From patchwork Wed Jul 22 08:16:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93120 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDE59C44539 for ; Wed, 22 Jul 2026 08:17:22 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.12]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43193.1784708238209646599 for ; Wed, 22 Jul 2026 01:17:18 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=HLOZmJKL; spf=pass (domain: est.tech, ip: 40.107.159.12, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=kNTrtKlnQdSnqD6QQzXmvbR3D0NUYl4sw7hUGveJHC3spRqXWSre1b1BVQbTmspHaK2BGogwK7oQXJ4BtZ3o3SK1NMaN/b4z3B92g+N7cicXux1mUFvD6RViAY5H0FWIR6JTpCxNAysx5AT/sqLQF9oavwla2MfA0HjpLxqKDB5YaS8iXBrLZ0XzjevGm/y1EwYRbu3UjKL5oXA2afS+GD/dzCl/G4sClZLuLlx3SRcUw9hoqjuCOChw86PwW6EOHDWbGNzfW40VAvSyaqHmSIKZyhticA431W+5M+j3xGcIPLRpFoqZtLi84DsCfl8QAqnDVlVhfN7OBKTMizx+8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fWX9Ebjzl2/geou2kL+4vREcai+774h1I7GF7fx/tA4=; b=zHC1gNsatKgG/HQk2aQKuoe4oy7rbeaPePLjcOzWFLpEtY8+fj6zqPB7mLZLmJU1k8kvss+IM1dJwmUEisTRyJw4XZu4lfReMhYvCqsYZ+IWtnNQmnHg3zvZ+QomF/cLlQuoktaXb0/3aTo9AvzzLfUOhWkgzX0iYj6TdQW08AjO49SlbdexaFE2HpZiRirsP3UWvJ0yYzV6y0ifhzZwwAwTilrRM3nFy2gebu8yCqSklwCv448db2mLRAG0OP0h1zutigDqjLWsbXjS1xA2IiZMDNEqGwo8iTrLvC8MPoveFU4HeTD2n0U6CCo3LvjknVNldqUDC7y2cghpFizSSQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fWX9Ebjzl2/geou2kL+4vREcai+774h1I7GF7fx/tA4=; b=HLOZmJKL6hezhMS8HhKkadgNg3JrzK2zJSUW1XOXkZ+Y68MRKec/DS1nMB2jT1AKx3419+dRwVLgUuUxIEkiIvDepgN7aSI+4ZcqZGhFlvUzqXozE+Kk4pHxQRQdKOF4KxBwW7FY50rtSZ8URzRHwpFrM/3aEhEeF/+i8UeQO6TIMJ0PP8A0LQpXpFipNzawsjTcU8vaEXYanl2zpzcfvAaC6TabHcgoqQFbxmlCkTK/+yP1OpI3B1sblVwGEn/Ucdgci0bB2gdmVY7wFJJ5FWf8qV1fP/cEZQxO30AOxqvbdNZqAo69baV1a+448Z0YSYPgR9p1jwnWBB8HbgfH2w== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV1P189MB2129.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:58::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:17:14 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:17:13 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH 1/5] wget: fix CVE-2026-58469 Date: Wed, 22 Jul 2026 10:16:57 +0200 Message-ID: <20260722081709.14764-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: LO4P123CA0430.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:18b::21) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV1P189MB2129:EE_ X-MS-Office365-Filtering-Correlation-Id: a3883924-31ac-4845-03b5-08dee7c9a2ae X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|13003099007|56012099006|11063799006|10067099003|18002099003; X-Microsoft-Antispam-Message-Info: pdmzGNW6D0/GJ6NOY8T3xh9powqUlqN42RkPOTZLlr2vBEU9b/eicW8iWme8L83PQKtjqn8ezZaLcSW8IOTFjU4wzDi3zOiqK2nHuGcsy4gPW1srK5HLNkC+f9a5ifKUbM85gMZ88zTIDhl4thkds918LS8iM6tkRD0SJs6EThuYf/829z969f2jMkP/toOhGI52klIQq79bmZGC1mAlGWGEm6iZL7z6/fJIMn23L6Y+zOcRzONELkl2lC9gfIzjC8ry3Rlkl5XsOmrvMf/12gSknCCVBAbcCkAyavU/v+eIR7nw61ZE2dMuv7r/ofYd/Ld3YlFeKI/1playdlUFW/7f7rL3rvPLX3eiT3Az02A4TKm7DiVMLNvtcTTu+AjtrGIQZOaDxAqt1+8KeSbE0RseyKdAXq70vGsXbPdskCMUxkv2BJDA/d8OwmkTPgB5uinDDAlXozjXUVdoFvZ7UTHm5Kzp8oe0ZzEAwKc+M+k0FGAtNY7oZzRr9mJ5O9GAGrgSz+0amC4xX+aMprHAcqTHnqjv/a41plSrrFfsAVdQkmvpcHL5aqKuAptcPD7kM2eE964oEvpc5wSCiAG/YCvAtz9F5JKFVO/k+DOK7sR8urCuB0oA57ucILgJr8d4 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(13003099007)(56012099006)(11063799006)(10067099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: XrTLxQGdDuyd43kiLe7JO9a2taf5gOjA251FFDFg9aN0fhckEzy5Xa+yJNQC8Lbykp8Bpu/lAi1LvFLfpnCiY0SKAz5zkmp/Ue3jZvWOdr/KOD6QqWvrvdEePFWyCkL7lzYmhxbwejNUZtUF2b7UTGzvbjKvDNEr1hE2WrfWH54+NMgl/GzOsGFPqIGUb2Yc6Hniary72oA09a5iBT3JPMfzSenp6PzrCYq9JAQllHLBHr4ABFfpYisVeMLbUHEGWHN//1VlqbkZn1IjlvY4GXifK6oGsktQR/HUV0dBLZlyj3V0oX5kPe743kAYgY6+H3HwRB7D/yAJijBO4tY5LdPdRwtgNV/YSvNm9osg2bcPWx65wInP/+7Jrf0b6SjEiqLyM2mq8yAOMh6QgjymGYGQtXeScisNro2o9VKTqrJtP8ZLOkG+kt8Xovwe1cHGS5UjbzgV5TIHerSvaobCyUARzV4z7tCOhtaKVME0hBiSsebJc/69++Wx/tBFSTRqPTfjiRPp9F2O0ZFfjm0dPJAU51WiA3Su4o5ylVKhQBGYac7+UBXq2SXtAGdArDU5JfDFZsRq21LhygUHK+4+XcB1chT+FlHFinoqPWa/5NmjED97IzStKn+nGhUOd4H25KmZ97ODfeTrOePGUCPcCrpuph+/3wOwqOhmoZp548m0/iVs+0z54QFUr8n6jGlE3pN7tZPVlWXu/PMMgFRFHUjebVhMMCw/uFXvQFv+gZ246Q3h21qyb7q8dEpnGnW+bRiogZLVAhVko2cPqubmCiyLyQ4qzXgwQSl0hdwrAUv6ysxMVwjKZr4A4s+nHpg2DZAgqb7smXd0tM0mSBvABn7Hn8SG8V4/GtCJg9ivOWKBZlrX4dT4Qs9IIp6CeMWDIvfUWO07CAvLfaAPtPoNPcDkCRQXZter8ulNnomRYS4gdoAQr9kvHGHLgYNI9eW+rN7RYpy2Mlj1m3MxY/in97w3Rq4odrkTKU+lGJBWyFt37eQqYVdRk3nsv0ota3YKG8C0uxDaVHbNWmZBZtBnWkA5FeZmdKIVA7t0eXYj7F6vnPm1j47XoqrfzmqWtXzIpu/cwEzhsqsXRWfmYSV7bWDuucWyA1cM2pI8Y5cT+aIK8JLKGUpopW0QYojujkuiqJkf3v7hL7H3ur+7T1HaCb1DtdGD6GZNl2evZnuvrYLGSYBvBEP/7dzvmg8zXcn/RikWf26EE9oKmj7y/gb+vYjSNsJjdmmFGeZU0PsyLUuEUNsqMUhSU8mpyd/CNN5LCM7ym5471imLHNlVzg8OEsyjYscw6r7zULe0AM3/XX2vJf8d88be9IHDMW+8lmkT4WS6APCoFb4KJGcVTd38GU20wmKur5HkcEBgnzPnkjozUdjFRMmAS+1S1siymZLgCXwioWATH2w47piYGmJijYpcNAPZG2vApDFLz5BS5+XsHaSdAzKRkV0KQXmRXUfFa7G4P6TiGSyGnjUeuOZewUL9cQYGUCUTEmAdKR+ejW+t7eC8NOiEoN32Upleh7b1MDgsr6q+913eN3O8nYyMIWU9xtcZAF8R1JYz+0jJoJpuqhSQWqb5FnMQclvK4eFKXhWdKzJfslKkXRAgDaJLoZRMTM370dwat8fql9SL/QpWCdoqVWTOO8wi9rc/MSKvz8bMUKvB3Y5NmllfEU8GV8JNtMZy7ywKPLO3ioY27OYshGGNhXsx17O25EM2eNymnR8DDMzFyuqtIxrGBXmngA== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: a3883924-31ac-4845-03b5-08dee7c9a2ae X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:17:13.7591 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: JCxFFfsECHhXNsax7r2b4Fn3icwe25h9E+ZROytIUwy0w52vuTuCH7uDoWcHNXInnoGtfO23ET/PyYZNnMpswg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB2129 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:17:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241609 From: Amaury Couderc Backport patch to fix CVE-2026-58469. