From patchwork Wed Jul 22 08:20:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93125 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF914C4452D for ; Wed, 22 Jul 2026 08:20:42 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.8]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43221.1784708437756185239 for ; Wed, 22 Jul 2026 01:20:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=omZGxDtZ; spf=pass (domain: est.tech, ip: 52.101.65.8, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AXzymqW2yrc8QQnkvhQMjlzh4HV2gHy1nxo7CH7pKmOgE9cTPr/rEPiiD3Rn1Sxn8P1mQEX9b7xgsr0G9pLMXCvxwS2Mj3sfT8VQrJkRghCeGyQnbuvukX8YwuAPLz0pWFg4D+jcKk1aFPGC9rzW8XsXekTjU9mGktO+UQFF8XWVWnhdkwNJuDaV/rc2KpZ4AXQ00qwXmMuZHqPIMxHMG3dFV6YKuqIxCKx0lwgFbb31o+beGKYUatYxQUdKknkrOiRok5zt3Wj9VMACcabKj0ENsmAmF5xgZVZQ0Ta9BkqSF081apl7cDcqrf8tHyONTgvLlnK0SgATxB1oTfELZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fWX9Ebjzl2/geou2kL+4vREcai+774h1I7GF7fx/tA4=; b=q/AJFeFnJvr6QaIi/U8qjiTbOiItO9UeEpMd4qsV8/iPTBnupXcabk/NrDvXAoiDzXv0TO8lI2vkS7v2qQC1G2K7KobOhdHForc6E68NcPFuWzSxWfq8WfVmMmfQXVW+UIo+YGBmwYkItrd6LQgn9JLFWaQwKdwUIP3KBFZWSBOgFl1DaxzF7U51ZIejbf5FPWR66abNP8VLJ9lsnYxYo65sx24pOcXOE+09FO5aVFC3/U9eHwaudVuAYy3iqDY7Fsq0mXEL03bGSy08CdV9ufxynoa1iXSAU13Wl0yXB3duHZ8qojRll6OkfqMys4s0yGYrIMCx867bz0VA3HGLJA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fWX9Ebjzl2/geou2kL+4vREcai+774h1I7GF7fx/tA4=; b=omZGxDtZt/d0mIzz5185ZbTn4SMMGjdnF+onDnYxZ7n+mcjpa1aXA0vJqE+pJog9qna155d31+1Xmlzvkj4g8ka4+rkhqqqk5JB3FAo3Kgo6bQUX+bncpEFpsGi3Th8yPujvrTaAerk1noEMcFXPEfD1LwxKdoqu0r954pHioP1AYZV64oPXf97xOiK/EEO21wLXcyXqc50IS/lhBxS481r4aAoCj45q7Klzk9QbY5Hry0NK0uvxtEEwKSYFeFuXYB8rXJ3S8lnnlrP+7ZbhmUFvcDJoVJv3MMIkJa0pdJSyLDYOnkTKxSdk+eD0W0xQ1Kh27pcrdFey9cNUaHbuyQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by PA1P189MB3492.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4f9::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:20:35 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:20:35 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 1/5] wget: fix CVE-2026-58469 Date: Wed, 22 Jul 2026 10:20:14 +0200 Message-ID: <20260722082024.15137-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZPR01CA0292.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b7::14) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|PA1P189MB3492:EE_ X-MS-Office365-Filtering-Correlation-Id: df9cff61-3140-45e9-7638-08dee7ca1a9a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|11063799006|56012099006|10067099003|13003099007|18002099003; X-Microsoft-Antispam-Message-Info: FDhTCyMxfo+3Q/2QHk+YhTP8CUxR5ysr477jzkWasoyIZX5UIzLQRuy73GbpH1ZbdC87DI/eTBcKazOsj5OYxwCss8dkZZsB4Gi8uA45fzadw2Gqm2EZxcZCn1GKquYxST2Hqqu13WEtwcmgY6bxneIJcWFJNUKLuMbtgjBEA+dlabwKqg3IwMTW40zz4gzbU1bXgIgt7EtBAm6xQv64dGWqdqGOwUTzYt6CkCXm3oqHsr99akuyUHFqgCr4gf9tEQB5th5lX3XRG7AYveVXFxIU6aWjn7FhpgE0twCQ3UBEgoqnKSm7j/Git23wDAwAO2dCnQkJmx8ebFWqY5yhxHDCrNjNgoWfQYCsYIThYEEvWn1hmr8fkaZPhufeRlUBUi75VrMH2HozBtXX73anr9G3o/8nw9JMEs3gX/tFqCZHxnutujkpQID12Gax5iaff0j0ChlDsNm14gY3ay2HumwEY4Y0pM/J4NnD4yHP0EyJrY8E/kgYzzWmK72/UEYXOuxKfLpN2nUfMdx46sv9zyv+RccnaHvHIBJLrmLs2HmjLHQhby7CTdwccFhH5wQ+nmJzbhDrX2fq8VVrcug2L0/edyJS+wq8v0MxF6W01UkR0MZvwf0VPyBwyo2u6WM+ X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(11063799006)(56012099006)(10067099003)(13003099007)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: