From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 956CEC61DB9 for ; Tue, 25 Aug 2026 13:07:05 +0000 (UTC) Subject: Re: [scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469 To: openembedded-core@lists.openembedded.org From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.83) X-Originating-Platform: Windows Edge 151 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Tue, 25 Aug 2026 06:07:02 -0700 References: <20260722101230.34771-1-hthakar@cisco.com> <18C4DECEC4DDFC1A.1355869@lists.openembedded.org> In-Reply-To: Message-ID: <2716314.1787663222100636520@lists.openembedded.org> Content-Type: multipart/alternative; boundary="WUTTotChENwLTJ46ajJV" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 25 Aug 2026 13:07:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244237 --WUTTotChENwLTJ46ajJV Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 25, 2026 at 05:01 PM, Yoann Congal wrote: >=20 >=20 >=20 > Le=C2=A0jeu. 20 ao=C3=BBt 2026 =C3=A0=C2=A011:11, Hetvi Thakar -X (hthaka= r - E INFOCHIPS > PRIVATE LIMITED at Cisco) < hthakar@cisco.com > a =C3=A9crit=C2=A0: >=20 >> Hi Yoann, >> I hope you're doing well. >> I wanted to follow up on the patch below. It appears it may have been >> missed during the review process. Could you please take a look when you >> have a chance and share your feedback? >> Thank you for your time. >>=20 >=20 > Hello, >=20 > It was not missed. I've answered that it lacked a master equivalent befor= e > I can consider it for wrynose. > Has this changed? In that case, can you provide a link to the master > commit equivalent to this patch? >=20 > Regards, >=20 >=20 >> Regards, >> Hetvi >>=20 >>=20 >> *From:* openembedded-core@lists.openembedded.org < openembedded-core@lis= ts.openembedded.org >> > on behalf of Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at >> Cisco) via lists.openembedded.org ( http://lists.openembedded.org ) > cisco.com@lists.openembedded.org > >> *Sent:* 23 July 2026 14:15 >> *To:* Yoann Congal < yoann.congal@smile.fr >; openembedded-core@lists.op= enembedded.org >> < openembedded-core@lists.openembedded.org > >> *Cc:* xe-linux-external (Internal Group) < xe-linux-external@cisco.com > >> *Subject:* Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469 >>=20 >> Hi, >>=20 >> I reviewed the earlier series. >> It looks like the follow-up upstream regression fixes for >> CVE-2026-58469 and CVE-2026-58472 were not included in the backport. >> These follow-up commits are required to complete the backport, and I >> have included them in my series . >> I kindly request you to review my series as well. >>=20 >> Thanks, >> Hetvi Thakar >>=20 >> *From:* Yoann Congal < yoann.congal@smile.fr > >> *Sent:* 22 July 2026 23:13 >> *To:* Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <= hthakar@cisco.com >> >; openembedded-core@lists.openembedded.org < openembedded-core@lists.op= enembedded.org >> > >> *Cc:* xe-linux-external (Internal Group) < xe-linux-external@cisco.com > >> *Subject:* Re: [OE-core][scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469 >>=20 >> On Wed Jul 22, 2026 at 12:12 PM CEST, Hetvi Thakar -X (hthakar - E >> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org ( >> http://lists.openembedded.org ) wrote: >> > From: Hetvi Thakar < hthakar@cisco.com > >> > >> > This patch applies the upstream fix as referenced in [2], >> > using the commit shown in [1]. >> > >> > It also includes the upstream follow-up fixes referenced in [3] >> > and [4]. These correct the trailing whitespace check introduced >> > by the original fix and add the required include for >> > isspace(). >> > >> > [1] https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc= 2a7a4fb0b6f7826 >> ( >> https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4f= b0b6f7826 >> ) >> > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469 >> > [3] https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575= c8a00386c3f3bcf >> ( >> https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a003= 86c3f3bcf >> ) >> > [4] https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736= aac298c24fe00a1 >> ( >> https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298= c24fe00a1 >> ) >> > >> > Signed-off-by: Hetvi Thakar < hthakar@cisco.com > >>=20 >> Hello, >>=20 >> I received another similar series 2 hours before yours: >> https://patchwork.yoctoproject.org/project/oe-core/list/?series=3D48993 >> Can you help review it? >>=20 >> Regards, >> -- >> Yoann Congal >> Smile ECS >>=20 >>=20 >>=20 >=20 >=20 >=20 > -- > Yoann Congal > Smile ECS >=20 >=20 Hi, This was a series of four CVE fixes. The patches for the following three CVEs have already been merged into master: CVE-2026-58469: https://git.openembedded.org/openembedded-core/commit/?id=3Df55c2f60daa1a12= 5fd36aa254abb16d431b55042 ( https://git.openembedded.org/openembedded-core/= commit/?id=3Df55c2f60daa1a125fd36aa254abb16d431b55042 ) CVE-2026-58471: https://git.openembedded.org/openembedded-core/commit/?id=3Df910a8beb7bb8fb= 3b41a240dfdad36f76d6b482e ( https://git.openembedded.org/openembedded-core/= commit/?id=3Df910a8beb7bb8fb3b41a240dfdad36f76d6b482e ) CVE-2026-58472: https://git.openembedded.org/openembedded-core/commit/?id=3D8a77e738458a751= 86c3bff6c4a97cd87d3aee632 ( https://git.openembedded.org/openembedded-core/= commit/?id=3D8a77e738458a75186c3bff6c4a97cd87d3aee632 ) The remaining patch for CVE-2026-58470 has also been proposed for master: https://patchwork.yoctoproject.org/project/oe-core/patch/20260722081735.148= 07-1-amaury.couderc@est.tech/ ( https://patchwork.yoctoproject.org/project/= oe-core/patch/20260722081735.14807-1-amaury.couderc@est.tech/ ) May you please review the remaining patch? Once it is reviewed, could you also proceed with the review of the corresponding wrynose and Scarthgap patches? Regards, Hetvi >=20 >=20 > --WUTTotChENwLTJ46ajJV Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 25, 2026 at 05:01 PM, Yoann Congal wrote:
 

