From patchwork Fri Sep 25 10:30:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ghanshyam Banait X-Patchwork-Id: 99225 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C16AC9830D for ; Fri, 25 Sep 2026 10:30:44 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4863.1790332236578141869 for ; Fri, 25 Sep 2026 03:30:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@windriver.com header.s=PPS06212021 header.b=LCWWMJ2E; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=3728c4202c=ghanshyam.banaitsanjay@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68P535i82499881 for ; Fri, 25 Sep 2026 03:30:36 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=PPS06212021; bh=zOOsmq6HAJweO5tHxIxd 67ID2jhfdOAcOnPe/CKrFxc=; b=LCWWMJ2Ecovuw6OJZnzR3kNE6pE1x8DypeN6 RpxZ7A+zv/pksijn9xY5Rqlg9djCy3qa9kPTILJZAPwY48gFdAXKhbb2PGyo7z2e zml8oEbowWyJUfyKJiPdg0RVqywYWrOARY/ROD3wMeR0h9DI6Xc3pcn8uM2xmqiv 6x84bAPHg+GDbDkylQof0RaFskxZaTsluWWMPCoVnLsdEN3zwRr2lOvNIwQ0c8A3 jOfqBtUV4m1Z1tlLbIG5SHBSGfFm5n8PXVgiFh9Dbhkpo3AMFG/XVQKp7qf6bCtC K2CH2Z0E7tur5y9bcj6na/7mCGjbMmX/TWWtnwmFf1oMaTzTig== Received: from mw6pr02cu001.outbound.protection.outlook.com (mail-westus2azon11022094.outbound.protection.outlook.com [52.101.48.94]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4gvt0xtc9t-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Fri, 25 Sep 2026 03:30:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bFaiFCpQTxXtxhCk2o7Ps4EOHGQBy8pHZkmZLLXZxgiMITmOfDxJiXqID5Dg1G88IfeuePHv9GSxDVrZGYhnIh/GaQOofWv9xNv1/xsjtMhRybrZcPuFsVfY4FvRU0t31LtZOcz9et1t6VH66QgZbO+sEWroWS6VUuwn2LF5W08KJnvtpU7mkjypiszqlOKbRo+5o6Vgfw3ud2TU3yFB+DLW+yfasaVuUhcYnmxLY6atyeSu2zXrpubDOpdKkoGSntD5dGmFe0UpXiFG2FLmIDZ6Qaqntv7CQbH+OujQtN1WzeV4z4lwdUPgBZ7HeFAghs19vWXcgU8TP9QcNDgZDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zOOsmq6HAJweO5tHxIxd67ID2jhfdOAcOnPe/CKrFxc=; b=WIkKbsSAG8Iq99Kp+RyreuCAIeGnHLmmQtZCjra1AKysPVqjaBhZepZUI1IUS2d5cmbB22lUJRGBMdCrOmUoRm7Po+yjjFkmmNDrSJjzpYO1uOPXAm7L8lELFW0mbSseoalcYq0F5MLwlEqL+IazqszmaMGOGmObhuO6ql86bb4yB8y/j3WKWCUObmnXJij12ZeoilqGSvL12XB8M7MdcwVk3MRNgPV0UpASUjntwVe22eYocmpv9mpM1yjNmJ3eWBvxxdR0NOG2TAEog3qnwASKyIooiOYQsqo8jsRXH4hrGUq00PlEwV7mWhNWpe12yv4aAtu8uv6KwU5cS9MqLw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from SJ5PPF57F27BA08.namprd11.prod.outlook.com (2603:10b6:a0f:fc02::82b) by MW4PR11MB6737.namprd11.prod.outlook.com (2603:10b6:303:20d::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Fri, 25 Sep 2026 10:30:32 +0000 Received: from SJ5PPF57F27BA08.namprd11.prod.outlook.com ([fe80::68e:cafc:75a:3e02]) by SJ5PPF57F27BA08.namprd11.prod.outlook.com ([fe80::68e:cafc:75a:3e02%8]) with mapi id 15.21.0451.014; Fri, 25 Sep 2026 10:30:32 +0000 From: Ghanshyam Banait To: openembedded-core@lists.openembedded.org Subject: [OE-core][PATCH] wget: fix CVE-2026-15146 Date: Fri, 25 Sep 2026 16:00:10 +0530 Message-Id: <20260925103010.3001030-1-Ghanshyam.BanaitSanjay@windriver.com> X-Mailer: git-send-email 2.40.0 X-ClientProxiedBy: SEWP216CA0094.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2bf::11) To SJ5PPF57F27BA08.namprd11.prod.outlook.com (2603:10b6:a0f:fc02::82b) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ5PPF57F27BA08:EE_|MW4PR11MB6737:EE_ X-MS-Office365-Filtering-Correlation-Id: 70c94015-feaa-4a98-06a5-08df1af006cf X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|376014|52116014|366016|13003099007|38350700014|10067099003|11063799006|56012099006|18002099003; X-Microsoft-Antispam-Message-Info: wrM8DUmxj0nPCgAhBivokrdKd/gwNRbV06W/MthKzj75fnGnOczaJg/qvJ8pHvrjM9ODLCBL6M5HlhmYQnBOqIDtvqesxQtPZHiC77g5NJdkLOlHb9EL45ypXX90jU8C2OTestwIJXl0zYttamj4fZ9AIMs55Ma0LiCD3XL8nZ1Tp7KnEk6g+ujGj3/mFlIG23XS8yPDHe9Ho+RiSxAG1bxeGxD/KUq32sFuWP0epimAETXcTDfmsjLdf//LHZQYbqUtchoLQuz5utRkqOHliySb4YLJY3EOaj9qTtlzGb85oetJtgvaWRFxnEzKEMMY4/gfRYDswd5b/ld6zHBCoP+fv8OggbScFOkehY0I3iCq0bqzJqbyarqr3XndCpQwNlP5uJRF+/0U/6VZx4mbFFOQt+PFpGtYHfYNqFnBAgP5huOMGqTGopFMnKT1PZi01e0JeJdwjpsKgNo3hHXYKnLDwj7IdEOXxp4HCXRqYTltY/bl7aaEWx6w3YzxdZwkp0cRveRJj8NrH28N9a+vONWQyyNgCrDeU18zU1eT+UIjOv2vXsWmfyXSuR08peqEivQilfTGx1hxMiiUyC5t/dphNpx226592j+ahBqvYgGHIoTTd/zmiar361aZlVCKwwGzzu8pVCfcaMvL6x31EbDfF9Z2cDUpGPMbM4KvKus= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ5PPF57F27BA08.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(376014)(52116014)(366016)(13003099007)(38350700014)(10067099003)(11063799006)(56012099006)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?SRyTfLUFjVT/6BnEza6JE74blNOR?= =?utf-8?q?+tzjj72aaXP4dDcdGXCdL6xGdteW/XYcHi3gU/5zz3J4+/36O2Y34y1m8u8gvunyb?= =?utf-8?q?lCtQieXRRo9KIiJ6xo7Wt0THVswIYC+siUE78s7J1pDGhwpnuMo4Cax0Hp9Jr2et2?= =?utf-8?q?VaMSqwm35t5G389zE65MqePcvfHysqX2/IuR4lGEGUFPKB8Au86MGE31alNNsiF/M?= =?utf-8?q?2Y13Pow8h7JGj5EGctfOqTwUrNhSQGhkI9maS512Gyv7tZUIIYIuu2JKsAdTnP3w1?= =?utf-8?q?OdSL3kflJsBMpjyjdFUMgM3PtquzJHNO1ab0FV6yMWfIjLIPO40XyEWvdTWue8iLz?= =?utf-8?q?oAOljSjG88xDl/1vQH0vkutd0Pq4bMbKT7wJzL2hc5PdpDBJbN1wl4J8lunK5On+E?= =?utf-8?q?eFyBCyC1WDsSbbNNXax/bVJ4ChH/Lu1TJXhShQR0jqX/BuSsniTEboUGI37+aKt+B?= =?utf-8?q?AySdYFOx9LARTmFOLJC/EajuIuca/fBjuoKojmRBu9TuwlHZ/tMl0xhxGbl4qpClA?= =?utf-8?q?g9OrpVWPLUpkJzyMIuPQPjnTA7vT1s+uG77DZW30LPfd2qeseYEv6FwUaXYwN94dP?= =?utf-8?q?aZ7NlzSkAKNkZpjHFNT9I9znHSek0i4SMeIaP2TyY5uxMExYJ2x8bINiESVR4dnNj?= =?utf-8?q?tBHPZY2jcaM/gOxX69xDGnmcDdwO3/orfI7mROZq5WAeUxsSEwvQNWyHK/QA1GHMq?= =?utf-8?q?yHXHJSKgRgLiZiCroOR2uUi9JS0P4LFDUfo0QmgDo/ELSR+9wWeWU1EIFmxvGp3bw?= =?utf-8?q?UDaDV7kotXeD2wn2kdn0WfwBdkzsImmNUhRLv79LuUkTKjwKd/bZ8en/wZ3W6/DI0?= =?utf-8?q?6/jjVf0sX3zKkYd1G9zy2NBcmAL/t2BnlPvGPI3jsIwSl8EMjkUY0+JAI6Q2CcVje?= =?utf-8?q?H7xp6PBVQDlAtX3CRBTjeQuygUblfoRrs7ABiXBZeuBqKtHCuP5Smqg+qA+NUuCBm?= =?utf-8?q?DgkrGlOQkHJYwpWZd7fP7lPlbNnxKDTf7W/oQHC8JkkzO8Q0dmaeXuXHcP/HSff7N?= =?utf-8?q?xQLDQ/BAcDHp5h1Dmx8BxfwfYzfRnogKqAC+dhJq4+tDaHQOdk5aQjxL+ivV93duz?= =?utf-8?q?B6z8YRA4R/QqPBNnMKLHAKbyOt8bhhKwkjcIUQ1CuXwEYxyZhcAG69pIk6fh76zxc?= =?utf-8?q?KXe/OGtmCC1eIOAlPGqRJvMKACtUaQe1XyWYWgTda4XThwjuIER46sC+F+gOElfPh?= =?utf-8?q?9nVa3eJi21j7pudvN7EGX/+21Nb/VQJ0isLhor/sAayqXXyOypo9xBtWmVDRsNPnG?= =?utf-8?q?RAYvdclJfhI9vXZhzx2XAVLSrxBjvvaYANTERD+v/ZgEDXJPCh2mr+lcDIKx9OBMp?= =?utf-8?q?UT3mkiqms6yX5wt1a4PGwGxz03gCPNML14c1wKxPN/ff1xMvaOqPIgbKYU5iZLlzL?= =?utf-8?q?neQsrMxP4eb11/XPlZ6kJhPf9BRJAruE3pUkRL73ywlAHPnqlU8+kJQdVrJiE/nLj?= =?utf-8?q?FwANmv/KNhuRuqTjO6vqrWu6VhURAWse2Hd9Rr+hVhUQczrd+TdBsU3sW53UG4oeK?= =?utf-8?q?gg3sA8fqnXVUMeSFjsm42IjWwjT3cyAVqfFTARxdiJPKNMC9MJl67YjPeqL4ae8eC?= =?utf-8?q?jmpnRYzBXUHBmdeNZ2kwva5JW5+g+qqI7WRdRn0UeNCJ3vByIydPjq9Pn4GJDgxL0?= =?utf-8?q?al+V121W/unX225wrtoiBaZUnbbdUuT1usy1cySvJAXS2VRJB9qiwHK59OqQD6XSd?= =?utf-8?q?hO8TxusdD?= X-Exchange-RoutingPolicyChecked: 2cFI16WlOoKb0zI1Y1dvC5BCK8eDbkVf7QIwdRxYpIx+u04DnuHWt8eOc0B0cUQJXSowtNYyhc25OF7uCzBR+JmMQfJ5h69vvvTfry+V7Xv7l5JWcCrIvraP3kihLEXYipgAVuHXzjF01t2qUw/jJxt8SbrYZbRiqCZLR0Clwq38lwD6VmXdBAiu7s+J0hemZFNPxPPSC+TBt4tEZFUY6X0qF6i+0QcPetw4EFOV7EjErODmjXFxLLpILhfJlJuf54wiLz6SJKnBMv7wnzQauyzNMg87CJF3nViMImzUSTBMISAQ0bXVEPYnQ6DUEVf2USlJtVbxGrPX+nsMswD3HQ== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 70c94015-feaa-4a98-06a5-08df1af006cf X-MS-Exchange-CrossTenant-AuthSource: SJ5PPF57F27BA08.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Sep 2026 10:30:32.1173 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: E67QO/v+yQJ4WAfYvWnPXrEnGH6CZPXYqPy+X3qfE/f+WPED32EVcVcGAaW+osIzGRjdp/9b6oCZEtpzb/M3nMF2xPcMdOOZ4dYf9qgQpbbafHZ/QPiSKin9kjtFExMc X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB6737 X-Proofpoint-ORIG-GUID: pJqBHQzbpX-WtSCMaFxAJsZz9syDYA0r X-Authority-Analysis: v=2.4 cv=Lv4HWXdc c=1 sm=1 tr=0 ts=6ab64d4b cx=c_pps a=kWDUzu7Sg0boEHrzbzcNEA==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=mDV3o1hIAAAA:8 a=PYnjg3YJAAAA:8 a=8r2qhXULAAAA:8 a=xNf9USuDAAAA:8 a=fxJcL_dCAAAA:8 a=t7CeM3EgAAAA:8 a=koS_CkKyrU6iBq9c7OQA:9 a=7jqKeCjk4K9AMwHj:21 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=8gvLZcY7Nlvl4CGD_6nf:22 a=FdTzh2GWekK77mhwV6Dw:22 a=ObmvtD6WMDJ6O4cpRQe4:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTI1MDA0MSBTYWx0ZWRfXzMEGfuNZf+sH