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58469 https://www.cve.org/CVERecord?id=CVE-2026-58469 https://security-tracker.debian.org/tracker/CVE-2026-58469 https://ubuntu.com/security/CVE-2026-58469 https://osv.dev/list?q=CVE-2026-58469 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58469.patch | 52 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch new file mode 100644 index 0000000000..c5d3df9090 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch @@ -0,0 +1,52 @@ +From c7d858a9ca8b9840e5edc520c36fe4f33f2e9cea Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:32:02 +0200 +Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer + underflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58469 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826] + +Signed-off-by: Amaury Couderc +--- + src/metalink.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/src/metalink.c b/src/metalink.c +index de2439c9..2d6e5846 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1041,7 +1041,6 @@ void + clean_metalink_string (char **str) + { + int c; +- size_t len; + char *new, *beg, *end; + + if (!str || !*str) +@@ -1049,7 +1048,7 @@ clean_metalink_string (char **str) + + beg = *str; + +- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (isspace(*beg)) + beg++; + + end = beg; +@@ -1062,12 +1061,10 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (end > beg && !isspace(*(end - 1))) + end--; + +- len = end - beg; +- +- new = xmemdup0 (beg, len); ++ new = xmemdup0 (beg, end - beg); + xfree (*str); + *str = new; + } diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index f0d3458462..a1f34dfb5c 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -15,6 +15,7 @@ DEPENDS += "autoconf-archive-native pod2man-native" SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ + file://CVE-2026-58469.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:17:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93121 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC07EC44533 for ; Wed, 22 Jul 2026 08:17:52 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.7]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43195.1784708267819870779 for ; Wed, 22 Jul 2026 01:17:48 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=biSN2L4A; spf=pass (domain: est.tech, ip: 40.107.159.7, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UXgxw9v0nTFD4vpDc8CYbd1tVqQ/gj0mLNvlgcqlt9H8Wk02f07cvQKApf+RwH1tK1CpVSThsEOz/n6sZm4jPd4u3Ve+xnMXqYZ/s/CA/quM1vk2850C5k9fYstVSEUomsrVfmnPcrm4VBzmD8OLtnyWJzmF3HljDai3Y247LcyYVUF2e3C7Bleq7WepMvwEcTUB1mUKZ404s+iVFwgFcEO+RpAOUhXEcntY9IG1u8vTP8HELRHoUC4dO9OUPlHFN9FYhEaFZrqmva5AiKazGCCw0Dxif6nc6HSk4ka6xoLmyaE6IafQKKpm9h3T4Eze6DKiy7I7v3vBYbS6qQ7hmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=AFwRahHwYJl90c1mnkov1YjG+reQkX3qf/oMotq3nKw=; b=Rvco81SscrJ7Gh/x9enj66Z9XDpCJn5TzqRMeAWpsZ+74/30O7foNfQT3wQT/FznEfp908iU4d3t9iaGoCN+fpSSrjIzsxcHy7bCKcKojBbJDzvruuWAreg3Wm1NKAgxP9LNeO2XnggM+Fz+NofVWh9QG3CCX6HpjjiPDrOMP3SRBNdRMbiizmYAOX6mFrnHf1zaSJqKzrRMwt+jiqELhwyr6AfeonSEESC6awV/HXvdS/7MRi3VGKBCrvmfwpBCxt1YS5wIfHuDauR1vgeGPwGnWfNQ7mQTYx9H51mGtX91yxbbvnechlMU0bSY+p9EhTR3z4jhomdMpHa8K4qgUw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AFwRahHwYJl90c1mnkov1YjG+reQkX3qf/oMotq3nKw=; b=biSN2L4AoJXWlUbtnwirp0+xZOfcvHZeE0wrcIPc2N0qtGA9Yhpk83+FV6WX/RrLx5ET2fPowP04rsgWq74D3yyHAYs9pYzwnYkamLezLTlDR0XwRp8qk89UpTsHCMuNHZ0HMHss+WKnK7RCL8pCLqVvtEKzuuPEiyM8yhj4aiuEjG4uwZxRG0Mm+ion9E0KUDp+O3d70ybpdxa+U3pE+FzDUp9ILxGgn1sefszWFUVE7Sp7QIgrarNYSgbaJ3GrPklEKDr1CNPORJcSAMKL6x8JlPmYjyzUVKew0oUoL9qe0oqRUqSXkN6pJ1dGf07Z1Iy0xSfeEpXv5psJR5Qivw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV1P189MB2129.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:58::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:17:41 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:17:41 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH 2/5] wget: fix CVE-2026-58470 Date: Wed, 22 Jul 2026 10:17:25 +0200 Message-ID: <20260722081735.14807-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU7PR01CA0025.