b7zYzNIX+sVpjFphkxKDLSm1KbXDcal/pLfdNLsr2kmgq1SdlVhUDIv6EaEPO4Lhpdkx5Hd38+66JgMU3ZYf/qAFMhpm+GC7bC0KW0CPAfUXPPoTPHsSLQoI1uLsbcphrzSRC6ucoLxkh1tZBkFG68Fu9xB+7NX7cCCxcioxNevKXljkgxAi+Cqlz1hpsbMFYB1TynGRHgZBfaCxy8zuXubdgAGv+BzFwo8vgl2ZcHd70IYqi47rOSTeUtAVldNdULTl37ZrqshltBma822BYz1ZGc2/x5z5clrBt967Q4auxfV4RkcssZMEjK2siJS8EMK0phgj0GfJnMv4BuXzzgVk6OGcqFY5jpdS6a/SkeQkushgffr5bNw6Prsi0Y0uKskN+ZXKc/Nnq/+tRr/CoJBguQabHXhgANO6Chy0b5yvCPWtTaImfenpkXLouRtEnKzbMHfEprz48Bu854t/kIcDfsJFCw0UwE09/MeY1fTMw8cf3vQSA2Ycri5H8fUoWaIQvBoRxq36rLzd9hICP7HivdQtCotVW0P+CTzv/IKenS3nJATnQjE9c96ulteuBUaLo73moAm9IuqqXiWatRngCfDMFHLSpGP7ORZioj8HEvjZhLHk2H+L8iYBZ/Rg/VEy+nxyDF43w6qN6vNzIFNveqTqnEI+doDh6rx8Tgxzn4hBBbN0xcALsgiHOgbRqUCYKOrP/EAows5Bw7l9etf6/Lj7KFiraZcSDKg5U+Jju1X/NmiHzJH3/DGkQMZRjrL5SONodWlfnh2qA6DJp1BhhLRUJVy1cZ2FN+oDhEXE6bU+tZBQw8OCwQx8LyY5LTa2ruQeNC6VAQ77fIeXXiFaPAq1I8DbU1myNj18mGi920rlAmX5n4vrZY5zIAl1+LTM+CRlNhbtivWSSq0KDyfFXRjHEKO5GiyDmuA6kl8rMNXTjIz5utpppAqiLfvmPBFeqjuUU497RDwuK0m6y+2iUL+LcPyazGkyB5Ibk39fjqBv0APLtO3Oh0ieejsXAnrv7HdlZVq5OOi3arJWjMOOuIEaGPubh2N7SXODqx0Hw1+ln32rZ1KdyX913mQGPMUnG5grtOSmYTE9wvEToMe5JS4xrrYHT6FHNHb5iqj2yZXbRODVUWhB1zVeveZ9NT8S5t7sG3qj5X4QAA9u45DUiROaJJvYmSmvbE0VR20+RmYWuN3V3M8S78OJWHWKk7aJGFUhySUXUcafnAoTKjTJrOTlP6VbMw6bFRe6IDn5yPUEr4T04TvYI4Gr8GLqcVpUbVLBzs7bHWFCElh0KJkeiSpcCHOvdYHX2Wein461xhJzR/PTFSJl08ygk6PLTrbVq/kYSN9Ffp2oopqfGrUtIJN73LRs+XdkrYruEh+vc46uG9Z2MSXHA7Z0LQBL7CtuCju/OBAiMBQNyRYhjv8vAFvUb42lOUfmxGVlbWmlUTDCF0wjKMeH/EXuDDmv5vx8vIOUDAaLTWvVFCa9oM0xzHLqCP50ymWmxjhdi2Utw45h0m1JFWLPpawQD9djV7dVyKIOdAJIFahYK8ePzUlMKzYv7uS9gVQm+O/B/JLIIEZO6o7F2BOcI/vR0FuK1Skpt/da+au+kOG9asygj2E2HEBE8XLzBcmKcpWEMmQGwqh03XZyKNRcFrpGrd43wjqEKq6OzHi84Tsgo+jCO5GsRmNLwKDxzLI2sT5pc8kK4l3fgPuHYx1an4XUjIDJT34+ta575bFeo6JSOosP5A== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: df9cff61-3140-45e9-7638-08dee7ca1a9a X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:20:34.9692 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mDtU50cSaMPevXaIxK+Te1iZ4DKeEGuepuT2gNPJEcBC1twxXnxO6UqrCHTvCYQdss0KImf68z4AnK5lnEb2Bw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB3492 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:20:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241615 From: Amaury Couderc Backport patch to fix CVE-2026-58469. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58469 https://www.cve.org/CVERecord?id=CVE-2026-58469 https://security-tracker.debian.org/tracker/CVE-2026-58469 https://ubuntu.com/security/CVE-2026-58469 https://osv.dev/list?q=CVE-2026-58469 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58469.patch | 52 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch new file mode 100644 index 0000000000..c5d3df9090 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch @@ -0,0 +1,52 @@ +From c7d858a9ca8b9840e5edc520c36fe4f33f2e9cea Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:32:02 +0200 +Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer + underflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58469 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826] + +Signed-off-by: Amaury Couderc +--- + src/metalink.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/src/metalink.c b/src/metalink.c +index de2439c9..2d6e5846 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1041,7 +1041,6 @@ void + clean_metalink_string (char **str) + { + int c; +- size_t len; + char *new, *beg, *end; + + if (!str || !