mirror of
https://git.yoctoproject.org/poky
synced 2026-09-19 00:49:33 +02:00
vim: Security Fix for CVE-2026-42307
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-42307 [2] https://security-tracker.debian.org/tracker/CVE-2026-42307 (From OE-Core rev: ce14ca9604dfa13c619f17282273eb279a79a3ac) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Siddharth Doshi
committed by
Paul Barker
Paul Barker
parent
1c0ffd724f
commit
0939d72e83
121
meta/recipes-support/vim/files/CVE-2026-42307.patch
Normal file
121
meta/recipes-support/vim/files/CVE-2026-42307.patch
Normal file
@@ -0,0 +1,121 @@
|
|||||||
|
From 936634660e3836e1a495965b48a0dc913e9d0deb Mon Sep 17 00:00:00 2001
|
||||||
|
From: Christian Brabandt <cb@256bit.org>
|
||||||
|
Date: Tue, 21 Apr 2026 19:03:02 +0000
|
||||||
|
Subject: [PATCH 02/17] patch 9.2.0383: [security]: runtime(netrw):
|
||||||
|
shell-injection via sftp: and file: URLs
|
||||||
|
|
||||||
|
Problem: runtime(netrw): shell-injection via sftp: and file: URLs
|
||||||
|
(Joshua Rogers)
|
||||||
|
Solution: Escape temporary file names, harden filename suffix regex,
|
||||||
|
drop unused g:netrw_tmpfile_escape variable
|
||||||
|
|
||||||
|
Supported by AI
|
||||||
|
|
||||||
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||||
|
|
||||||
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc]
|
||||||
|
CVE: CVE-2026-42307
|
||||||
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
||||||
|
---
|
||||||
|
runtime/doc/pi_netrw.txt | 4 ----
|
||||||
|
runtime/doc/tags | 1 -
|
||||||
|
runtime/pack/dist/opt/netrw/autoload/netrw.vim | 16 +++++++++-------
|
||||||
|
runtime/pack/dist/opt/netrw/doc/netrw.txt | 4 ----
|
||||||
|
4 files changed, 9 insertions(+), 16 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/runtime/doc/pi_netrw.txt b/runtime/doc/pi_netrw.txt
|
||||||
|
index a86cac36ba..2d98a8407b 100644
|
||||||
|
--- a/runtime/doc/pi_netrw.txt
|
||||||
|
+++ b/runtime/doc/pi_netrw.txt
|
||||||
|
@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|)
|
||||||
|
such as listing, file removal, etc.
|
||||||
|
default: ssh
|
||||||
|
|
||||||
|
- *g:netrw_tmpfile_escape* =' &;'
|
||||||
|
- escape() is applied to all temporary files
|
||||||
|
- to escape these characters.
|
||||||
|
-
|
||||||
|
*g:netrw_timefmt* specify format string to vim's strftime().
|
||||||
|
The default, "%c", is "the preferred date
|
||||||
|
and time representation for the current
|
||||||
|
diff --git a/runtime/doc/tags b/runtime/doc/tags
|
||||||
|
index 300dfd18a6..7ce3b63075 100644
|
||||||
|
--- a/runtime/doc/tags
|
||||||
|
+++ b/runtime/doc/tags
|
||||||
|
@@ -7863,7 +7863,6 @@ g:netrw_ssh_browse_reject pi_netrw.txt /*g:netrw_ssh_browse_reject*
|
||||||
|
g:netrw_ssh_cmd pi_netrw.txt /*g:netrw_ssh_cmd*
|
||||||
|
g:netrw_sshport pi_netrw.txt /*g:netrw_sshport*
|
||||||
|
g:netrw_timefmt pi_netrw.txt /*g:netrw_timefmt*
|
||||||
|
-g:netrw_tmpfile_escape pi_netrw.txt /*g:netrw_tmpfile_escape*
|
||||||
|
g:netrw_uid pi_netrw.txt /*g:netrw_uid*
|
||||||
|
g:netrw_use_noswf pi_netrw.txt /*g:netrw_use_noswf*
|
||||||
|
g:netrw_use_nt_rcp pi_netrw.txt /*g:netrw_use_nt_rcp*
|
||||||
|
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
||||||
|
index 1c98104d00..805474616d 100644
|
||||||
|
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
||||||
|
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
||||||
|
@@ -378,7 +378,6 @@ else
|
||||||
|
call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\')
|
||||||
|
endif
|
||||||
|
call s:NetrwInit("g:netrw_menu_escape",'.&? \')
|
||||||
|
-call s:NetrwInit("g:netrw_tmpfile_escape",' &;')
|
||||||
|
call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\<C-V>\"")
|
||||||
|
if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4')
|
||||||
|
let s:treedepthstring= "│ "
|
||||||
|
@@ -1799,14 +1798,14 @@ function netrw#NetRead(mode,...)
