diff mbox series

[meta-webserver,blacksail,9/16] webmin: patch CVE-2026-125392

Message ID 20261112044426.3933391-9-ankur.tyagi85@gmail.com
State Under Review
Delegated to: Ankur Tyagi
Headers show
Series [meta-oe,blacksail,1/16] 7zip: upgrade 26.05 -> 26.06 | expand

Commit Message

Ankur Tyagi Nov. 12, 2026, 4:44 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-125392

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../webmin/files/CVE-2026-125392.patch        | 26 +++++++++++++++++++
 .../recipes-webadmin/webmin/webmin_2.653.bb   |  1 +
 2 files changed, 27 insertions(+)
 create mode 100644 meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch
diff mbox series

Patch

diff --git a/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch
new file mode 100644
index 0000000000..f357eb703a
--- /dev/null
+++ b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch
@@ -0,0 +1,26 @@ 
+From 261c858c1f09b734add7239b835c1085eab3106c Mon Sep 17 00:00:00 2001
+From: Jamie Cameron <jcameron@webmin.com>
+Date: Sun, 8 Nov 2026 17:20:57 -0800
+Subject: [PATCH] Add HTML escaping in all-records mode
+
+(cherry picked from commit 224cbd91467c98c3147df695fe9abc8149183356)
+CVE: CVE-2026-125392
+Upstream-Status: Backport [https://github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ bind8/edit_recs.cgi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bind8/edit_recs.cgi b/bind8/edit_recs.cgi
+index 2141c0a12..627143b37 100755
+--- a/bind8/edit_recs.cgi
++++ b/bind8/edit_recs.cgi
+@@ -268,7 +268,7 @@ for(my $i=0; $i<@_; $i++) {
+ 		if (length($joined) > 80) {
+ 			$joined = substr($joined, 0, 80)." ...";
+ 			}
+-		push(@cols, $joined);
++		push(@cols, &html_escape($joined));
+ 		}
+ 	if ($config{'allow_comments'} && $in{'type'} ne "WKS") {
+ 		push(@cols, &html_escape($r->{'comment'}));
diff --git a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb
index e4380e16a0..8598994a17 100644
--- a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb
+++ b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb
@@ -18,6 +18,7 @@  SRC_URI = "${SOURCEFORGE_MIRROR}/webadmin/webmin-${PV}.tar.gz \
            file://mysql-config-fix.patch \
            file://webmin.service \
            file://CVE-2026-125391.patch \
+           file://CVE-2026-125392.patch \
             "
 SRC_URI[sha256sum] = "9acc680d3d45cee876f36fc8810ce68bb6e44a0365e245a4298a180e0d016696"
 UPSTREAM_CHECK_URI = "http://www.webmin.com/download.html"