*str) +@@ -1049,7 +1048,7 @@ clean_metalink_string (char **str) + + beg = *str; + +- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (isspace(*beg)) + beg++; + + end = beg; +@@ -1062,12 +1061,10 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (end > beg && !isspace(*(end - 1))) + end--; + +- len = end - beg; +- +- new = xmemdup0 (beg, len); ++ new = xmemdup0 (beg, end - beg); + xfree (*str); + *str = new; + } diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index f0d3458462..a1f34dfb5c 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -15,6 +15,7 @@ DEPENDS += "autoconf-archive-native pod2man-native" SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ + file://CVE-2026-58469.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:20:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93126 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D34FBC4452D for ; Wed, 22 Jul 2026 08:21:12 +0000 (UTC) Received: from AS8PR04CU009.outbound.protection.outlook.com (AS8PR04CU009.outbound.protection.outlook.com [52.101.70.2]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43347.1784708467126866624 for ; Wed, 22 Jul 2026 01:21:07 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=OLb/WRfQ; spf=pass (domain: est.tech, ip: 52.101.70.2, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=S1HOLC8iYKFxk+mx/CitXnlNTzFRUZEjosqS53PCOqlZFX8ffNkmY6nlHhxKBFjEG42QUP+L/gex2vTPoPw1wJ3LVO50AUtIq24J6u8FDW9erVKaD78aRL6jyEEJ4Xn63bwg7Zzjki9u/XnmBTC08ZANkBjOcCScFJxZ1w9LrZOC/+OvB3MXjr6QwPzy7aN/WPs0AJ+myXDJI+vSN+fS4DB1a5oE+4wKCg3CJrCCvIPT0bR/e94+OwAEQgXvmFCLME2y7L+OLLV3X53VHUHzJkRYXIyXlUbsTyQVZGdQGo3ds4ef5kakZY948lHoYCsoPptRB9jVTUe1zzAqDXDwrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=AFwRahHwYJl90c1mnkov1YjG+reQkX3qf/oMotq3nKw=; b=Y/bs0jK9DSIhf/IaLPrN+yXNjsysL8n+60th7rUGymoNRu8a4r3vPWmHI0gIMBfABWwMSuOi1o6MEk6JYVEmrYkdbm6biyor5WFShU1awWFANY3QBfmQof3qHD2zSw8hnVV/V5wx24p+oXaAIvhTq1lln1KTSIN1cV9AoFG6SvMJmhxTnxfcv2zz0khKP0IKPYG/eMN5QrGSsVEjIy5zpxZrfTaL95bnck9wbJh37de6TVu2aZfc2IOg3sHL4PVWTYx3A/yBlhlrYsNbw7Ugp/XWUNTC8PwoR+iNMdSakJaw8osoUQRxlZdJ3eOx5fFw1Kg3pACOLVozv208ebjHYw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AFwRahHwYJl90c1mnkov1YjG+reQkX3qf/oMotq3nKw=; b=OLb/WRfQKgJaTHkxtLyz8/aPtMIzdfhOdBnqIh7Elk0TJzs7ihI82t/uMWCRN5j8Uw3vtCKR/PY7RkWRdQeBzGZjpX0OMtGQdC9qrmvSqqadNKnvSC/V1gSBVyxTTlpsMDlprZV3/9FMKtoSVSsdmNeODU0Iflk3EiVhr6zQQXAE+JgP552IMiyjwYsoQm32L/IcranigNAue9KrO5Wc1BsUw0/ZutZVzdJyJgVODBCCYWjHVU/nS8wOpgjB/NAs/3fSTVW9suq20juOJC4LS19c1Sa7NtmxrNawpqgMdGhz4A+WHC0rgKyhayesXSL38I1pHhp6WDEcQUaUND8P4Q== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by PA1P189MB3492.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4f9::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:21:01 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:21:01 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 2/5] wget: fix CVE-2026-58470 Date: Wed, 22 Jul 2026 10:20:46 +0200 Message-ID: <20260722082056.15176-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU2PR04CA0180.eurprd04.prod.outlook.com (2603:10a6:10:2b0::35) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|PA1P189MB3492:EE_ X-MS-Office365-Filtering-Correlation-Id: 1c27c33d-d7f2-4cbe-a4ad-08dee7ca2aa4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|11063799006|56012099006|10067099003|13003099007|18002099003; X-Microsoft-Antispam-Message-Info: TAEauUm1d3TrLC7dRr1VX7b5JmExPOI6fjBSKTDHlWwpu2I+fFcEo8KpIMC5acyi0dyHEyC8rn4nQVredZxYfmWvahwP4vzVYKsop0qXsmB13D4I7fSuDCN3yz6vMchDSkDteW7hivjUCQ5ndex69trMv/k74d5jBZJh89gcGcFc7QejQP6dq6W/KCl7xpOZ7sX7kjm1psHXuYlio/aV02xQfxLlTsYja/KjkCOkKGsAeJbdAxIj9T9+NIgn0nfrl39XUxiFNNd6UTPsJz5RoqqVmbjrWeDi90CHHXbetHmJzWiKDYXYcbAfEr07Ea6SChb4uhXo2Cxz3jVQU0xMk8tYHfBFwOYchby8NS4Q90jstF5kGhS4Fz3p1tGCrliiOqF1fjKnE9M+NqjYpUPS+hWhtgcaC7DicWprG4TDCdnBZRar4mq4d08ZAd1HwnuW3Ox6hlICI65RvJzaWUlgjy3wL+CLm3tDJmJfQM6VTyykyML1pSWge40yH6vCLw95ndMD5hmU5ToPxGotbgIB1Tkxb+wxGKJwb9KhqjkKJY0E9QdHp+7O+dejXj5g+pmZqiJnlM4rlgiK3yLBF+hXBM92toDXqSjJwBXyc0hroE0Uf7Y8OrkIsD3v/sq7BuUh X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(11063799006)(56012099006)(10067099003)(13003099007)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: zi0nb6NuWQIl7kGln0jilBuIO48ckL7x/vrkrAJvju2e5+8GoPvbUkxpSKFEWtOw0ggO5/mTeYEp0sZQt+X4I9dhWHGR123ZtfN+Ca/8SsM5c2/hvz/5aS2FFTg9TVLAdY6fbg+ANRRIu55Zx3aOKtxdcBxv2nCYyzbtmL/63TfYmwKlFXY5Lr826iEB7d2e5HVqvJs4I6l+fzp4SxBEaUyrRiBx2Y5Ld15QoPJl95eJciE9jebRvds+Sq/FNVkkVGc3iXLHDuZhecPtab03Zazq3eO/qgwytCeTaqSoUCg8J3GC+3cErnp2dXCNWPlSe4z6CnAntMrjmeCfhHZXEiHizva/FNWwNSoXOv0tmS8MI6+tcak21fmZIwdQ6ppTDEgifHUEmlCp3TtSExEQoiiO5/H9g+gfZ6DI38iu3ofjlSxFop9BsPRfIuy5wqmAzxe083t/0Aef/o6HkMYCrVl3Zx9tDDUkNuC78wzMlPi7NJjIXWHudhykFUDZssHfZKkbKCvTi8ybmSj94OvfqQXWn84YYbtI79VrGQXjuZiqR6kS4iVTCSCYOEz4wXKag33HTykS/opo6ZDTJGgkPGhG5qT3NNQt70yoFwUs2OTKaUJRhBOHxEUk4FV/ZO74lssdRplg91LNKobTxYjcMYLx0a6MZOxiO198bnsjFVKnke98l1ZoYFiLkGEX6Kf3R0xDZET8jZGwYnBwBOfrC1YAed+y3hGaKQ6FeFbg9GMJn9PzUhx7vjd169D9o9RGTCVc7ye2eQSq1EZiRjfZT1qTY9kQN0YxuNziM9sypoLRANZDsqHWpcTyZWouVAzx9aS81V0bMNme9kVAGPNt2NkXjwdN1WA7jIBNols7NNWEztmuvx7wRD+4suPch5ynO9Wz1riWl3YX9AyQhU5jYA5TWekx4ysI1GKXaBqfVpev4ZykvNHi9WVwTkgG+OZ6mrat/r9B2X//wkwxs5HHoRfgfJZujQvyx0fvK46PZhV3KTvkAQS500WEloNfhXrAmwawvj4PS3+u7ZxJRzbHQniaTyuSTV8sfe+45JOzat4u8QCEOn6FmI781SQXMVDrSYltRzHm9eVqs6RxioBzG3z8eyiqyv+U8HBMXwlhzHoynYQ3sO7Y7QNCxO5NnJcgYGZGSPJl35wp2J5mTGIoGZEJ3BXCRmfm82qQlV0A9L9JgS0OTZuUPXxsa0PbOElfemSXRfZEPjpirYoXJ1LWm4rNF3n7jbOBEM5QPQfoQAB11PDUIfyuveef7EwZPWNv9ZRxizp4B3ENJdcs5ajLlqtXAztxlV8GXRiRkc0sBSOxaq/o1lJvSz9ydV1Fu+ZMKI8fPfpFzJKRQxDyfLcbU2T6xIq1M6MU2oK9fwXxLqFaZ/8EKWNH+kHFLreqY29HWIDyb1qaUt8G5af+6cEl1yrpkDLCq132DO+wCFTPZ5kI4UhRp16wFnevfJ/MADmfyIuRb4hasUd2MpgrI2TRw97qHsP90nFFyr66ZpdbQxqjWv/CwDOmPM6vYdCzAwR3s54X/QXeaPTAlS8teEJi9VXImQcpGxKC2QVp7B+N5yhb3GqYVRIrYeEti92jKcvbBh343qjVaMJsAXQdWbHib5vBUPtLhUa5+/SIM4KA02VCx5XSnIWA4miiIu3FDl+xAejKQyJdcoY8ikYTYB2xa7f331t7nmi6JMpqR9HrcA3nyYen1mqxGUtBxi8mhSFtPboctVhA2m71+x7ajYxIug== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 1c27c33d-d7f2-4cbe-a4ad-08dee7ca2aa4 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:21:01.8469 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: B/GDtK1i6VcPk4BUz6QXjmVgg8Uqsx3ZPXRXY8C9UMcBpl0TWltorzKKStSFYyXFhJcu/LynKGNNo4OIgHnGMg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB3492 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:21:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241616 From: Amaury Couderc Backport patch to fix CVE-2026-58470. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58470 https://www.cve.org/CVERecord?id=CVE-2026-58470 https://security-tracker.debian.org/tracker/CVE-2026-58470 https://ubuntu.com/security/CVE-2026-58470 https://osv.dev/list?q=CVE-2026-58470 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58470.patch | 78 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58470.