Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2225856/?format=api
{ "id": 2225856, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2225856/?format=api", "web_url": "http://patchwork.ozlabs.org/project/glibc/patch/20260421164416.4031726-2-carlos@redhat.com/", "project": { "id": 41, "url": "http://patchwork.ozlabs.org/api/1.1/projects/41/?format=api", "name": "GNU C Library", "link_name": "glibc", "list_id": "libc-alpha.sourceware.org", "list_email": "libc-alpha@sourceware.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260421164416.4031726-2-carlos@redhat.com>", "date": "2026-04-21T16:43:48", "name": "[2/2] advisories: Reject GLIBC-SA-2026-0008", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "a8800547edbca76f7dc9fb10b944ed5ec79cff4f", "submitter": { "id": 22438, "url": "http://patchwork.ozlabs.org/api/1.1/people/22438/?format=api", "name": "Carlos O'Donell", "email": "carlos@redhat.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/glibc/patch/20260421164416.4031726-2-carlos@redhat.com/mbox/", "series": [ { "id": 500854, "url": "http://patchwork.ozlabs.org/api/1.1/series/500854/?format=api", "web_url": "http://patchwork.ozlabs.org/project/glibc/list/?series=500854", "date": "2026-04-21T16:43:47", "name": "[1/2] advisories: Document rejection process in README.", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500854/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2225856/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2225856/checks/", "tags": {}, "headers": { "Return-Path": "<libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "libc-alpha@sourceware.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "libc-alpha@sourceware.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=eFwoNzGx;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)", "sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=eFwoNzGx", "sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com", "sourceware.org; spf=pass smtp.mailfrom=redhat.com", "server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124" ], "Received": [ "from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0SrR6YYxz1yJG\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 22 Apr 2026 02:44:55 +1000 (AEST)", "from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 0B8974BA9024\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 21 Apr 2026 16:44:54 +0000 (GMT)", "from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id 445584BA23E9\n for <libc-alpha@sourceware.org>; Tue, 21 Apr 2026 16:44:28 +0000 (GMT)", "from mail-qt1-f198.google.com (mail-qt1-f198.google.com\n [209.85.160.198]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-561-QDaeqtfCPwCD-QoWbwOaHw-1; Tue, 21 Apr 2026 12:44:25 -0400", "by mail-qt1-f198.google.com with SMTP id\n d75a77b69052e-50fae95c82cso27799001cf.2\n for <libc-alpha@sourceware.org>; Tue, 21 Apr 2026 09:44:24 -0700 (PDT)", "from codonell-thinkpadp16vgen1.rmtcaon.csb ([198.48.244.52])\n by smtp.gmail.com with ESMTPSA id\n 6a1803df08f44-8b02aeb04e0sm104116796d6.46.2026.04.21.09.44.21\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 21 Apr 2026 09:44:21 -0700 (PDT)" ], "DKIM-Filter": [ "OpenDKIM Filter v2.11.0 sourceware.org 