<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 28 June 2017 at 17:58, akuster808 <span dir="ltr"><<a href="mailto:akuster808@gmail.com" target="_blank">akuster808@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><p>Please double check the revert in master. Is the commit message
wrong or did the wrong thing get removed?</p>
<p></p></blockquote></div><br>The revert in master:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra">libxml2: Revert "Add an XML_PARSE_NOXXE flag to block all entities loading even local"</div><div class="gmail_extra"> .../libxml/libxml2/CVE-2016-9318.patch | 207 ---------------------<br></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra">-From 7fa1cd31552d52d50a9101f07c816ff6dd2d9f19 Mon Sep 17 00:00:00 2001</div><div class="gmail_extra">-From: Doran Moppert <<a href="mailto:dmoppert@redhat.com">dmoppert@redhat.com</a>></div><div class="gmail_extra">-Date: Fri, 7 Apr 2017 16:45:56 +0200</div><div class="gmail_extra">-Subject: [PATCH] Add an XML_PARSE_NOXXE flag to block all entities loading</div><div class="gmail_extra">- even local</div><div class="gmail_extra"><br></div><div class="gmail_extra">So the commit message matches the summary of the patch being deleted.</div><div class="gmail_extra"><br></div><div class="gmail_extra">The addition of this patch:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra"> libxml2: CVE-2016-9318</div><div class="gmail_extra"><br></div><div class="gmail_extra">diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-9318.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-9318.patch<br></div><div class="gmail_extra">new file mode 100644</div><div class="gmail_extra">index 00000000000..3581ab83df1</div><div class="gmail_extra">--- /dev/null</div><div class="gmail_extra">+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-9318.patch</div><div class="gmail_extra">@@ -0,0 +1,207 @@</div><div class="gmail_extra">+From 7fa1cd31552d52d50a9101f07c816ff6dd2d9f19 Mon Sep 17 00:00:00 2001</div><div class="gmail_extra">+From: Doran Moppert <<a href="mailto:dmoppert@redhat.com">dmoppert@redhat.com</a>></div><div class="gmail_extra">+Date: Fri, 7 Apr 2017 16:45:56 +0200</div><div class="gmail_extra">+Subject: [PATCH] Add an XML_PARSE_NOXXE flag to block all entities loading</div><div class="gmail_extra">+ even local</div><div class="gmail_extra"><br></div><div class="gmail_extra">So the addition of the patch also matches.</div><div class="gmail_extra"><br></div></div><div class="gmail_extra">The revert actually happened upstream:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><a href="https://git.gnome.org/browse/libxml2/commit/id=030b1f7a27c22f9237eddca49ec5e620b6258d7d">https://git.gnome.org/browse/libxml2/commit/id=030b1f7a27c22f9237eddca49ec5e620b6258d7d</a><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Conclusion: I think the patch is good.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Ross</div></div></div></div>