Le jeu. 20 août 2026 à 11:11, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com> a écrit :Hi Yoann,I hope you're doing well.I wanted to follow up on the patch below. It appears it may have been missed during the review process. Could you please take a look when you have a chance and share your feedback?Thank you for your time.Hello,It was not missed. I've answered that it lacked a master equivalent before I can consider it for wrynose.Has this changed? In that case, can you provide a link to the master commit equivalent to this patch?Regards,Regards,
Hetvi
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org <hthakar=cisco.com@lists.openembedded.org>
Sent: 23 July 2026 14:15
To: Yoann Congal <yoann.congal@smile.fr>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: xe-linux-external (Internal Group) <xe-linux-external@cisco.com>
Subject: Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469Hi,I reviewed the earlier series.It looks like the follow-up upstream regression fixes forCVE-2026-58469 and CVE-2026-58472 were not included in the backport.These follow-up commits are required to complete the backport, and Ihave included them in my series .I kindly request you to review my series as well.Thanks,Hetvi Thakar
From: Yoann Congal <yoann.congal@smile.fr>
Sent: 22 July 2026 23:13
To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: xe-linux-external (Internal Group) <xe-linux-external@cisco.com>
Subject: Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469On Wed Jul 22, 2026 at 12:12 PM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> It also includes the upstream follow-up fixes referenced in [3]
> and [4]. These correct the trailing whitespace check introduced
> by the original fix and add the required <ctype.h> include for
> isspace().
>
> [1] https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
> [3] https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
> [4] https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Hello,
I received another similar series 2 hours before yours:
https://patchwork.yoctoproject.org/project/oe-core/list/?series=48993
Can you help review it?
Regards,
--
Yoann Congal
Smile ECS
--
Yoann CongalSmile ECS
Hi,
This was a series of four CVE fixes. The patches for the following
three CVEs have already been merged into master:
CVE-2026-58469:
https://git.openembedded.org/openembedded-core/commit/?id=f55c2f60daa1a125fd36aa254abb16d431b55042
CVE-2026-58471:
https://git.openembedded.org/openembedded-core/commit/?id=f910a8beb7bb8fb3b41a240dfdad36f76d6b482e
CVE-2026-58472:
https://git.openembedded.org/openembedded-core/commit/?id=8a77e738458a75186c3bff6c4a97cd87d3aee632
The remaining patch for CVE-2026-58470 has also been proposed for
master:
May you please review the remaining patch?
Once it is reviewed, could you also proceed with the review of the
corresponding wrynose and Scarthgap patches?
Regards,
Hetvi