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58470.patch b/meta/recipes-extended/wget/wget/CVE-2026-58470.patch new file mode 100644 index 0000000000..463292651b --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58470.patch @@ -0,0 +1,78 @@ +From fd316db417a4d368f6f76aecbac047dce7e40699 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:57:54 +0200 +Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58470 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf] + +Signed-off-by: Amaury Couderc +--- + src/http.c | 35 ++++++++++++++++++++++++----------- + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/src/http.c b/src/http.c +index 07af1867..ea2e591b 100644 +--- a/src/http.c ++++ b/src/http.c +@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, + wgint *last_byte_ptr, wgint *entity_length_ptr) + { + wgint num; ++ char *end; + + /* Ancient versions of Netscape proxy server, presumably predating + rfc2068, sent out `Content-Range' without the "bytes" +@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, + } + if (!c_isdigit (*hdr)) + return false; +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); +- if (*hdr != '-' || !c_isdigit (*(hdr + 1))) ++ ++ errno = 0; ++ num = strtol(hdr, &end, 10); ++ if (errno == ERANGE) ++ return false; ++ hdr = end; ++ ++ if (*hdr++ != '-' || !c_isdigit (*hdr)) + return false; + *first_byte_ptr = num; +- ++hdr; +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); +- if (*hdr != '/') ++ ++ errno = 0; ++ num = strtol(hdr, &end, 10); ++ if (errno == ERANGE) ++ return false; ++ hdr = end; ++ ++ if (*hdr++ != '/') + return false; + *last_byte_ptr = num; +- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*')) ++ if (!(c_isdigit (*hdr) || *hdr == '*')) + return false; + if (*last_byte_ptr < *first_byte_ptr) + return false; +- ++hdr; + if (*hdr == '*') + num = -1; + else +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); ++ { ++ errno = 0; ++ num = strtol(hdr, NULL, 10); ++ if (errno == ERANGE) ++ return false; ++ } + *entity_length_ptr = num; + if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1) + return false; diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index a1f34dfb5c..5268ed968f 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -16,6 +16,7 @@ DEPENDS += "autoconf-archive-native pod2man-native" SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ file://CVE-2026-58469.patch \ + file://CVE-2026-58470.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:21:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93127 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D341CC44533 for ; Wed, 22 Jul 2026 08:21:32 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.58]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43350.1784708491399541406 for ; Wed, 22 Jul 2026 01:21:31 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=XOgDMFpW; spf=pass (domain: est.tech, ip: 52.101.65.58, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Gk30NGuh07Fan9pOL3pybmKnWJEjAnuJv/pFy3+lhCZpIIEQyO4w5leKbaDA3DzQV6WhhcTlmcZqC0FtS/B0HM0A8IPXTB0E+HxOuoppb06EsYnqgJowkvFp/aHd3HgHOquDGgbpXPORPUGOfsXD+LmF65qzsCHw1CwTPVzZkplPZVFqXXojOcxofXGMA8Q2ycycEOYz7BMPf8JijdEVL1sg/+EPArCFT9HstSEcecJom3YYznpJFAsodtReB2uffffIwnXWlL7kg1w0Eay3Btiz7I9AZnoXkC7cjLErgItCM6WI/Cva70U3wfU+OpWse3aTjo+O4mtoCVojwBWPRQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WlKzYR2ynq6vryFi0XcXA1JaHYU/FGcyfj5jjW414eE=; b=jxYKkBc6+FXD2BE5YhKJoTNtuMwoW4wy6UbyDIHwaVzvk7xOc2UW4PL8tiWMvRRx0JQmuXD+J9ozpaoLX0XiAtq8+60juGnVG0yoKFBI/DBxA+z4cD3Qce1GwPO3VxSpbbAoP8Bxu6tQMGZn4BPG38pNrrwAmFC6U/CMEWMKaQU0LFqawU37OFs5f7jaxldHgfcNZDqQREe7uVHO0HwrXGXlj2vBA3XgsdBQyoNvGuawZX1ISyN0MrLlWH2kifacJ9TRwv5KO1KBe5kwkD+n6MsKLjRDLE2o2JOGsL9ONpeRW8zkP6mUO2NBJcUjkYRMJCuQAU14bHXmDbgVyap0Qw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WlKzYR2ynq6vryFi0XcXA1JaHYU/FGcyfj5jjW414eE=; b=XOgDMFpW8i/qy4HbRkG2rUNkv3aeS5OXISD6xGkTWiR8BS3EZXVpH59g14ib4y9hCeWA079wp/fvNTPhsYKYKrT7qmlBKhso2q/H9MIZyecSF3Bq70yKipZ4iZoYj5LzjS/vK3fd3q7PmF1C3fAFIJxdks/ooISqg9ljMcJor/W/DWp+foiyfndlXMFEtK/CqcGH/TmQlBS1i+MXVkqzAwM7Lr8YjeCPzvHqDob91sHyURsBAiOpWtc399j/Y71DtOnR87t2cOojSX3ICLyIUKILQlFPgpGubYYZxEcP89CYJ5CBRUPdThhEhmbfk/rk55y4DGJEn2MlKYW8ekoW3A== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV4P189MB3630.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:21:28 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:21:28 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 3/5] wget: fix CVE-2026-58471 Date: Wed, 22 Jul 2026 10:21:12 +0200 Message-ID: <20260722082123.15217-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZPR01CA0083.eurprd01.prod.exchangelabs.com (2603:10a6:10:46a::19) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV4P189MB3630:EE_ X-MS-Office365-Filtering-Correlation-Id: 8993323e-e003-495b-6829-08dee7ca3a76 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|11063799006|10067099003|56012099006|18002099003|3023799007; X-Microsoft-Antispam-Message-Info: F1J4lhWOpk1ZTDrCt3fcF7yLmgYngX4sfAhzD8Q3fLpVPPyVfBWdIh1LITIJ/g1iTnfJ5UcZsyRa+VXoSxZhNpuruDhs1Mgf8Mv/BOyMyRYVl/PB2r3mKh1UlV6Jy+N+nObqFk4EEIttAvH+5TXp7oZjatJy0Y0xKPb6riZLsxSnexXmiuov2C28lpz7burIasOkOElMk7ygatkdhC36hIX8Mj1ZEFa80qyglfNib/mBda+YztCaX6+zdOCbQH5cdcs/LRXx+SWNoL4RkS9Dt+hH2L3FxVrIezxzI1Bc54MgK+4F1zuPDGQZyAqHWkIEnDGmPSwwx6wr5ZwwdTQBRlaUBMS5ts/ItAOdwkbcb3UfdNP8pXK5XS16WUluGtlTZOIRYHJFtFV5KV1ru6Z/siWOGolOBPnysCWoig9SrDQW5AZ6ikacqJ/JhZ8q4hfslzU/FjP9iOCxxL98ynQj08OisuysjV8+3M9gu0ZV9bRQVZuSDliTk23NGdSGxyKYvh8X/rXUnBWPfkUSc5fW1HUWcPezCw/+TYbwQ7LKxu2tq9gUDQ7U1tLC109aJc720lo632kTTPujaL5H1k19b3nVZQ1EqgVKOqOhjL8w0t8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(11063799006)(10067099003)(56012099006)(18002099003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: KAGOspx9CqWGdscvrFqQu7heh/mfsR/Jh276uIlexkj0AvLTu93/tg98wArWYNv3drtMn7StB0hlX8MDQOxBRVUNdPnvbu8lf3UW6H2VbaBIzXRSu4l5m1XQ1PmMqPjRJfhGOIgGMUkNPBXDeJG/QWsQGKMUBtzvdbfrQRJPtcLk0tWhj6Vny/lUcEcNjk6DqMZksj+9oyUXb3T8U/cSkJ/pNBK5hsyvrHvtYQ52Rqu3e0cTqfebdlEIffSMGmtd96rJCLSbgrStMe6q2XeEbPfbaXwacAfKB05Y3d7Shjrwc5m9Rik0Gx5LWxBvFBXqbvIrB47c2EAgFGNHeym30+7K83UHoVMmsWPA5TZ97u5YZEtY5FqvbqmdUkY7j7/4D3G9oO89amE8t49FdOwflX6DiH7G/PhUqriMF4KHyDPEmet/m5CWn2EEDQUh5aBJz5Mcx3eTDNBpydWHE4vedgOQa+4GhgfSzfhSGWdl14+iufd+t9LrugoWCbHwbes3YG0wXEe6oFSU1ZVQC4PSvbohSsXV4NxdkXQHiEnVLIxRmizmJY3wEgxx3khv0SMciNHWeCunKV25O0e8/uUITB5a2ttprFeo45mMyXfWFd8r3wqospnygxn2cZ2ExsCe41Z7z76cEoGPVWVEcLU+Elq0YqtgXepKyb0x2406xLbUh2awvyBzw+aZPaY/PVz/w6tf1/UN+d4owb94X8bwaSwBz0pI888Eop3wjYRdhNCxVk5egxIiUws09jwlIfLYnp9rDWSIyoXhPlwTdykriDBDFV7AwtfV9dbKFINh5QvLTtzgRth8xLx7qM6M3cOY408uMV1lyscMepvVOgFnQqez9+gRNS/2kQ8uPyNW+gq21lLnCT3ex9YC4a6Z/GAOVWlKyuZzXcbrTIf5HqlxxfSwHnEcdDxWuFtDr1pon+NAs1MpUeX6DzSTSrNp2KQAyyuQ2AJCBnpHtcfai0pgzv4swuHupqVXZnq8YSXxn/jNFN1lMt6h4iT64B2peoawwmDg2D+0bqzE8ZRlA1ZOkogQz/zgFbpWeoctMXAIm7zTp8H8PgM1dP7MjHbaJ8SXIP54rKLyo6g5CymA6Xl7yRC/+sA6aHbZOERJW1XZuCAudp69JMTIYc4osRGAA5rEc02inf+WelgVUhWiTqftdZOg01E7hPiIe9pTAezpREI0IqrPaHKcrfCaQzPRjky03igzLNJC1fV/DTRo5fk0USrxP0OkUdPb7xaAXskA7sZvnigqjbamWkAkw3maiMDdMyHJUT1wn1ErBsCSbDaYSK22+cLKsePEdFD7bd9j4aPaGYhLks1x9Cahr37XGtxIl/oVlAL0cSrpRe7i9mZYGYIdquAM6Ev/3yskaA+JuexXZbqMy+hTsSOuwj9vqJGOBNHNr7xSCjs2g11qgW8Zf25vS9qyKodxI8lxswKdN87yxpEIop9ONhbDYnWelPStT8ZEyhXHZrqTH8kP7l3vtp0HkYRgnNtY21I0V0ULTDF4Q9F0Z12KmTiS/tfpDSRfM2vc5rPB4QLPhxMD/qX3/q5HwW0uI0xouFB+OGyTyyhlOkNWPUFU2I2pXRFxYZBdr8NHYL0GunuHfenh6XDdUON3zYan4msMenNmWJxfuV8zob0dY2bIogsn0guE4WnT1tPmBYbAngHxxRqAxeLVgmH9Kqolp0QJtxVQdJiF2/QtapArp9WrSxaiW/qXh7fqLc2+atgrhUj2NJWWgDhL8g== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 