mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-16 05:17:02 +00:00
Code Issues Projects Releases Wiki Activity

vim: Fix CVE-2026-28417 regressions

Browse Source 
The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw
hostname validation. That CVE fix requires two regression patches
because it rejects valid hostnames that include an optional port or an
underscore.

Backport Vim patches 9.2.0089 and 9.2.0553 in that order. They restore
optional-port and underscore handling while retaining the stricter
validation introduced by the original CVE fix.

Scarthgap's Vim 9.1.1683 source does not contain
test_plugin_netrw.vim, so the upstream test hunks are omitted. The
src/version.c hunks are also omitted because this backport does not
change the recipe version or Vim's upstream patch-number table.

[1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1
[2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda
[3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11
[4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336

(From OE-Core rev: 1505d5181d610b221fd75d413d884172b46b7860)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Devansh Patel authored and Paul Barker committed 2026-10-07 16:08:04 +01:00
1 parent 1a85e65209
commit 7902807be5
3 files changed
+133
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch
+78
View File
@@ -0,0 +1,78 @@
From a6e9906380af2b51ea4b77234ef77b14cc712f2c Mon Sep 17 00:00:00 2001
From: Miguel Barro <miguel.barro@live.com>
Date: Sun, 1 Mar 2026 19:32:29 +0000
Subject: [PATCH] patch 9.2.0089: netrw: does not take port into account in
hostname validation
Problem: netrw: does not take port into account in hostname validation
(after v9.2.0073)
Solution: Update hostname validation check and test for an optional port
number (Miguel Barro)
closes: #19533
CVE: CVE-2026-28417
Upstream-Status: Backport [https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda]
Backport Changes:
- Omitted src/testdir/test_plugin_netrw.vim because this test file is not
present in the Vim 9.1.1683 source used by Scarthgap.
- Omitted src/version.c because this backport does not change the recipe's
Vim version or its upstream patch-number table.
Signed-off-by: Miguel Barro <miguel.barro@live.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit a6198523fb28a50d96945458792cdb4787d3cdda)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
runtime/pack/dist/opt/netrw/autoload/netrw.vim | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
index 1b790d250..69eababf1 100644
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
@@ -6,6 +6,7 @@
" 2025 Aug 07 by Vim Project (netrw#BrowseX() distinguishes remote files #17794)
" 2025 Aug 22 by Vim Project netrw#Explore handle terminal correctly #18069
" 2026 Feb 27 by Vim Project Make the hostname validation more strict
+" 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
" Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
" Permission is hereby granted to use and distribute this code,
" with or without modifications, provided that this copyright
@@ -2575,7 +2576,8 @@ endfunction
" s:NetrwValidateHostname: Validate that the hostname is valid {{{2
" Input:
-" hostname, may include an optional username, e.g. user@hostname
+" hostname, may include an optional username and port number, e.g.
+" user@hostname:port
" allow a alphanumeric hostname or an IPv(4/6) address
" Output:
" true if g:netrw_machine is valid according to RFC1123 #Section 2
@@ -2584,17 +2586,19 @@ function s:NetrwValidateHostname(hostname)
let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
" Hostname: 1-64 chars, alphanumeric/dots/hyphens.
" No underscores. No leading/trailing dots/hyphens.
- let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]{,62}[a-zA-Z0-9]\)\?$'
+ let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
+ " Port: 16 bit unsigned integer
+ let port_pat = '\%(:\d\{1,5\}\)\?$'
" IPv4: 1-3 digits separated by dots
- let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}$'
+ let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}'
" IPv6: Hex, colons, and optional brackets
- let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?$'
+ let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?'
- return a:hostname =~? '^'.user_pat.host_pat ||
- \ a:hostname =~? '^'.user_pat.ipv4_pat ||
- \ a:hostname =~? '^'.user_pat.ipv6_pat
+ return a:hostname =~? '^'.user_pat.host_pat.port_pat ||
+ \ a:hostname =~? '^'.user_pat.ipv4_pat.port_pat ||
+ \ a:hostname =~? '^'.user_pat.ipv6_pat.port_pat
endfunction
" NetUserPass: set username and password for subsequent ftp transfer {{{2
meta/recipes-support/vim/files/CVE-2026-28417-regression_p2.patch
+53
View File
@@ -0,0 +1,53 @@
From 047b5dfc3213a42d7db960569f53b37e332f3c76 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Thu, 28 May 2026 20:53:53 +0000
Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames
containing _
Problem: runtime(netrw): netrw rejects hostnames containing _
(lilydjwg)
Solution: Relax the restriction and allow the underscore
fixes: #20344
CVE: CVE-2026-28417
Upstream-Status: Backport [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11]
Backport Changes:
- Preserved Scarthgap's multi-line netrw change history and appended the
upstream 2026 May 28 change instead of replacing it with a single date.
- Omitted src/testdir/test_plugin_netrw.vim because this test file is not
present in the Vim 9.1.1683 source used by Scarthgap.
- Omitted src/version.c because this backport does not change the recipe's
Vim version or its upstream patch-number table.
Signed-off-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
index 69eababf1..58aecc81e 100644
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
@@ -7,6 +7,7 @@
" 2025 Aug 22 by Vim Project netrw#Explore handle terminal correctly #18069
" 2026 Feb 27 by Vim Project Make the hostname validation more strict
" 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
+" 2026 May 28 by Vim Project allow underscores in hostname checking #20344
" Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
" Permission is hereby granted to use and distribute this code,
" with or without modifications, provided that this copyright
@@ -2585,8 +2586,8 @@ function s:NetrwValidateHostname(hostname)
" Username:
let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
" Hostname: 1-64 chars, alphanumeric/dots/hyphens.
- " No underscores. No leading/trailing dots/hyphens.
- let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
+ " No leading/trailing dots/hyphens.
+ let host_pat = '[a-zA-Z0-9_]\%([-a-zA-Z0-9._]\{0,62}[a-zA-Z0-9_]\)\?'
" Port: 16 bit unsigned integer
let port_pat = '\%(:\d\{1,5\}\)\?$'
meta/recipes-support/vim/vim.inc
+2
View File
@@ -30,6 +30,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://CVE-2026-28421.patch \
file://CVE-2026-32249.patch \
file://CVE-2026-28417.patch \
file://CVE-2026-28417-regression_p1.patch \
file://CVE-2026-28417-regression_p2.patch \
file://CVE-2026-45130.patch \
file://CVE-2026-46483.patch \
file://CVE-2026-28420.patch \