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::15) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV1P189MB2129:EE_ X-MS-Office365-Filtering-Correlation-Id: 276fae16-d0d2-464d-a6a0-08dee7c9b363 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|13003099007|56012099006|11063799006|10067099003|18002099003; X-Microsoft-Antispam-Message-Info: Sehvo/LQyoulgwJfQp7M+dES7a44NF+E5lMLobMld44Vimw7e+EJ3gLsZsH4w0X7YdwHlbJ72j9PJWPq5E1rlM4nSOWAEP1FXzO57qp+i8k1tdUj8N1Q5j/zOW1ScE18JkOyJ8Wq5e/mrvP4ybujyAiW3FKR9c1UKFB6gV6OYlLA7FRzO9NCaUe2F35enNhdq+l6n4vkOGQL4R8onSZdeGBUMGkLWichaKQY0bkQVkKElDCYK7afURv/khwvWltwrj4dJsbO0fE1HQs4Ee8cBK3ErczMTpqKIRlcgFxju6rL4B6xUxMg/jSHFPq9T0xSKirVUhrbQZNdNoJIE1ywEF7AHDOCAOKFJYf9nVIccMnMGR4qo9G+6h2XprSbKISaknk4zSRczm/bpPfJQmoZ9bVVNYke0NUMeh6GjyVTbScAjS0C+wjN4KTq6Hdt5l+6FxBvUVJ/W4HJrHp56YRswmTr7G39VZM3dF/I/uHL2hAz+XAg+QoDE+/T14UCScAlP5al29f6/nbynl7rcKYdaGAbIQm1s3gMZgOQ5MmUKaeK1NMjq6Lkr3uMbPcn6Y7bB0pcxVa8KM+q4NYkZF8MGf5m8OmNteQU2njg9+SzbXobyjC/ueUHKHRdHcvAr1Ke X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(13003099007)(56012099006)(11063799006)(10067099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: bG9m4XS8oJ5SlrBSl3kHa73yXrwpUQs1gUDfIYJJt3ypJYmZzaUe87SxWW1MUtn81wJ4+cYJ3/Q0cUVksYFe+xblCTVFDxA0TbBm03KlZF4LCKR3WioltJ6doZ71TtAqWAvt8ZpU1qlxLxC6LPovVXPnhqcbT6IVwSDlwMThXB5NsFdumd9Jw5rLLTrjHcmcOsWrSCtK0RJNGDHKO/zMktA/DGTXzbz7dZuwrBgHnB+sOK51DpZmmoJiOaKVC9MVS6AXbzFZMNCmHeLDuY6MIfQ6A4TW+0e8fERoTHfFyANoIJQVufXgA0zsyjUPIZX9L7sMqKB+W65Zqk6EEd0QSMSeKHYUNfoZhd225lGT27B52c4plUjQwTLJh4Yg3kwCeI22k8Hfe1400/KQVC5IKFdHBA3HMa6Nx/mk2hpmRd0JXu/qVFB18WwJO/JvAtcA3sXEOPKrhBeGRVTzM0VyNne3IgsS/V20ud/ecvMOV/OJNPnEzUJ8kkeNyKv1PIK8H2hNLApfrMEI8EwJ7PnNHSl/Mm3W4SMieOy/bnqsO7dhn4tdR8OvuOvSod936Jarh5L42S1tb9k6rkTnM5KXz0XGZ8BRaDg16YML7gCngyYryulPMgDDGLcvmnGM44AyVUnbVXRKy84Frv4yNuwQDPvfQf5MTNg5AFB7tJj4abYVZ+eZpIxtbHChb8kIHyoBvOEltRho/G0GAVjoMZGVc6D4NZN1khJo/ktjHuLD4jN0QNzUqJXGpSlfsHkkJbYttpPLDn9Csv1b/UFK3AyJTNcpbmQyjTb/OpiZY28HFjYPc8bJzQxA22cTJtITUY34QVed4jAum82vUXUsAVmO1yRuORh7YvFOqvYSH7tmb2gn6cSs2VPAWX10rqxH6sOOa0CMIXqwUNhEqfh+wZFE/THHdzp8UoP8e0ORvjzJYPjY+GP+/66EP5PHWY7W16iEvjFJ9Nr7aI5NhYw4gxci1vqMl/JqnyCQx/6OeWo4N1enHt0Rb57xGHtFch0joaHBPyeuRw7pfc6ToJMdUtocfKnroX7uK2RrnzuaCuha00upg+HFiiD9lWyqguBw0v3B2GfBGteORKdIHEkCqQl23CP1TubFHYoWyDyqx5ETOwmAGcjhJo6EK8wTYx6ZRv0N1ek1YuTUfEbdA+D1sqkl0P/KKOxSgJiJI1HAK73sdIXPafTINdlSp8g3/nW+aMswbFy60BqYMDMvv1QahL8p4CCa3lF6Y1UbdbdwBkLU/svRTvhek+Tmj5d7H3Pw54SBpZ8xrFmoNDB5lI1+HEDfDiKf2vFUzxofmCws6pY2PXAIpdmnqL22JhgWBXD4g1tjkibvVuuqYpwlrIWWlSfxqm4CUEFcrmGMy6mCYLGIH3hCwD9ZlZEmSctr2Js7xqNDobJidX4Sno4eNF6LE1OcRBmfDOaw0oSJp4WoM5uNfBHXfUE1/oRLC8Xy3t1zoUiccLj1bPQr6nccfNsUdXpqldyH1kwmuvlpzK0OI8dfVjn/B11cY13sbB0NcR/zP0fdx+1iL+71BoWK4LD2WHbxFoAcgV7x4GDqIJ6mYCFmddl7z9Mv4xa0Cni5O7AhDRZWAXXXOAHcchkzVFhY5UXZdeYKDNAZqdHTyS8/Vua9P58iSZ0WsbLmUp2JNxcEciXjhaCuj9w3k8WBllTgUD04qvN7gqvSY5WE/vYDWmrRsucXYkQQE9OfSsxUTYa6b0W/YZadf2mcu6OzMvQJgDpsxw== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 276fae16-d0d2-464d-a6a0-08dee7c9b363 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:17:41.7970 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: VTFQiZmYh2bNiq3sY/ZAU7Y4UKJw6pz3u2f1GEx06XHPU4PKo8oCyWCEvvXby9znFbQDROOncmV/gBmjI5SEag== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB2129 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:17:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241610 From: Amaury Couderc Backport patch to fix CVE-2026-58470. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58470 https://www.cve.org/CVERecord?id=CVE-2026-58470 https://security-tracker.debian.org/tracker/CVE-2026-58470 https://ubuntu.com/security/CVE-2026-58470 https://osv.dev/list?q=CVE-2026-58470 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58470.patch | 78 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58470.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58470.patch b/meta/recipes-extended/wget/wget/CVE-2026-58470.patch new file mode 100644 index 0000000000..463292651b --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58470.patch @@ -0,0 +1,78 @@ +From fd316db417a4d368f6f76aecbac047dce7e40699 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:57:54 +0200 +Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58470 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf] + +Signed-off-by: Amaury Couderc +--- + src/http.c | 35 ++++++++++++++++++++++++----------- + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/src/http.c b/src/http.c +index 07af1867..ea2e591b 100644 +--- a/src/http.c ++++ b/src/http.c +@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, + wgint *last_byte_ptr, wgint *entity_length_ptr) + { + wgint num; ++ char *end; + + /* Ancient versions of Netscape proxy server, presumably predating + rfc2068, sent out `Content-Range' without the "bytes" +@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, + } + if (!c_isdigit (*hdr)) + return false; +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); +- if (*hdr != '-' || !c_isdigit (*(hdr + 1))) ++ ++ errno = 0; ++ num = strtol(hdr, &end, 10); ++ if (errno == ERANGE) ++ return false; ++ hdr = end; ++ ++ if (*hdr++ != '-' || !c_isdigit (*hdr)) + return false; + *first_byte_ptr = num; +- ++hdr; +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); +- if (*hdr != '/') ++ ++ errno = 0; ++ num = strtol(hdr, &end, 10); ++ if (errno == ERANGE) ++ return false; ++ hdr = end; ++ ++ if (*hdr++ != '/') + return false; + *last_byte_ptr = num; +- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*')) ++ if (!(c_isdigit (*hdr) || *hdr == '*')) + return false; + if (*last_byte_ptr < *first_byte_ptr) + return false; +- ++hdr; + if (*hdr == '*') + num = -1; + else +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); ++ { ++ errno = 0; ++ num = strtol(hdr, NULL, 10); ++ if (errno == ERANGE) ++ return false; ++ } + *entity_length_ptr = num; + if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1) + return false; diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index a1f34dfb5c..5268ed968f 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -16,6 +16,7 @@ DEPENDS += "autoconf-archive-native pod2man-native" SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ file://CVE-2026-58469.patch \ + file://CVE-2026-58470.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:17:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93122 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D19B4C44533 for ; Wed, 22 Jul 2026 08:18:22 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.68]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43325.1784708301719805309 for ; Wed, 22 Jul 2026 01:18:22 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=xUSad18r; spf=pass (domain: est.tech, ip: 40.107.159.68, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=B8y+tf+q1Th93WkH5aJXFQlNpRMYZHWUlDLqi2hfo9QAGMicVkmAa7KKsxP0uzcGwKXXUY7a40Ytzxsu0MXyn+oJinb8BE52w+oP56eBnzLAbhktI52Ojj+PU6l3tIA/wk7+02YOKQyc95NEvGLjVYCSGSREP6/kKn3N3HEsqN2KlKdKpbxAMg4Yvfnvxso86Gbg77GWU8xnZXJdlrhL4ZWzgOsKlp756AcPxk0Rn8BPpa7w0/iI2koH6DhDtNSOmnk0tptXYnEbNSAQK4gkNf9JgsAGf7p28kRDjphNIthAZ/sZRjXr/W4QL+6Xfzj3zj1gg4C8w6l7gD4T3GfZAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WlKzYR2ynq6vryFi0XcXA1JaHYU/FGcyfj5jjW414eE=; b=V1eKFAnlacoVUFBNjHXLC/V+iFRDY9lCRZRhJmDfa9cvfKX0Z5RFQRLq3Sh7fg1xMxeQalzy3ZjN5416Jmsw09Y6XV5/GRtcyF2QrYwbCH2ojROs6IRa2QOlLQxz3YIoi3De/v5mCiLxyYxHdhspA9YRTcwQEh6faAj7S6GeQ91rvU2vHqqejM0CCoOeOufrhuiz+0DHqBJ1CELDSztbEa85ZUk0U6I1iITSD6yQcaRs36bRfDk4fUhcNp5lZP9W8jkdCJEkHeAXs/znIBayiyDHVO5EHmflY6EqMpdPpfs3yLiE7TGmANOqDh4e4deh21ZBBEv1VSLMit5pSoyDhA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WlKzYR2ynq6vryFi0XcXA1JaHYU/FGcyfj5jjW414eE=; b=xUSad18r6xGIlMxCDFkJK5dcJsGF2f+HK4d/35xMBUjpl/zjBEys7M0nYokm7WTRvsaz5gnjDVryw3tAhHAJNhkcV/FKNYlAHkJZlG6XG/NP5JzMV0PkeaxoapdzYNKjfpaoys77ap8DTZzS3gG9ynkVVfpDgCFE94yLCGcszxVHS1qZwzmAnbPyh++laqdMhb6fGGNf/hzP8n6QZ3d6LcOd5HEHETZwDGbUWyQh4QmwOQAAUbzqRE4TG3rAPFVC8d99pIMXRyGtZAM0xvLI79ZTQWEiNaHuxBJ3H8ywbBzsoiggyhf5zRbGfRIB3ehqLG1/HeSn4AtcOo6aIsU6Pw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV4P189MB3630.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:18:15 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:18:15 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH 3/5] wget: fix CVE-2026-58471 Date: Wed, 22 Jul 2026 10:17:56 +0200 Message-ID: <20260722081807.14885-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZP191CA0023.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:4f9::13) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV4P189MB3630:EE_ X-MS-Office365-Filtering-Correlation-Id: b86cd7a7-2f8a-48f5-6d22-08dee7c9c7a7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|11063799006|10067099003|56012099006|18002099003|3023799007; X-Microsoft-Antispam-Message-Info: icCBOqcMXjrTM1Ta3VB2qPT9O5jklMQOS12GFZo+Ey4/MYS1FGagv9jEAehrZvU49gNUmh1tS2DjPMn1LN9fLRx2zryShjI6KBY66Rgt7sfcSYCttvnK7m0drD21cWN0RbSmNK5uCTQ/nZWcx7rYLsr7PSsnf27YVuUa4sNRGCSEPdIA5946wBXPn/1Ta4I0uBTmKBiSl9v9Ym6daQ1CTRX7YeTFsMWY9RjTUPzxaVgYNKVMqBFvgU5HAc17/ZpQeniIAkpuAIlsGVNJPUshuym2UFJloMHqP7QrsWd6kDBOGbHfTThGfGvSq39dKLuwr/iU9QBifE5bGGOJ4sLBR8q+3oE7CFCWkqZp0nELUqm9Zwlp0v4PcvS4V2An4Awj+nU+7Sf4C2XrdI53wy5RZEj5iJ//7/50q+WNXQvF3oAjAr7Ij9xhqkb/KNgv24SYlXgpxnJPfyVVoy9hy9SBE8Sv3GQii5WwU+6s6IvxvD4oWmWTmgX/v4SKFr2HgqbnSao7FO/aausvHHK0JzyboFt2FXM+L5CJ5qP3VyyZTNnUDach2H7qLMoP8zzr2S8xsOW+eviN6ykR6PwjoTDgfFr2aAWBs0WNUOh4f8HyRk8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(11063799006)(10067099003)(56012099006)(18002099003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: pw/ZPpa3GxfQHyG1QpSz7qUgj2rMSkca2KuViYoXAa/zljbSjnMa3prGaVUOLQy8gZ/MoxGNwYNN46xHE64yp2prw7P0kvH3UPbayWe96JaxQTTcjQMioxClfJvRd57Ay68A3nlbmwqxaY5TtzmzNq8gFqMIAoGIh+wRVZ474pqA21qDnl/b8sqG1Ez0r7OlHeaU6BPisgnZEkl1mWHenJDBcgs2OVXmc/ZkpRKHQCug5zjDR29dxvY2IqAvD74g0p9MCp497DthseOvJyg3fOlOcR9Rhrfu7Va9uGh1eMv7KKsvLZJygaayWx0lQ9+KE+3nblxjKzWQds5gtJdHTLx0MOEEgGVo998nV84I9GSJ69KONacUjDFDLvOcVFyykHUTqCFqeCpcccTRU7OUS8EglbrALNG3lvI6vIOfQzI2onV/XJK1w+mjyt45WiFjX/GMOqaKge5emzIwePJxIBLUyV8ksFaoP1j/y3ozXgnVacm9BSi7oJx0WgpPT7Cy2uq6Z4cqQv0skIxB9Q6IqB5BwiLRiT24zCtRz/5PRjwG4J8/byI8yhZPNjE38ntjPH92shqVY8BhOgOKma7Bx9sHPKQX6lTjVTj41U4akLpDhSDcHxoJk10imq/llErg/xFYUZXZfr1GPMbxcmw8U5prcIXg589w58nMcuOKFczz05eIlxOE7So0xKjqhzwJcx4T3vIEfM7hk9i732S8vr3YhEBl1/VYHhSwNoaVxjRzZnGXmedIsIoz0YxtdKVFHyOYXUm5R2DLZNEuwiZpPLxDxah7P+G5ejhB1bkJJrAltTuG8NrqOvMxk/4uBVaCn1lUWv/xZ8tBSWpWYaJe6CW6e1Xi0jRxB4YFsHl19zc8reMczx/WxkSjU7eNhwmztLBXNcWvwQuK90haGV8DRim0mJAM9wmqtzOsrBpe+cMy9wbVpO0Dz2U7JJ5Y2hbk/I8UJAgrrLOTZb6QetYZaNTR8bSSoFDcfrGZaLmQlRsGozmKJ3n8CftiDRFTaaZcHmwvxYGMNAR/hsoQPwsZdUPT76+mDgU67VPcvmY9g9stnVfzqlEtpl3MqaVYBcWaQ3kaNjydQ8vEg38WGLbNAl1SF1ymF7XpRlQo+pwQZnmxpBesn+dxlTuLvsjI6Fh4XGNHR8atzH3dPEou/SmZkFmcCJfipjYQtp3+JFGYItXmqag0HhdBxcGCBp5hvjbJAl62fZThZKcpKy40DJtlAwpqJyL0tKL0JqL2JDqcdfpYFC76MWujKTCQPrB9lac5VN3dTWIY5eNjREVSjmIa2h/gP7h743le4n8EZIHQ+BZLkAAz7vd0ZOER6F51lhwvenOZ/+1QtXjpMlbO1Me6KjmBNkoRAIwsqYEZ1DgQLp6PfaD7OPZmFKQKDHUKbC6TeysHc4AUjGDSzWtmetBH8gmjKcuAP1Lhv97h9ewMe2TMC32epk63i/o4yllJBmj+J4kChr8ECcPLRsxVDxpMxUhZn9kW96mv0xpfXL0kFCdCkc4xh4lzlI74yLDS8I/Qs8tOFQgLlFIbqTq7bHWfu8aymToJvfAPpz+mXgfuk3NT2RvLvxDn5PvMObbESAwqAhQbSX/2rwQrjyw/atgoQQj06oPvJ0Ttj2MxjSmUNHf+h1uBiwUBsRDk0F38P6Ue/hlrIz+328VbXDBFnfD8YM2XEwptInU2E/jqxKrQQcQLZJNbIl9E+ZJ7D6z/PhCwKM8/ESl6z73KiMENWJ9cDg== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: b86cd7a7-2f8a-48f5-6d22-08dee7c9c7a7 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:18:15.7959 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dUNvGzlf/ozf1sWqMjKyy3EUC5KPSL1QT62ySccnGO7AESilJarIw/QEHhd+ZYkNHN+jDSpwRBcYFTWX2vGAUA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3630 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:18:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241611 From: Amaury Couderc Backport patch to fix CVE-2026-58471. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58471 https://www.cve.org/CVERecord?id=CVE-2026-58471 https://security-tracker.debian.org/tracker/CVE-2026-58471 https://osv.dev/list?q=CVE-2026-58471 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58471.patch | 70 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 71 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58471.patch b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch new file mode 100644 index 0000000000..a69dd5ca81 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch @@ -0,0 +1,70 @@ +From 532945675f0d67677cefb04ac4293005ede61379 Mon Sep 17 00:00:00 2001 +From: Arkadi Vainbrand +Date: Tue, 13 Jan 2026 12:22:04 +0200 +Subject: [PATCH] Fix buffer size handling in filename conversion + +* src/url.c (convert_fname): Fix buffer overflow. + +Copyright-paperwork-exempt: Yes +Signed-off-by: Arkadi Vainbrand + +CVE: CVE-2026-58471 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee] + +Signed-off-by: Amaury Couderc +--- + src/url.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/url.c b/src/url.c +index 2f27c48a..7e7a3cea 100644 +--- a/src/url.c ++++ b/src/url.c +@@ -1603,7 +1603,7 @@ convert_fname (char *fname) + const char *from_encoding = opt.encoding_remote; + const char *to_encoding = opt.locale; + iconv_t cd; +- size_t len, done, inlen, outlen; ++ size_t len, inlen, outlen; + char *s; + const char *orig_fname; + +@@ -1625,7 +1625,6 @@ convert_fname (char *fname) + inlen = strlen (fname); + len = outlen = inlen * 2; + converted_fname = s = xmalloc (outlen + 1); +- done = 0; + + for (;;) + { +@@ -1633,7 +1632,7 @@ convert_fname (char *fname) + if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0 + && iconv (cd, NULL, NULL, &s, &outlen) == 0) + { +- *(converted_fname + len - outlen - done) = '\0'; ++ *s = '\0'; + iconv_close (cd); + DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n", + orig_fname, from_encoding, converted_fname, to_encoding)); +@@ -1656,10 +1655,17 @@ convert_fname (char *fname) + } + else if (errno == E2BIG) /* Output buffer full */ + { +- done = len; +- len = outlen = done + inlen * 2; +- converted_fname = xrealloc (converted_fname, outlen + 1); +- s = converted_fname + done; ++ size_t used = s - converted_fname; ++ size_t newlen = used + inlen * 2 + 1; ++ ++ /* Ensure we actually grow the buffer */ ++ if (newlen <= len) ++ newlen = len * 2; ++ ++ converted_fname = xrealloc (converted_fname, newlen + 1); ++ len = newlen; ++ s = converted_fname + used; ++ outlen = len - used; + } + else /* Weird, we got an unspecified error */ + { diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index 5268ed968f..8d9b983de5 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -17,6 +17,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ + file://CVE-2026-58471.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:18:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93123 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D24C3C44533 for ; Wed, 22 Jul 2026 08:18:52 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.3]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43201.1784708329862118673 for ; Wed, 22 Jul 2026 01:18:50 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=hTH+DLao; spf=pass (domain: est.tech, ip: 52.101.66.3, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=S6jn2r0fa0m44xRX8Pnr2gLw8qbvmAbV4EyTQg7EKPSFiZtuelFHfFd/7loQlDFD7haByHr8BiFkQATtLAKG1pUvoeNpgoqiH1PKhpW5uwEuiSRoI4T1vGPu/9QYX8z+q//FFrzqz8jCXNW8d4FwMlY3Nr4jbdJXh5a4F/tyw7QQ4W+MIi9eC1uyU6PxKTyHNxhTIM2SB+xgTo9sw+o++8LQodRjihjwaA/WO81YfEPnOj2laiogGyV0AnosbwpuOPo4x4kM3U+JzK/Wk14dt0mSIrZRCjoQfDL7yj3oJysOJXwTvMRga+FboHnyuOll+PHt6pobWFH8rYbLP5/yLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Brll+F2/WPQXZ3VADSjAQm9V3ipbBWUMekgL9E8qrcQ=; b=Xj+aBo+3M2H6FtXLgAXkOwcsXhxqM+heUMNnbBXTS7h+9iAlNEMOGDj2KyiSwlOUl1gH7KehNJ7dgV4WDhbbMlaMD3J3F6qiT+hy1jQ1q+AvonmblnmNnDflu5uZKYAcKWmkPl7JlhmCQJKPDX2cDdJDdGcW07tKBWAB2icbRaT4N7vQPXSgNyfBFvvI6K2zaJcTkwiviitr7xyoao+RHe9Nx8ZJDposLSKrNpttglQRNXS4k+StoN+gOgKzLWUZppt7XXy3sOqMeGSqaLnTIE5szFii6+gExYMoBuqNhugBqHBqVUXLDnfzgLWz7TlLlQfOk5h2qsTsuVCJZW7uzg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Brll+F2/WPQXZ3VADSjAQm9V3ipbBWUMekgL9E8qrcQ=; b=hTH+DLaoWujpCkwfZ4JWaPrDlX56Yo3yH+hDo5QZAgJnjiOTYrtQNK/E/R08E0/gZ3Cmad+QPsGoz7hPQAkmaJQnjqfBw50TxwLPwcddZe62Dq4ExK1OQ7kUIsZGOA4zGZTtRfrb3BlTWP0rIlMxJbeOfgokVnkBRq0dqFi/letTXnHeBtwq5eGH78qjMG+2TyGUnp+IDmOLBUczIE34iTwAF2roaSjsElZ1mJctOAUtvPcPx+VV2pCKzNJ8v9opoSl1IpSGKBVryL0Vp68RIf/vHtC59VHirTUkRWZTCIf2Jnt+165Za58yHhhAWRHI+WxchPogn5brP0iJpSmEXg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by PA1P189MB3492.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4f9::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:18:45 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:18:45 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH 4/5] wget: fix CVE-2026-58472 Date: Wed, 22 Jul 2026 10:18:27 +0200 Message-ID: <20260722081840.14924-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZPR01CA0089.eurprd01.prod.exchangelabs.com (2603:10a6:10:46a::12) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|PA1P189MB3492:EE_ X-MS-Office365-Filtering-Correlation-Id: 4e8da420-3fa4-4d72-97c4-08dee7c9d96a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|11063799006|56012099006|10067099003|13003099007|18002099003; X-Microsoft-Antispam-Message-Info: Yzi2wz6PxhpRva2CpfEB7uFQZ9oL2FaYF0oKD0eI5Ju8LYSXftepvL6z9hGuoHpmv6cnci1VMY3me84V/IS4g7tlKqxOyr38qgjLuG+1DaXxWlu/QoR5Mvp8AOs5MzfoL9Fv17uWqz4zsqrptIjoVlRd7E1t7Y+Vi5zaO0Ru3aqK4T3M9vSi9JeG+43R1xqUY0oDu9j6E/CpKdR2vluMXSoLHrsLLD70W4j8Forqx+lGYN0iILm9s4s8ctfOWcvwP/nnEYecSHGafF0f7AJ09kHrebkiYIeWei8yA7V0hK3Oszrb9dPuPlPmZjwC+2AxY566MUJIlvUXYDKkTU8QnGTXocjME/0U09hppeFidyUr952kk+QIEkVFy6oj+GUO2eu6kvSY9FHQfzamfL/MDfDBBY4dIaLnqOjgN4xfK3Bl/4NOBeCzYpZmYxnCi05jwvUWjjDF6bq0rYuXEhwSWXTgq/Q8pSTmVAuGAri2giPc0IGZN5CY89dECNgoAKNLpkNmvNWsLvSPHPDsRFK6+0c4pB6ZpY2qDuGBPTMIa5w0D/6RH1psus9iDcJYGOZLximBqR+fysqO1W067UW1cfpG3tbLSZP2/rwT73YO16I= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(11063799006)(56012099006)(10067099003)(13003099007)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: h8bk/TFpuvU4XoZDqjk397NRYZZZ9r256Qio4p503+pI7QpM2M/Xd0OP/nubBmAze6wR5NkJ58P4OLeNu1F0aGTki4zcSWqa/3yxAf/8OP5aHA7MV6IBGib/SdKaFTku4evJqxTtjWt7GZYfy7TtoS9QGJaA3aNOwA3AvfywAc07GUBx4IVrUJicEATQ09NW/PwpEtvgwubwbt6/eAbhBa0eYVREQUMYgE71i8J6oPQMjX5TmyBSXRATIrXwR/fb4J0igymFB3z6L6QoP9sq/MkVKgQeL4Yiz6+/OsNb0XnnY+UxkH8eAdjBgoXJyjLigSmCxcZSnhzqFRQF2cHv9aJd1UCWugW3RicqHvCMRaAkyosXKZg9LyjMVs9b3d55m9/qaW0isFIMl8uDe5AzmmXsftfX7xRQUhH8HpV8FxZaBtw2FDY3q+XKOmvhMaV2u8/zjc6OAkZC9GmZ7vOmVoZ6OE6k4dV63jsT1LgvrGE4UtCSvoWP19alabmIFGb4C/xSamvsApynURNUan4dvDplw0dvlVRQIEsLFkNaD9b9apLgKzHvajEY1bDgmr/yR0yeXQ+c6E3s8uWzUTxqzJkfJJ5fONpgr7WDPjcCZjO/trEsuOIxxPRBIvRkuwHfxp+89GouFE4B02Hz1nC4q/xgLtPDF8oKtIcD/X6BqJgOjIjamwpNL6UXi+vdT8KqWau+mjNCgTnpL79d67Yeu1hcGoueWmkttsny1LeT+KeDEKU+SBMdUrWVZLu8APdBJdcPiwY1fMz7sqeSsUFummVXhobVL+C6HnRmLPU+/jgq5qXYrTMnfyOgzhoWvijK82v08HtE3xzbXX1hjA0riW00cuK/hzb61mAkZiqcshZDxDoOJhxRQ3ckbeHPtJ/S/gnfAiUDrw7ZGiJRXHjhHQUbE+cWtH9UXQp5gJENJnWPyqa6kSokKLvuJinK4/hkckcA1A1hjgmhAe8AiONooMpgCK99Tjv+m+G4pHYSbNNh9JwiAOGN+qMJ6mTDOA3kYSGvQYWM8gQppalsIpEmrlqaqZUxn3XSc+FflfiklKX8076kzJTBOXsthDoP2JM5wjA+6rAjvJ5Jitz9yB+lEdiqEZ+FIYfLy6LzWzAh3aodybB/0qfRz2p/Xr1FurWObt3bG3yWa0/xCAoicja1BhMehaJEkEgvlS6Gr4ukECvwrUpStVU3zy12AQstLePUCqxfQ23VHLhJI7Hk1KqYDddoK261krk1XrFaDaflolH758VdgW1UDJYDY44Zu1CZNyATbxB2f4N1q7qZObi2sRVEhmcSNrObxzwnmWIYJlsmA8/oG6oMDBxBYVEHDs/om71BMv7SXZxpBQ8xkiDf+Zo7lDB3GdGAXmk1R4H8pOgoqBe9SHeRffTk90o4etQoburBwbFJZNkbox9sCjthX9SJg4w1KJBG/goIqZVwYnCcsbd6OOwq0PEcJXYQKt/EsRXbjEkgzmH2zJbE8vSYhp3IHd4/zbJ+ZVnitnIqbrlknQUhjGlOK11Uas/dLVLajGY4GJsNglvhKz0Et8ev+8Dn7MaI0i6hq1uAKwwfZdyB4PW4i2z++haHBBMdEDxPV0PxrkZaVFdLoOl3ii4UONbZgt8J/IIxAx1UzP4vcsWF0KxscH3o27BCphVt+OaeBdnz48h3pVu8edTtsQNRd/OB3XSb/sjPACnMuq3pGsFbCuuT1WvqdY7rfPZk6aCdVCETsvJtw/imwU32W3AUUg== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 4e8da420-3fa4-4d72-97c4-08dee7c9d96a X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:18:45.5916 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /Wmle37w1rd57G4rtge4AorHnPDP1ABkj/qXTf6vi6eGjEzPzFD7t3wecC3VL0WPKbRtN5Qr5Q3l0sr79CUIHQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB3492 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:18:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241612 From: Amaury Couderc Backport patch to fix CVE-2026-58472. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58472 https://www.cve.org/CVERecord?id=CVE-2026-58472 https://security-tracker.debian.org/tracker/CVE-2026-58472 https://ubuntu.com/security/CVE-2026-58472 https://osv.dev/list?q=CVE-2026-58472 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58472.patch | 73 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch new file mode 100644 index 0000000000..3499f298a9 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch @@ -0,0 +1,73 @@ +From e4b70d86b2347f03bbe17ae258c68a77cdf6ee52 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 19:13:15 +0200 +Subject: [PATCH] * src/convert.c (html_quote_string): Fix integer+buffer + overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58472 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812] + +Signed-off-by: Amaury Couderc +--- + src/convert.