jvzy78ym5NeP/vFcx7hS9u7lDfMzWLNVJr9ykjYqrEnLo9DTGqMfzpo9DnYtSiDZI0vz1XQtlPU dmplofG+Gv5x5BOVFl+EACCV04JP951XFzFNfAX5bx2MRMnLpHlpd5zNw89/YYXD2uN7+se8mNl HApi5qrm06BuTmXHuDm8i8HRTH/iqvvaCKUlvWtFAbzUYFLCl+kKqHcEwFre6qjUhUC0qy6FALg xVTI1gOO4tzelgPxzoowvmJr0LVayYpgEkRIEI5s7QLhUyqNv2BJ+GD83ADmac5zconptcNFAj9 8jsMAwadimAMB0K7HM/pMN9q4Sh/QJ4eN8E9u2/e15PxjJnY9mepcCV5LEGHWIpuhv3BdzsBekW plpLoea6qYo85xV0yvdlKRtjBaBlYQ0I2JOaoWMVtpCeBtlbPP2AacTTC+yUR56OjRLxILrkzAh qPDpnkpkeYjTZD0A6cQ== X-Proofpoint-GUID: pJqBHQzbpX-WtSCMaFxAJsZz9syDYA0r X-Proofpoint-Spam-Info: AW1haW4tMjYwOTI1MDA0MSBTYWx0ZWRfX8UzzRPfOfGlW bb+5NVbDu+c2Avfhx/3O43LPS/B9jMGcm4yelJ4THJ97qbkZBd1wuov6935X6gI+plTbFS6UB1f bPJoII+7u2W1tG3pTgeckfVKot0fWxoaMKVuLDwH6Dzyy+wq4mkZ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-25_02,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 phishscore=0 priorityscore=1501 suspectscore=0 clxscore=1015 spamscore=0 impostorscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609250041 X-MIME-Autoconverted: from 8bit to quoted-printable by mx0a-0064b401.pphosted.com id 68P535i82499881 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Sep 2026 10:30:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246613 GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port.This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources. Backport patch to fix CVE-2026-15146. https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b Ptest Result DURATION: 17 END: /usr/lib/wget/ptest 2026-09-25T10:26 STOP: ptest-runner TOTAL: 1 FAIL: 0 References: https://nvd.nist.gov/vuln/detail/CVE-2026-15146 https://www.cve.org/CVERecord?id=CVE-2026-15146 https://security-tracker.debian.org/tracker/CVE-2026-15146 https://ubuntu.com/security/CVE-2026-15146 Signed-off-by: Ghanshyam Banait --- .../wget/wget/CVE-2026-15146.patch | 126 ++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 127 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-15146.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-15146.patch b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch new file mode 100644 index 0000000000..5d8d1a898e --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch @@ -0,0 +1,126 @@ +From 4f85853f641863d5915786a8413e1a213726a62b Mon Sep 17 00:00:00 2001 +From: Acts1631 +Date: Sun, 5 Jul 2026 17:22:55 -0400 +Subject: ftp: validate PASV/LPSV response address against control connection + peer + +* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised + address, + (ftp_lpsv): Likewise. + +ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in +the server's 227 response without checking that it matched the peer +of the control connection. A malicious or