Re: Incomplete fix for Emacs CVE-2026-79992

[Sam James <sam () gentoo org>]

Sean Whitton <spwhitton () spwhitton name> writes:

> Wonyoung Jung of 78ResearchLab, using their PatchHawk tool, discovered
> that the fix for CVE-2026-79992 was incomplete.
> The tramp-user-regexp failed to check for some additional problematic
> characters in user names, meaning that exploitation was still possible.
>
> The attached patch by TRAMP maintainer Michael Albinus addresses the
> problem.  It will be included in Emacs 31.2 though that won't be
> released soon.

Red Hat, would you be willing to provide another CVE for this? Thank
you.

Attachment: signature.asc
Description: