DLPX-97846 Ubuntu Security Notification for Vim Vulnerabilities (USN-8500-1)

[prakashsurya]

Summary

Backports the Ubuntu USN-8500-1 vim security update (2:9.1.0016-1ubuntu7.17) to the release-track appliance via the misc-debs extension point. The release build (2026.4.0.0) installs 2:9.1.0016-1ubuntu7.16, which is still vulnerable to these CVEs.

Remediates:

• DLPX-97851 — CVE-2026-57455 (CVSS 7.8)
• DLPX-97850 — CVE-2026-55693 (CVSS 7.8)
• DLPX-97847 — CVE-2026-57456 (CVSS 7.8)
• DLPX-97846 — CVE-2026-55895 (CVSS 7.8)

Changes:

• packages/misc-debs/config.sh: three sha256-pinned debs=() entries — the vim binaries the appliance installs — under a comment block naming the USN, Jira tickets, CVEs, and the Ubuntu archive source.
• .debs uploaded to http://artifactory.delphix.com/artifactory/linux-pkg/misc-debs/ (epoch stripped from filenames per Debian pool convention):
  • vim_9.1.0016-1ubuntu7.17_amd64.deb
  • vim-common_9.1.0016-1ubuntu7.17_all.deb
  • vim-runtime_9.1.0016-1ubuntu7.17_all.deb

Fetched from the Ubuntu 24.04 LTS (noble) noble-security/noble-updates archive.

Test plan

• PR check passes (make shellcheck + make shfmtcheck — both clean locally on this branch).
• misc-debs Jenkins pre-push job resolves all three artifactory URLs with matching sha256s.
• git-ab-pre-push builds an appliance image with ...ubuntu7.17 replacing 7.16; pre-checkin regression passes.
• On a VM from the resulting image: dpkg-query -W vim vim-common vim-runtime reports 2:9.1.0016-1ubuntu7.17.

🤖 Generated with Claude Code

Testing Done

ab-pre-push build #14508: IN PROGRESS

• Build: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/appliance-build-orchestrator-pre-push/14508/
• Tested: linux-pkg@ef02e7b (against release); additional package built: misc-debs
• Status: running — result not yet available; re-run recording in completed mode once the build finishes.

[Copilot]

Pull request overview

Backports the Ubuntu USN-8500-1 security-fixed vim packages into the appliance via the misc-debs extension point, upgrading from ...7.16 to ...7.17 to remediate the listed CVEs.

Changes:

• Add sha256-pinned vim, vim-common, and vim-runtime .deb entries to packages/misc-debs/config.sh.
• Document the USN/CVE/Jira context for why these packages are being pinned.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.