From: "Yoann Congal" <yoann.congal@smile.fr>
To: <hprajapati@mvista.com>, <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [scarthgap][PATCHv2 1/6] bind: fix for CVE-2026-10723
Date: Wed, 14 Oct 2026 16:25:52 +0200 [thread overview]
Message-ID: <DM4MPOPTHX9C.2IO3PVJDW950C@smile.fr> (raw)
In-Reply-To: <1979951.1791983373368474761@lists.openembedded.org>
On Wed Oct 14, 2026 at 3:09 PM CEST, Hitendra Prajapati via lists.openembedded.org wrote:
> Hi Yoann,
>
> I have back ported this patch series from 9.18 .
> All the patches are back ported from respective Debian bug link. Please check it.
I don't see what you mean by "respective Debian bug link":
https://security-tracker.debian.org/tracker/CVE-2026-10723 =>
https://gitlab.isc.org/isc-projects/bind9/-/commit/35e3d49d2222c13786a06021c7ed583d2a656e51 (9.18-branch)
(= https://github.com/isc-projects/bind9/commit/35e3d49d2222c13786a06021c7ed583d2a656e51
the gitlab.isc.org link is not reachable without an account)
the commit 35e3d49d2222c13 does not touch bin/tests/system/glue/setup.sh
but your patch does remove it. => Still feels wrong to me.
Also repro_5874_nsec3_parent/ans1/ans.py is added, then removed in a
later patch. So, maybe, we don't need all the patches? Even more so that
we do not have ptests for bind.
Why not just cherry-pick from the 9.18 branch?
> I don't have any news for 9.18.51 release.
I do now: https://lists.isc.org/pipermail/bind-announce/2026-June/001296.html
=> It won't happen as bind 9.18 is effectively EoL. The last version
should be 9.18.50.
That said, there are recent patches on the 9.18 branch. Can you look
around and maybe ask upstream about the status of this branch?
Thanks!
--
Yoann Congal
Smile ECS
prev parent reply other threads:[~2026-10-14 14:26 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-12 4:38 [scarthgap][PATCHv2 1/6] bind: fix for CVE-2026-10723 Hitendra Prajapati
2026-10-12 4:38 ` [scarthgap][PATCHv2 2/6] bind: fix for CVE-2026-10822 Hitendra Prajapati
2026-10-12 4:38 ` [scarthgap][PATCHv2 3/6] bind: fix for CVE-2026-11331 Hitendra Prajapati
2026-10-12 4:38 ` [scarthgap][PATCHv2 4/6] bind: fix for CVE-2026-11622, CVE-2026-11721 Hitendra Prajapati
2026-10-12 4:38 ` [scarthgap][PATCHv2 5/6] bind: fix for CVE-2026-12617 Hitendra Prajapati
2026-10-12 4:38 ` [scarthgap][PATCHv2 6/6] bind: fix for CVE-2026-13204, CVE-2026-13321 Hitendra Prajapati
2026-10-14 9:56 ` [OE-core] [scarthgap][PATCHv2 1/6] bind: fix for CVE-2026-10723 Yoann Congal
2026-10-14 13:09 ` Hitendra Prajapati
2026-10-14 14:25 ` Yoann Congal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM4MPOPTHX9C.2IO3PVJDW950C@smile.fr \
--to=yoann.congal@smile.fr \
--cc=hprajapati@mvista.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox