Public bug reported:
Since:
vim (2:9.1.0016-1ubuntu7.19) noble-security; urgency=medium
* SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)
- debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in
runtime/autoload/netrw.vim
vim sftp://anyhost.com//any/file
(need set nocp at least in vimrc for netrw to work)
fails with:
Rejecting invalid hostname: <anyhost.com>
That's caused by an incorrect regexp in that NetrwValidateHostname
function.
> let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]{,62}[a-zA-Z0-9]\)\?$'
Unless with verymagic, the interval operator is \{x,y\}, not {x,y}.
Patch attached just changes {,62} to \{,62\}.
** Affects: vim (Ubuntu)
Importance: Undecided
Status: New
** Patch added: "simple fix for regex syntax error"
https://bugs.launchpad.net/bugs/2166178/+attachment/5996978/+files/fix.diff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166178
Title:
[REGRESSION] netrw: "Rejecting invalid hostname" error on valid
hostnames
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/vim/+bug/2166178/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