|
||||||
|
".........................................
|
||||||
|
" NetRead: (sftp) NetRead Method #9 {{{3
|
||||||
|
elseif b:netrw_method == 9
|
||||||
|
- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".tmpfile)
|
||||||
|
+ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1))
|
||||||
|
let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method)
|
||||||
|
let b:netrw_lastfile = choice
|
||||||
|
|
||||||
|
".........................................
|
||||||
|
" NetRead: (file) NetRead Method #10 {{{3
|
||||||
|
elseif b:netrw_method == 10 && exists("g:netrw_file_cmd")
|
||||||
|
- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".tmpfile)
|
||||||
|
+ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1))
|
||||||
|
let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method)
|
||||||
|
let b:netrw_lastfile = choice
|
||||||
|
|
||||||
|
@@ -8927,14 +8926,17 @@ function s:GetTempfile(fname)
|
||||||
|
endif
|
||||||
|
|
||||||
|
" use fname's suffix for the temporary file
|
||||||
|
+ " Restrict the suffix to word characters so shell metacharacters in a
|
||||||
|
+ " remote filename (e.g. sftp://host/foo.txt;id) cannot ride along into
|
||||||
|
+ " the tempfile name and out into a downstream shell command.
|
||||||
|
if a:fname != ""
|
||||||
|
- if a:fname =~ '\.[^./]\+$'
|
||||||
|
+ if a:fname =~ '\.\w\+$'
|
||||||
|
if a:fname =~ '\.tar\.gz$' || a:fname =~ '\.tar\.bz2$' || a:fname =~ '\.tar\.xz$'
|
||||||
|
- let suffix = ".tar".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e')
|
||||||
|
+ let suffix = ".tar".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e')
|
||||||
|
elseif a:fname =~ '.txz$'
|
||||||
|
- let suffix = ".txz".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e')
|
||||||
|
+ let suffix = ".txz".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e')
|
||||||
|
else
|
||||||
|
- let suffix = substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e')
|
||||||
|
+ let suffix = substitute(a:fname,'^.*\(\.\w\+\)$','\1','e')
|
||||||
|
endif
|
||||||
|
let tmpfile= substitute(tmpfile,'\.tmp$','','e')
|
||||||
|
let tmpfile .= suffix
|
||||||
|
diff --git a/runtime/pack/dist/opt/netrw/doc/netrw.txt b/runtime/pack/dist/opt/netrw/doc/netrw.txt
|
||||||
|
index 01a5bda597..144bab5fb3 100644
|
||||||
|
--- a/runtime/pack/dist/opt/netrw/doc/netrw.txt
|
||||||
|
+++ b/runtime/pack/dist/opt/netrw/doc/netrw.txt
|
||||||
|
@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|)
|
||||||
|
such as listing, file removal, etc.
|
||||||
|
default: ssh
|
||||||
|
|
||||||
|
- *g:netrw_tmpfile_escape* =' &;'
|
||||||
|
- escape() is applied to all temporary files
|
||||||
|
- to escape these characters.
|
||||||
|
-
|
||||||
|
*g:netrw_timefmt* specify format string to vim's strftime().
|
||||||
|
The default, "%c", is "the preferred date
|
||||||
|
and time representation for the current
|
||||||
|
--
|
||||||
|
2.44.4
|
||||||
|
|
||||||
@@ -37,6 +37,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
|
|||||||
file://CVE-2026-52859.patch \
|
file://CVE-2026-52859.patch \
|
||||||
file://CVE-2026-52860.patch \
|
file://CVE-2026-52860.patch \
|
||||||
file://CVE-2026-28422.patch \
|
file://CVE-2026-28422.patch \
|
||||||
|
file://CVE-2026-42307.patch \
|
||||||
"
|
"
|
||||||
|
|
||||||
PV .= ".1683"
|
PV .= ".1683"
|
||||||
|
|||||||
Reference in New Issue
Block a user