0B8974BA9024", "OpenDKIM Filter v2.11.0 sourceware.org 445584BA23E9" ], "DMARC-Filter": "OpenDMARC Filter v1.4.2 sourceware.org 445584BA23E9", "ARC-Filter": "OpenARC Filter v1.0.0 sourceware.org 445584BA23E9", "ARC-Seal": "i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776789868; cv=none;\n b=CuPO5V+qg7qYJN9qlh2dd7D0dY1Da2lkQWbuIUMS+jg2tGPedyU+xpy9DriPPfM66LXMwHLRXp3TE91NkSXxdAUrGgzyT8JAS70UbzJFpknqxtJAbcVVGaZS5FZadwPGAx0+M9mpKO15D5BiTeW9mhHPJPXh0C55YJ9I79rwGOs=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776789868; c=relaxed/simple;\n bh=kRmfD48+tt7HzgIbLhGkOABzXPEMBN/FVe2Fmn7hb2A=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=Rk9hEO2qYFalytRjvXoEsWyQZdvoMXXAnNwG9nzM9RoC9dy/EvuA0NMzWZUY0iLC+y8uWx8lsQXZd+ApDnPUmvy1NZXvGV4BZVOFKzxUBhKy2h4K2dFnjlvAB5Kvt3uvYegre5hUCbTrg4a8ldKRqU+j1sWeAvLtHy7yv1R29ic=", "ARC-Authentication-Results": "i=1; server2.sourceware.org", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776789867;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=M2p44JW7J9okU9efjCcczNqT/5DDa/GQV0y+ZJZcT20=;\n b=eFwoNzGxItHO6idtVli0c6YdbrRBEwe7r5+0emdEKZC+EseV83Rccwalixx2HCFwRCZDWf\n mTHdatEsiTTW/EJdEMd7TPYV5iuQLBP44s6NUTJy4yF5BOPogQWafoEARdQaqjSjh14o/W\n c65ZjUqJ6Rlte26tpmOFutA5JOURoGw=", "X-MC-Unique": "QDaeqtfCPwCD-QoWbwOaHw-1", "X-Mimecast-MFC-AGG-ID": "QDaeqtfCPwCD-QoWbwOaHw_1776789864", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776789863; x=1777394663;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=M2p44JW7J9okU9efjCcczNqT/5DDa/GQV0y+ZJZcT20=;\n b=YalNYTiBFmmj8YOtaKEGrDBq3FT+cM9p1v0vVrAC4oknQ7xkDlib9T8z2UUPRwBWqS\n N3rdQ3x37J9eEPdvaJ4PqdRU/4iU9kVHHiw6TjKiJSAe59TnNEMg0LJwTpmaxlzI0oAP\n OVoHlvF88xA703abXgXSbk4t4zEsqYB9KQPRqbsgUmLTMpHlFTj6R7wkrGduusPYfd8G\n x2FTnMVP0xnUKeV9zHIxjN5IvVp6YLnXzzBOS5ZFV34tIUFdOgLRR4RvJz/5PfWPvYod\n GjCM/GSnjK789Vvz3FPPBztWhSTBhdevd02UKILWgERz527b70heOqNB5FW/urPEOS3V\n J16g==", "X-Gm-Message-State": "AOJu0Yw2Dyt+G915I98cgNPzYmRVsm/U9TSmaoTVhem6ujxCnACKaTxU\n MP2dlixoRguroY+GXo9kCV/hshzJtzMELrFHzPvqxYY0XPtLqyZDh5zf7gP48i5c2/DMunYY/3y\n cwFPOM6jRDSwZI4wHfognowOSavzR/XNxbeuY5mHQecat5mqzT1lG6K0C8MffUfVnKfbYHh9F0m\n Y7HkqTQW1VdXSmbzha5I9BumLOKj2GFozcT300IgYjUEk=", "X-Gm-Gg": "AeBDieuQOFcSdou0rqRXNPQO3QsAIywI53w9u+2B9tDeccYaogk+hWqCjmy+ZtPZmob\n eiTEKql+EXd9XgqIRcMiCJ+qK2zMLJ4oSEbYqxTAo9U9zBf2ZwWl4kByVTwAhpR14+3mNXhr4Ze\n tapwG4Yev6yaRIgLcqGmErBkRolzv1W+a6ijH7M5MlnVwGuqZOkRDFA+XBB+8xA1JuUUUWlTD8V\n FcJjROtD6XR178zWkL/BEBGjL3hlBZMGhbyUYIMr9lzYO0u1YKYRM7WFlgrm3LS8MBSa9zlKklo\n 0LFKv/dgkI3oK+4OUGs57ZI5psfzaJAkIXXuq059P5jf22et79zDGJsvGTFv2r6xaoc2MJzb4Hb\n eeGT0wsZwa7YZHCmecdomVmj2OL54h49IHVQpv0l/o21frSFC4Vk0j1C1LCdIXFD9MyIjIpNdlL\n BetxT26jca6BWAe3OTH19iG/04mGnDkPZ1ZkZof/Xkydc4iUkgc93kMvNnRKx6EA==", "X-Received": [ "by 2002:a05:622a:5914:b0:50d:aa29:2b67 with SMTP id\n d75a77b69052e-50e36c748edmr289183861cf.49.1776789863328;\n Tue, 21 Apr 2026 09:44:23 -0700 (PDT)", "by 2002:a05:622a:5914:b0:50d:aa29:2b67 with SMTP id\n d75a77b69052e-50e36c748edmr289183371cf.49.1776789862825;\n Tue, 21 Apr 2026 09:44:22 -0700 (PDT)" ], "From": "Carlos O'Donell <carlos@redhat.com>", "To": "libc-alpha@sourceware.org, siddhesh@gotplt.org,\n adhemerval.zanella@linaro.org", "Cc": "Carlos O'Donell <carlos@redhat.com>", "Subject": "[PATCH 