[PATCH 2/2] advisories: Reject GLIBC-SA-2026-0008

[Siddhesh Poyarekar]

On 21/04/2026 13:56, Florian Weimer wrote:
> * Carlos O'Donell:
> 
>> On 4/21/26 12:53 PM, Florian Weimer wrote:
>>> * Carlos O'Donell:
>>>
>>>> +NIS+ support in the GNU C Library was never officially supported even
>>>> +though an incomplete implementation of the APIs was made pulibc.
>>>> +Applications should not use any of the NIS+ APIs and should move to
>>>> +modern identity and access management services.
>>>
>>> Maybe also mention that there to the glibc team's knowledge, there are
>>> no server implementations available that this code could interact with?
>>>
>>
>> diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008
>> index 748c0c8944..04b3eeee3e 100644
>> --- a/advisories/GLIBC-SA-2026-0008
>> +++ b/advisories/GLIBC-SA-2026-0008
>> @@ -10,9 +10,11 @@ The use of a trusted server means no trust boundary is crossed and this
>>    is therefore considered a normal bug.
>>    
>>    NIS+ support in the GNU C Library was never officially supported even
>> -though an incomplete implementation of the APIs was made pulibc.
>> -Applications should not use any of the NIS+ APIs and should move to
>> -modern identity and access management services.
>> +though an incomplete implementation of the APIs was made pulibc.  To the
>> +best knowledge of the glibc security team no open-source NIS+ server
>> +implementations were ever released for use with this API.  Applications
>> +should not use any of the NIS+ APIs and should move to modern identity
>> +and access management services.
>>    
>>    CVE-Id: CVE-2026-5358
>>    Public-Date: 2026-04-10
>> ---
>>
>> Like that?
> 
> Yes, it's fine with me.  Let's wait a bit what others think.
> 

LGTM too.

Reviewed-by: Siddhesh Poyarekar <siddhesh@gotplt.org>