compromised FTP server +could therefore direct wget's data connection to an arbitrary host and +port of its choosing (e.g. an internal service unreachable from the +attacker directly), which is a server-side request forgery. + +ftp_epsv() was already safe since it only extracts a port and reuses +the pre-filled control-connection address. + +Fix ftp_pasv() and ftp_lpsv() the same way: capture the control +connection's peer address via socket_ip_address() before parsing the +response, and reject the response (FTPINVPASV) if the parsed address +does not match. + +Verified with a fake FTP server that returns a PASV response pointing +at a different loopback address (127.0.0.2 instead of the real peer +127.0.0.1): before the fix wget connects to the spoofed address, after +the fix it rejects the response with "Cannot parse PASV response." +Legitimate transfers using a correctly-addressed PASV response +continue to work. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-15146 + +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b] + +Signed-off-by: Ghanshyam Banait +--- + src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/src/ftp-basic.c b/src/ftp-basic.c +index 4870256a..0f4bb821 100644 +--- a/src/ftp-basic.c ++++ b/src/ftp-basic.c +@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port) + int nwritten, i; + uerr_t err; + unsigned char tmp[6]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the PASV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port) + memcpy (IP_INADDR_DATA (addr), tmp, 4); + *port = ((tmp[4] << 8) & 0xff00) + tmp[5]; + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != AF_INET ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ return FTPINVPASV; ++ } ++ + return FTPOK; + } + +@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + uerr_t err; + unsigned char tmp[16]; + unsigned char tmpprt[2]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the LPSV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + DEBUGP (("*port is: %d\n", *port)); + } + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != addr->family ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), ++ af == 4 ? 4 : 16) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ xfree (respline); ++ return FTPINVPASV; ++ } ++ + xfree (respline); + return FTPOK; + } +-- +cgit v1.3 + diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index 51ef1d485e..91e998ea2f 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -25,6 +25,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58471.patch \ file://CVE-2026-16599.patch \ file://run-ptest \ + file://CVE-2026-15146.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"