Le jeu. 20 août 2026 &agra= ve; 11:11, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at C= isco) <hthakar@cisco.com> a = écrit :
Hi Yoann,
I hope you're doing well.
I wanted to follow up on the patch below. It appears it may have been mi= ssed during the review process. Could you please take a look when you have = a chance and share your feedback?
Thank you for your time.
Hello,
 
It was not missed. I've answered that it lacked a master equivalent be= fore I can consider it for wrynose.
Has this changed? In that case, can you provide a link to the master c= ommit equivalent to this patch?
 
Regards,
 
Regards,
Hetvi
 
From: openembedded-core@lists.openembedded.or= g <openembedded-core@lists.openembedded.org&= gt; on behalf of Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at = Cisco) via lists.openembedded.org <hthakar=3Dcisco.co= m@lists.openembedded.org>
Sent: 23 July 2026 1= 4:15
To: Yoann Congal <yoann.congal@smile.fr&= gt;; openembedded-core@lists.openembedded.org <<= a href=3D"mailto:openembedded-core@lists.openembedded.org" target=3D"_blank= " rel=3D"noopener">openembedded-core@lists.openembedded.org>
Cc: xe-linux-external (Internal Group) <xe-linux-e= xternal@cisco.com>
Subject: Re: [OE-core][scar= thgap][PATCH 1/4] wget: Fix CVE-2026-58469
 
Hi,
 
I reviewed the= earlier series.
It looks like = the follow-up upstream regression fixes for
CVE-2026-58469= and CVE-2026-58472 were not included in the backport.
These follow-u= p commits are required to complete the backport, and I
have included = them in my series .
I kindly reque= st you to review my series as well.
 
Thanks,
Hetvi Thakar
From: Yoann Congal <yoann.congal@smile.fr>
Sent: 22 July 2026 23:13
To: Hetvi Tha= kar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com<= /a>>; openembedded-core@lists.openembedded.org &= lt;openembedded-core@lists.openembedded.org>
Cc: xe-linux-external (Internal Group) <xe-lin= ux-external@cisco.com>
Subject: Re: [OE-core][= scarthgap][PATCH 1/4] wget: Fix CVE-2026-58469
 
On Wed Jul 22, 2026 at 12:12 PM CEST, Hetvi Thakar -X (hthakar - E INF= OCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:> From: Hetvi Thakar <hthakar@cisco.com>
>
> = This patch applies the upstream fix as referenced in [2],
> using t= he commit shown in [1].
>
> It also includes the upstream f= ollow-up fixes referenced in [3]
> and [4]. These correct the trail= ing whitespace check introduced
> by the original fix and add the r= equired <ctype.h> include for
> isspace().
>
>= ; [1] https://gitlab= .com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-58= 469
> [3] https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a0038= 6c3f3bcf
> [4] https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aa= c298c24fe00a1
>
> Signed-off-by: Hetvi Thakar <hthakar@= cisco.com>

Hello,

I received another similar s= eries 2 hours before yours:
https://patchwork.yoctoproject.org/project/oe-core/list/?series=3D48993
Can you help review it?

Regards,
--
Yoann Con= gal
Smile ECS

 

--
Yoann Conga= l
Smile ECS
<= /div>

Hi,

This was a series of four CVE fixes. The p= atches for the following
three CVEs have already been mer= ged into master:

CVE-2026-58469:
https://git.open= embedded.org/openembedded-core/commit/?id=3Df55c2f60daa1a125fd36aa254abb16d= 431b55042

CVE-2026-58471:
https://git.open= embedded.org/openembedded-core/commit/?id=3Df910a8beb7bb8fb3b41a240dfdad36f= 76d6b482e

CVE-2026-58472:
https://git.open= embedded.org/openembedded-core/commit/?id=3D8a77e738458a75186c3bff6c4a97cd8= 7d3aee632

The remaining patch for CVE-2026-58470 has= also been proposed for
master:

https://patchwork.yoctoproject.org/project/oe-= core/patch/20260722081735.14807-1-amaury.couderc@est.tech/

May you please review the remaining patch?
Once = it is reviewed, could you also proceed with the review of the
<= span>corresponding wrynose and Scarthgap patches?

Regards,
Hetvi

 
--WUTTotChENwLTJ46ajJV--