mirror of
https://git.yoctoproject.org/poky
synced 2026-10-20 18:38:18 +00:00
Siddharth Doshi
8e0b74b1d8
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-47167 [2] https://security-tracker.debian.org/tracker/CVE-2026-47167 (From OE-Core rev: 4c3c569a7d9e19f7d613d01afd2ab793a4d35453) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
40 lines
1.5 KiB
Diff
40 lines
1.5 KiB
Diff
From e117fcc6f1c1973602c8e2c6529fba9ee1ce59b4 Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Sun, 17 May 2026 19:39:24 +0000
|
|
Subject: [PATCH 05/17] patch 9.2.0496: [security]: Code Injection in cucumber
|
|
filetype plugin
|
|
|
|
Problem: [security]: Code Injection in cucumber filetype plugin
|
|
(Christopher Lusk)
|
|
Solution: Use rubys Regexp.new() with the untrusted pattern
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934]
|
|
CVE: CVE-2026-47167
|
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
|
---
|
|
runtime/ftplugin/cucumber.vim | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/runtime/ftplugin/cucumber.vim b/runtime/ftplugin/cucumber.vim
|
|
index f4848d1c60..3361f1db4a 100644
|
|
--- a/runtime/ftplugin/cucumber.vim
|
|
+++ b/runtime/ftplugin/cucumber.vim
|
|
@@ -96,7 +96,8 @@ function! s:stepmatch(receiver,target)
|
|
catch
|
|
endtry
|
|
if has("ruby") && pattern !~ '\\\@<!#{'
|
|
- ruby VIM.command("return #{if (begin; Kernel.eval('/'+VIM.evaluate('pattern')+'/'); rescue SyntaxError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
|
|
+ " Use Regexp.new, so the pattern stays untrusted data and cannot inject Ruby
|
|
+ ruby VIM.command("return #{if (begin; Regexp.new(VIM.evaluate('pattern')); rescue RegexpError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
|
|
else
|
|
return 0
|
|
endif
|
|
--
|
|
2.44.4
|
|
|