>> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-58470
>> 
>> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
>> ---
>> .../wget/wget/CVE-2026-58470.patch | 79 +++++++++++++++++++
>> meta/recipes-extended/wget/wget_1.25.0.bb | 1 +
>> 2 files changed, 80 insertions(+)
>> create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58470.patch
> 
> Hello,
> 
> The master patch you sent contained a regression fix that is not in this
> wrynose version (also not in your scarthgap version).
> 
> Can you send a v2 with the regression fix?
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

Hi,

Thanks for pointing this out.

I will include the regression fix in both the wrynose and scarthgap
patches and send the updated v2 versions.

Regards,
Hetvi

[-- Attachment #2: Type: text/html, Size: 1718 bytes --]