Re: [OE-core][wrynose][PATCH 01/10] openssh: Fix CVE-2026-106584

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Nov 6, 2026 at 12:00 PM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,

Hello,

> I have submitted the corresponding OpenSSH backport patches for
> blacksail upstream [1] .
> Could you please review  the wrynose series when you have a chance?
> [1] [blacksail] openssh: Upgrade 10.5p1 -> 10.6p1 -
> Patchwork<https://patchwork.yoctoproject.org/project/oe-core/patch/20261105042209.1168511-1-hthakar@cisco.com/>

I had to reject this blacksail patch. This mean that I can't
review/accept this wrynose series until equivalent fixes are sent to
blacksail by backports.

Regards,

> Regards,
> Hetvi
>
> ________________________________
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: 20 October 2026 00:14
> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Cc: xe-linux-external (Internal Group) <xe-linux-external@cisco.com>
> Subject: Re: [OE-core][wrynose][PATCH 01/10] openssh: Fix CVE-2026-106584
>
> On Fri Oct 16, 2026 at 5:52 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> From: Hetvi Thakar <hthakar@cisco.com>
>>
>> This patch applies the upstream fix as referenced in [2], using the
>> commit shown in [1].
>>
>> [1] https://github.com/openssh/openssh-portable/commit/aef20dfe30e68a469911a229b9117e7134766311
>> [2] https://ubuntu.com/security/CVE-2026-106584
>>
>> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
>> ---
>>  .../openssh/openssh/CVE-2026-106584.patch     | 39 +++++++++++++++++++
>>  .../openssh/openssh_10.3p1.bb                 |  1 +
>>  2 files changed, 40 insertions(+)
>>  create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch
>
> Hello,
>
> This patch (and a few others in the series) are included in openssh 10.6
> but blacksail only has 10.5. Can you send the backports for blacksail so
> I can merge this series for wrynose?
>
> Thanks!
> --
> Yoann Congal
> Smile ECS


-- 
Yoann Congal
Smile ECS