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index 2e5bc22b..d1cbab88 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -36,6 +36,7 @@ as that of the covered work. */ + #include + #include + #include ++#include + #include "convert.h" + #include "url.h" + #include "recur.h" +@@ -1178,21 +1179,37 @@ html_quote_string (const char *s) + { + const char *b = s; + char *p, *res; +- int i; ++ size_t i; ++ int ok; + + /* Pass through the string, and count the new size. */ +- for (i = 0; *s; s++, i++) ++ for (i = 0; *s; s++) + { + if (*s == '&') +- i += 4; /* `amp;' */ ++ ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- i += 3; /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- i += 5; /* `quot;' */ ++ ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ + else if (*s == ' ') +- i += 4; /* #32; */ ++ ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ else ++ ok = INT_ADD_OK (i, 1, &i); ++ ++ if (!ok) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } + } +- res = xmalloc (i + 1); ++ ++ if (!INT_ADD_OK (i, 1, &i)) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } ++ ++ res = xmalloc (i); + s = b; + for (p = res; *s; s++) + { diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index 8d9b983de5..b773081753 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -18,6 +18,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ + file://CVE-2026-58472.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:18:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93124 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7AADC44539 for ; Wed, 22 Jul 2026 08:19:32 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.64]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43330.1784708355035351193 for ; Wed, 22 Jul 2026 01:19:15 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=O6+lvEtd; spf=pass (domain: est.tech, ip: 52.101.65.64, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lgAhvyGt90S52B0S24bCFO3VfPpR+9RDKuQekog1Om79OianS+opXNqVqDOoYP3HL4UhiG8o4Eikyf3y0F114yTZSMSQ5dvryb5r3MZL1/SDdTqVRbM6rgqghUK31VFsNYipIHIPmtdkqJJJoQ4OrwLQmY+iJQxqGcmo1t6tHiZQ9R+L24ghcbwM45lClRNBtX5P8jqTsHdQjbU58haeCo3zDDAzP8e4lykoT68l4iNiW8bQ4MqqjW6LOs46hw5brMjeWnBo2q7QQA06QJkx0fdXAYQo40nv7GNBQFiRhqfIFHzwoe0+q9CKHhQ+r5PxJVIcWC19yuwSrjgW8FohHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=b18ZUBPBSsHbl8TnU+E5HYcWuwIu+iBdmKHx/GpWz3s=; b=Buiu9N3jpeTsTWOqP9C7EkQoBwGD0O77sNplbZHTExMYC27xc97oM+E3xWRg0sCScuPtxaDI9Hh+wgeZ5Qi6vJmSKFZ087O2xIRAKMThlSL7jYypKDDfPAXVDHbqPxvUAQQzWQonWpcBY8iCrE4XUII2ZlFN9T05pi3UzsSVR0UFRzspExfKreRfNkzaDHijtT1rOkl6G2tNIs/PybhLat76rC6qS3oizvaKX0gvVf4I37sVBwnSsXqkZYXCbllZsn0OJ4/Aavg39ZFvMPlYg9Zgltqyb8DX4WwUWp6I5fJr9J+QFruQF2mdh9QG+LGj5+W/dRItiSCf8A7VcjIf8g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=b18ZUBPBSsHbl8TnU+E5HYcWuwIu+iBdmKHx/GpWz3s=; b=O6+lvEtdawjlvfIODyu3NXYKX8V+GK04rJAQoshaO6PqvB9ZEuWBYYWXug8v02gqWgIxu7iUuI+3UANGqtnpyAZVjVirB7UtQxs2s+qbjM+n3x0b5Hupe5RIyfHrdM75tDV2TnOLLv+Acc0PFD7HaP+5ZxL5gTFY5zvYJHa8x23pT9uMBl7t4VR7fKVAuEylgbrO5/XhxT+CsoKFetUYeFNinAvBgq7QwJTaYpKX4nd+rIHEBIigbbdVP6r4V9t7mMEGthvYPqINHGbfRNDkVsrpFs967ktlu5U0NL4fAEUSufG88kHz7qvNsGgxLMYTduVePv9U1KLibxoHpc4XOg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by PA1P189MB3492.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4f9::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:19:11 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:19:11 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH 5/5] wget: fix CVE-2026-15146 Date: Wed, 22 Jul 2026 10:18:56 +0200 Message-ID: <20260722081906.14967-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU2PR04CA0255.eurprd04.prod.outlook.com (2603:10a6:10:28e::20) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|PA1P189MB3492:EE_ X-MS-Office365-Filtering-Correlation-Id: 66744e83-0a41-41c5-d0f0-08dee7c9e8db X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|11063799006|56012099006|10067099003|13003099007|18002099003; X-Microsoft-Antispam-Message-Info: 4fiyrvCXASXPbANWUFEOO8jZBwvs/6Mjxsotb4aA5sOUpyKBz6xUa5GmyGAfrqBefVV87bPldIjw6d7D0XWlsezspFeAYEp+1Kol9oxfE3ElgVhQBNakLhtUUFPnYrNvbkd0iukcQaaw9LFnSO5sgJCfmQrbOMQtgbvz+cogNkXnElJ/AMEJrxHEAUhiY/jhetwKYxBbOADojczdOeWohBik6qzq9UOZOqfdJjE10qX+cxhsj4925S45S0VaNTYEO9F19xTO/E3w/esYOQk8aDzHJc1vkZW/vdha89FSoWhQBsXeseq/wD320vBgY0p3gbedE40qeB6TXAjG+pX+ckZJvcPDrmdUABdxE5QMSZZ/muvMN3aaf2l5f+p6xdPdjFTLB/DUIYHRJW+/gp/fijVHBZl6EChJabTEXfkeS5IzYQ9Crs0vI316ilrAGdpx4hJ++LVcw6TwMSoi7lV07+s4tssGC4swDL1ERkMp8c2h1O7jMTN+d0oQP6aACZTI0pl259j1OnzTOroiUyqByL42k672XdsE+Do24XPcxYsBHT6HHIH2ubE/ZPLicF6XFaibZdRpJjdacZ4vC9e9ksuoe5EEaWpyqI9zQgSe/dXJSgf3BuN8mHDXn4GkiMsTYQVbYPpxmDNxnAdPNfAsFO5jgXkjJGaPNO4d9jm4UGU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(11063799006)(56012099006)(10067099003)(13003099007)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 4Brusup2uxgvmuyADoVgRTFu/1sfysz9ocSwGQeZFPPcJOYJ3/aXYnN45xldzxiTjgO8J50Rg7nHI8+PJMpQII4p85IwqOCO1hlShcHD1oopnN2OAaMoWub/wXu10X7UHAjXPgdMlMW5R4IOObJt1ZO/7C+4/I79w0+WVvi+37qRqSEyNTYbVWMqkhVYifSqt7SMTK82OY2W4VoOWc2Laxig7SeOCZCHv5YMtTcGdVqvCSKgiaCtB52MZk3MH1oBKXJ65sZIzsHIS5Yw4mBcJyD2r6HGEfPMKD1X6No6IMWXrxkgzs8BFcR41ca0rw3ugVhVweLLeQi9Xr2yf9hB/0do7mOEGz8gFdh7Dvd/jr4LSj16SUOuo+AxOtuhZ72BcrpgbsnFfJLsFnBeVswJUrm1MUCXfdF5RP4SoEICDsowUPpWUfSw0Fc5GlRZCwDZmy6WHh2dCUkAtkpgiI+0GuSwxwxKACC8QToz1MBT6+fhs2gMVKpFJOUIXFDlhv+CrbGU7E0AfQG2x2u6uJ2dUVqIpcMod4XtBxUbXCiW+K83xsGX266zigckZYi138BQ7czos9Vqa9cCXAecNbhXKhy/edXKIaLqWJAXYyMk1GsXbWIrfsgtn3RUssWduEwhJs1ZDKRPpnjZ+OQf+K/qRkWmR4qQrBWUvns2LiA0zQEgfAfBe039/rq9RVPpAGUG4W3adlwiUyYbJ0w4uH0g9vz7dTQHhEJy/u1uOdsFKm7PHDTJbDBpGAtUKc0U+SMslmscypKxYEvrs//8fMZrlsgPzJtd66+Rv7QjiBH9ftGqRctQB3ev2mka0tSX0zktQ0Z0pCKeKDobGjkKW4bYrVO1kZKoa7d6DD0HxwfDllKszeVZPco490TRUAAZpX4W/mvTIHljO4V2hK0w6ka0m6ptZlkXGmxmKZJOdwMQHw9CG+pisWpTW5H1K8h+ZsfB8AHw9kujYsHfl1OdL7QtKJ3uw9z2DDxjNC+0gIPCSQ8WgfYE69gY/eBmz9T3SmbnbO1TlW4vvRIhU6NRIyfbKbUFYdB2cyQu2Y/B6G1FTeZmkFP01eVknsV0ic1FlsslVrbA2YfbtiZyZ6EO8ML/SS3YxpMJVXIT/c/0ckq84e/RAdSqaNJtJVken86GdKZyNA8KMrFVSujjMleXGkKaS+UNudCJReyBs1m/KgGFhbLUOV/SfPSqDNXF+8hx89j4HGaHjunIbkUKOEaER1Yx07X6fW4hsGCwv05EymXHK1OSH0itQop4VeOGcIRTlm4bh3Z/lsgKaB6aVnSFMTrDj2HOoR4P221uePbzZlaX5WA8kouPIFJsQkFKscT0K2qZR89WD6FfRln8/oClmPBNU6Ckz9r72V9GZO/uHvfpu2L6sJ7UraEsHRarjMbl1Z1Sd0Rw0qU3et4M1KKc2T/rIlmiOG8qhnbb4wWnG3sM6ujfg5ZUg4rociGxE2bTJNiaI2NOZts5bnCqO7SqqmK9prjUmR5m1fMkoaZ4IMZ8wYEhkvi3ua9L4WmSWCDMARNZKMhesoctx/NBTe4UCfiAYtb5JMdeMgu0oLp/h53jVg2I3tGGoDbLnRT9GpOsdimtAICohaYKlQohT76Y933vKnDlrh/EQcugUiZuC11XqVCW7eHHw1Y3p5yACrz3OHUCngvNDSXgwfb84pdVa7VfQCkVYwutO7srNFZCdLtZ0C822uYoz4v9CqAo/VExlExiVZ7K6rvRuTDa9vRms/4C+w== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 66744e83-0a41-41c5-d0f0-08dee7c9e8db X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:19:11.5058 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: s99OuEv4L1b/jKjttnoW5aXUL706L7kZiBQgvMYGU+h9OBj0raOXU2rsHf05M2Q6WyMp9Ev81l9XSoWwTabR7A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB3492 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:19:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241613 From: Amaury Couderc Backport patch to fix CVE-2026-15146. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15146 https://www.cve.org/CVERecord?id=CVE-2026-15146 https://security-tracker.debian.org/tracker/CVE-2026-15146 https://ubuntu.com/security/CVE-2026-15146 Upstream fix: https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-15146.patch | 122 ++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 123 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-15146.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-15146.patch b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch new file mode 100644 index 0000000000..a48b230cf3 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch @@ -0,0 +1,122 @@ +From 17e1d62264c07da2fd748f0714043b856d0925d8 Mon Sep 17 00:00:00 2001 +From: Acts1631 +Date: Sun, 5 Jul 2026 17:22:55 -0400 +Subject: [PATCH] ftp: validate PASV/LPSV response address against control + connection peer + +* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised + address, + (ftp_lpsv): Likewise. + +ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in +the server's 227 response without checking that it matched the peer +of the control connection. A malicious or compromised FTP server +could therefore direct wget's data connection to an arbitrary host and +port of its choosing (e.g. an internal service unreachable from the +attacker directly), which is a server-side request forgery. + +ftp_epsv() was already safe since it only extracts a port and reuses +the pre-filled control-connection address. + +Fix ftp_pasv() and ftp_lpsv() the same way: capture the control +connection's peer address via socket_ip_address() before parsing the +response, and reject the response (FTPINVPASV) if the parsed address +does not match. + +Verified with a fake FTP server that returns a PASV response pointing +at a different loopback address (127.0.0.2 instead of the real peer +127.0.0.1): before the fix wget connects to the spoofed address, after +the fix it rejects the response with "Cannot parse PASV response." +Legitimate transfers using a correctly-addressed PASV response +continue to work. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-15146 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b] + +Signed-off-by: Amaury Couderc +--- + src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/src/ftp-basic.c b/src/ftp-basic.c +index 8f7d19c1..9c7bba1c 100644 +--- a/src/ftp-basic.c ++++ b/src/ftp-basic.c +@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port) + int nwritten, i; + uerr_t err; + unsigned char tmp[6]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the PASV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port) + memcpy (IP_INADDR_DATA (addr), tmp, 4); + *port = ((tmp[4] << 8) & 0xff00) + tmp[5]; + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != AF_INET ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ return FTPINVPASV; ++ } ++ + return FTPOK; + } + +@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + uerr_t err; + unsigned char tmp[16]; + unsigned char tmpprt[2]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the LPSV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + DEBUGP (("*port is: %d\n", *port)); + } + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != addr->family ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), ++ af == 4 ? 4 : 16) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ xfree (respline); ++ return FTPINVPASV; ++ } ++ + xfree (respline); + return FTPOK; + } diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index b773081753..2b00aaefff 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -19,6 +19,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ file://CVE-2026-58472.patch \ + file://CVE-2026-15146.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"