From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <jakub.szczudlo@nokia.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 5F624C61DBD
	for <webhook@archiver.kernel.org>; Wed, 26 Aug 2026 08:14:38 +0000 (UTC)
Subject: Re: [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
To: openembedded-core@lists.openembedded.org
From: "Jakub Szczudlo (Nokia)" <jakub.szczudlo@nokia.com>
X-Originating-Location: Warsaw, Mazovia, PL (170.85.29.18)
X-Originating-Platform: Windows Firefox 140
User-Agent: GROUPS.IO Web Poster
MIME-Version: 1.0
Date: Wed, 26 Aug 2026 01:14:36 -0700
References: <20260824152023.19501-1-jakub.szczudlo@nokia.com> <042a154cf3f65594e4d46156f4df835195b68f90.camel@pbarker.dev>
In-Reply-To: <042a154cf3f65594e4d46156f4df835195b68f90.camel@pbarker.dev>
Message-ID: <2789044.1787732076156082495@lists.openembedded.org>
Content-Type: multipart/alternative; boundary="gtXhwfbCuLPrrDARksmF"
List-Id: <openembedded-core.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-core@lists.openembedded.org>; Wed, 26 Aug 2026 08:14:38 -0000
X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244347

--gtXhwfbCuLPrrDARksmF
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

I understand this CVE is bigger than I thought CVE patch can be.
Maybe we can think about updating expat beyond the fixed version?
I now it's not the best because it is stable branch but I can't think about=
 correct solution.

Best regards,
Jakub Szczudlo

--gtXhwfbCuLPrrDARksmF
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<div>Hi,<br /><br />I understand this CVE is bigger than I thought CVE patc=
h can be.<br />Maybe we can think about updating expat beyond the fixed ver=
sion?<br />I now it's not the best because it is stable branch but I can't =
think about correct solution.<br /><br />Best regards,<br />Jakub Szczudlo<=
/div>

--gtXhwfbCuLPrrDARksmF--