[PATCH 2/2] advisories: Reject GLIBC-SA-2026-0008

[Carlos O'Donell]

On 4/21/26 12:53 PM, Florian Weimer wrote:
> * Carlos O'Donell:
> 
>> +NIS+ support in the GNU C Library was never officially supported even
>> +though an incomplete implementation of the APIs was made pulibc.
>> +Applications should not use any of the NIS+ APIs and should move to
>> +modern identity and access management services.
> 
> Maybe also mention that there to the glibc team's knowledge, there are
> no server implementations available that this code could interact with?
> 


diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008
index 748c0c8944..04b3eeee3e 100644
--- a/advisories/GLIBC-SA-2026-0008
+++ b/advisories/GLIBC-SA-2026-0008
@@ -10,9 +10,11 @@ The use of a trusted server means no trust boundary is crossed and this
  is therefore considered a normal bug.
  
  NIS+ support in the GNU C Library was never officially supported even
-though an incomplete implementation of the APIs was made pulibc.
-Applications should not use any of the NIS+ APIs and should move to
-modern identity and access management services.
+though an incomplete implementation of the APIs was made pulibc.  To the
+best knowledge of the glibc security team no open-source NIS+ server
+implementations were ever released for use with this API.  Applications
+should not use any of the NIS+ APIs and should move to modern identity
+and access management services.
  
  CVE-Id: CVE-2026-5358
  Public-Date: 2026-04-10
---

Like that?

Notes:
https://tldp.org/HOWTO/NIS-HOWTO/nisplus.html
https://community.unix.com/t/nis-plus-on-linux-redhat/146365
https://www.linuxquestions.org/questions/linux-newbie-8/nis-606831/

-- 
Cheers,
Carlos.