diff mbox series

[wrynose,v2] vim: Fix CVE-2026-28417 hostname regression

Message ID 20260918101201.2899386-1-devanshp@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series [wrynose,v2] vim: Fix CVE-2026-28417 hostname regression | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Sept. 18, 2026, 10:12 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw
hostname validation. That CVE fix requires follow-up regression patches
because it rejects valid hostnames containing optional ports or
underscores.

Vim 9.2.0340 already contains that CVE fix and patch 9.2.0089, which
corrects optional-port handling. It still needs patch 9.2.0553 to accept
underscores, so backport that commit and retain its _gateway regression
test.

The netrw history hunk is adapted to preserve Wrynose's existing
multi-line history and append the upstream 2026 May 28 entry. The
src/version.c hunk is omitted because this backport does not change the
recipe version or Vim's upstream patch-number table.

[1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1
[2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda
[3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11
[4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
Changes in v2:
- Refreshed the patch against current Wrynose so the netrw history hunk applies cleanly.
- Renamed the embedded patch because Wrynose requires only one regression commit.
- Clarified the netrw header adaptation in Backport Changes.

 .../vim/files/CVE-2026-28417-regression.patch | 65 +++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |  1 +
 2 files changed, 66 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch b/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
new file mode 100644
index 0000000000..e5d947b737
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression.patch
@@ -0,0 +1,65 @@ 
+From a058d0dcd289ddb934b30125ac732f737bf89eb7 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 28 May 2026 20:53:53 +0000
+Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames
+ containing _
+
+Problem:  runtime(netrw): netrw rejects hostnames containing _
+          (lilydjwg)
+Solution: Relax the restriction and allow the underscore
+
+fixes: #20344
+
+CVE: CVE-2026-28417
+Upstream-Status: Backport [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11]
+
+Backport Changes:
+- Wrynose's netrw header uses a chronological change-history list instead
+  of upstream's "Last Change:" field, so add the equivalent 2026 May 28
+  history entry.
+- Omitted src/version.c because this backport does not change the recipe's
+  Vim version or its upstream patch-number table.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++--
+ src/testdir/test_plugin_netrw.vim              | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index c240bbd13..54be15b3f 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -24,6 +24,7 @@
+ " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
+ " 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit()
+ " 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913
++" 2026 May 28 by Vim Project allow underscores in hostname checking #20344
+ " 2026 Jun 16 by Vim Project Fix filename escaping in local file deletion
+ " Copyright:  Copyright (C) 2016 Charles E. Campbell {{{1
+ "             Permission is hereby granted to use and distribute this code,
+@@ -2604,8 +2605,8 @@ function s:NetrwValidateHostname(hostname)
+   " Username:
+   let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
+   " Hostname: 1-64 chars, alphanumeric/dots/hyphens.
+-  " No underscores. No leading/trailing dots/hyphens.
+-  let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
++  " No leading/trailing dots/hyphens.
++  let host_pat = '[a-zA-Z0-9_]\%([-a-zA-Z0-9._]\{0,62}[a-zA-Z0-9_]\)\?'
+   " Port: 16 bit unsigned integer
+   let port_pat = '\%(:\d\{1,5\}\)\?$'
+ 
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index a0a3915f5..8d7167793 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -574,6 +574,7 @@ endfunc
+ func Test_netrw_hostname()
+   let valid_hostnames = [
+   \   'localhost',
++  \   '_gateway',
+   \   '127.0.0.1',
+   \   '::1',
+   \   '0:0:0:0:0:0:0:1',
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 77f681410a..ce02c8b92d 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -45,6 +45,7 @@  SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-73076.patch \
            file://CVE-2026-73077.patch \
            file://CVE-2026-73078.patch \
+           file://CVE-2026-28417-regression.patch \
            "
 
 PV .= ".0340"