8993323e-e003-495b-6829-08dee7ca3a76 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:21:28.4159 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: eskfO4x42J+j4Ce/Bo/RoKTxuT2bXpj2VphqK0nf1f7w5HhTIRpoHt0RgVUDBh80AYhR+THzdujdyG/1QXnQGw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3630 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:21:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241617 From: Amaury Couderc Backport patch to fix CVE-2026-58471. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58471 https://www.cve.org/CVERecord?id=CVE-2026-58471 https://security-tracker.debian.org/tracker/CVE-2026-58471 https://osv.dev/list?q=CVE-2026-58471 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58471.patch | 70 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 71 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58471.patch b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch new file mode 100644 index 0000000000..a69dd5ca81 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch @@ -0,0 +1,70 @@ +From 532945675f0d67677cefb04ac4293005ede61379 Mon Sep 17 00:00:00 2001 +From: Arkadi Vainbrand +Date: Tue, 13 Jan 2026 12:22:04 +0200 +Subject: [PATCH] Fix buffer size handling in filename conversion + +* src/url.c (convert_fname): Fix buffer overflow. + +Copyright-paperwork-exempt: Yes +Signed-off-by: Arkadi Vainbrand + +CVE: CVE-2026-58471 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee] + +Signed-off-by: Amaury Couderc +--- + src/url.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/url.c b/src/url.c +index 2f27c48a..7e7a3cea 100644 +--- a/src/url.c ++++ b/src/url.c +@@ -1603,7 +1603,7 @@ convert_fname (char *fname) + const char *from_encoding = opt.encoding_remote; + const char *to_encoding = opt.locale; + iconv_t cd; +- size_t len, done, inlen, outlen; ++ size_t len, inlen, outlen; + char *s; + const char *orig_fname; + +@@ -1625,7 +1625,6 @@ convert_fname (char *fname) + inlen = strlen (fname); + len = outlen = inlen * 2; + converted_fname = s = xmalloc (outlen + 1); +- done = 0; + + for (;;) + { +@@ -1633,7 +1632,7 @@ convert_fname (char *fname) + if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0 + && iconv (cd, NULL, NULL, &s, &outlen) == 0) + { +- *(converted_fname + len - outlen - done) = '\0'; ++ *s = '\0'; + iconv_close (cd); + DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n", + orig_fname, from_encoding, converted_fname, to_encoding)); +@@ -1656,10 +1655,17 @@ convert_fname (char *fname) + } + else if (errno == E2BIG) /* Output buffer full */ + { +- done = len; +- len = outlen = done + inlen * 2; +- converted_fname = xrealloc (converted_fname, outlen + 1); +- s = converted_fname + done; ++ size_t used = s - converted_fname; ++ size_t newlen = used + inlen * 2 + 1; ++ ++ /* Ensure we actually grow the buffer */ ++ if (newlen <= len) ++ newlen = len * 2; ++ ++ converted_fname = xrealloc (converted_fname, newlen + 1); ++ len = newlen; ++ s = converted_fname + used; ++ outlen = len - used; + } + else /* Weird, we got an unspecified error */ + { diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index 5268ed968f..8d9b983de5 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -17,6 +17,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ + file://CVE-2026-58471.