2/2] advisories: Reject GLIBC-SA-2026-0008", "Date": "Tue, 21 Apr 2026 12:43:48 -0400", "Message-ID": "<20260421164416.4031726-2-carlos@redhat.com>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<20260421164416.4031726-1-carlos@redhat.com>", "References": "<20260421164416.4031726-1-carlos@redhat.com>", "MIME-Version": "1.0", "X-Mimecast-Spam-Score": "0", "X-Mimecast-MFC-PROC-ID": "eq1Lg6wV1Hz_7Ttk_CvbsWp5xRs6KkEy7xC7ES9L8qs_1776789864", "X-Mimecast-Originator": "redhat.com", "Content-Transfer-Encoding": "8bit", "content-type": "text/plain; charset=\"US-ASCII\"; x-default=true", "X-BeenThere": "libc-alpha@sourceware.org", "X-Mailman-Version": "2.1.30", "Precedence": "list", "List-Id": "Libc-alpha mailing list <libc-alpha.sourceware.org>", "List-Unsubscribe": "<https://sourceware.org/mailman/options/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=unsubscribe>", "List-Archive": "<https://sourceware.org/pipermail/libc-alpha/>", "List-Post": "<mailto:libc-alpha@sourceware.org>", "List-Help": "<mailto:libc-alpha-request@sourceware.org?subject=help>", "List-Subscribe": "<https://sourceware.org/mailman/listinfo/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=subscribe>", "Errors-To": "libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org" }, "content": "---\n advisories/GLIBC-SA-2026-0008 | 24 ++++++++++++++----------\n 1 file changed, 14 insertions(+), 10 deletions(-)", "diff": "diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008\nindex 1dbd9808e0..748c0c8944 100644\n--- a/advisories/GLIBC-SA-2026-0008\n+++ b/advisories/GLIBC-SA-2026-0008\n@@ -1,16 +1,20 @@\n-Static buffer overflow in deprecated nis_local_principal\n+REJECTED: Static buffer overflow in deprecated nis_local_principal\n \n-The obsolete nis_local_principal function in the GNU C Library version\n-2.43 and older may overflow a buffer in the data section, which could\n-allow an attacker to spoof a crafted response to a UDP request generated\n-by this function and overwrite neighboring static data in the requesting\n-application.\n+REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been\n+discovered that no NIS+ client or server was ever released for any\n+Linux-based OS distributions and as such this makes the API provisional\n+and unused. Secondly it has been discovered that the NIS+ cold start\n+cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API\n+can only be called with a trusted server from the pre-populated cache.\n+The use of a trusted server means no trust boundary is crossed and this\n+is therefore considered a normal bug.\n \n-NIS support is obsolete and has been deprecated in the GNU C Library\n-since version 2.26 and is only maintained for legacy usage. Applications\n-should port away from NIS to more modern identity and access management\n-services.\n+NIS+ support in the GNU C Library was never officially supported even\n+though an incomplete implementation of the APIs was made pulibc.\n+Applications should not use any of the NIS+ APIs and should move to\n+modern identity and access management services.\n \n CVE-Id: CVE-2026-5358\n Public-Date: 2026-04-10\n+Rejected-Date: 2026-04-21\n Reported-by: Rahul Hoysala\n", "prefixes": [ "2/2" ] }