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:21:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93128 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0F1DC44533 for ; Wed, 22 Jul 2026 08:22:12 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.62]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43231.1784708525694261694 for ; Wed, 22 Jul 2026 01:22:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=w/RYE+U/; spf=pass (domain: est.tech, ip: 52.101.65.62, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Rn739IW0K8HMhcdGvpqaRrXt7hvslC76tfeSOhB7ij60mCqFV/iTVxj2DMP1BxEpyXNaGQLc6H/hwXu/IEFBBfaLKVtZJlcuXfriIrddRTxa4mgJ1kYfzOa7wijd1jaUG2K5v50HDYKc34PzXABiyBRl8/ed0zIRB6hzFoVdnWdDbfGgOAcGom9RSIItM1xnigP+2E5lM9hV80b+aAr1iYW2SjOzSoSqb+mlBURY2jCKcHVSiTZ++EOUWtaMpNFD+w0hjdzT//lfr/iS4/rUhwu2obNJuGknIbJa/JGfQ4LIyYZ1MhSTNSE5SvWODk2T55xNv6PkN0sOd50mG1KjuA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Brll+F2/WPQXZ3VADSjAQm9V3ipbBWUMekgL9E8qrcQ=; b=us+zL5Jp3XtewTUs5Y3JFMyJuLLRDVnkIn1bX2r2wKNu8H2WMcU1kCPLwNnRwv5gtGU3RGqrjiOOScd8QIunDP4LxuXZQbfAT61r8ScNBizpQe5A22m2Pdcdxr5J8q2lXd6OvU5rwt+29+v0U9wjvs9gTCH31DWUVS17qM6GkDoii1I2h7EaFOASH/YxZbFV5a0g+oPwNV0+V+YZxl1U6ntpLHjU2Pzk2N9qDBjGZq09oYl9Opp+uofOSjB0FeeLR2ou4OSDmk7j1hi3CrM/fTfPEKRx/9DLoP3eS80IbN9HCWXT/5/k+8Sz5F7rNn4J+wL1CYcYBXfFl2KmgXvhZw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Brll+F2/WPQXZ3VADSjAQm9V3ipbBWUMekgL9E8qrcQ=; b=w/RYE+U/6buClnx8Sslmq7CxlDnW0kqBNtZOOKjY8agGDqCLyTd8W4WAuLWtkKzoQ3a7U6qnyWBSai4S0mQxCE4rVnl0QJhfW5swJ/oiQqwxAT0Z1/eXuSTNqcjw2DBo8AqE0EUrNQWtxRWmcHQXbRPTUU9FzBPBgGtXrXvt+xQLnBhTJ/FTXtDDRtsOzc3r8eH+bJRDPH3fEpqpU19vfghoID9OzUdghZXIlR/Y6bZeydYDgXtGODQ+7PfwLWhVxtATVCsVmTywtSYn6KlLms15fdgFgpVIscxaCejnx0SiuG/0osNZOHviQuVY2lvIauymKHkXHBmXq894jJw1Nw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV4P189MB3630.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:22:03 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:22:03 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 4/5] wget: fix CVE-2026-58472 Date: Wed, 22 Jul 2026 10:21:47 +0200 Message-ID: <20260722082157.15257-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU7P191CA0023.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:54e::14) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV4P189MB3630:EE_ X-MS-Office365-Filtering-Correlation-Id: 8692ed71-0f2b-4c2c-8c43-08dee7ca4f2a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|11063799006|10067099003|56012099006|18002099003; X-Microsoft-Antispam-Message-Info: oDSTAsvblZn1u42YPI6qjDoOY+AdMvUXo3ihr8JcbY+igj3xGOP2QLd33HNwYs8HtI4MdgGlgTgBzMoOObbMKwj/lI7nT/J3uixvfost0W9cAEW3y8ftNSl64kMQKTTH6SbXdhJFGVKJKMc7S5EDuRtJ6dEItvAqTgI5H8liirpLJIB4XMApD03kQbBPAFSNTEhnQD8CM7AuYewmulLtvRu3nSj2rrx/SKtNCpDQfpAssYAlkdKX3+sgczFiG4jpTCaau3emgl4H8fB+ae1j5dqFbqpJkI+nfJCOcTnsczXhjak4ekC5zZeWu48MqvBybqHLB3AlsO9d+t1czvoICvbritS3bJADDmxfbQdccvca89zr4lEYE7gAfwffUTrdN9z/m2vuwXkNX/wEZQoVpNtbQahF9Nx2V149jw9rSHQaIu09kDFTjN8L2ZqFCAyEuK3JTCVkYS2aI30Mk/xdzHWTGuO7eAiJG+yxs+66WhCZR2CmZGCkzMRJ28rT30qMH7r1inPVIVU4NYude2gY8G2Fj8/T2bijmkXERkb1NYt6bhWWFpIdhv2xyp7CXfkCxir4W/HEYhRLEL5qsl2zw1uF/oYmLilZ72cRMKWGZUo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(11063799006)(10067099003)(56012099006)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: rEWRDfGEytlAUzZlS1rmB/nwnxHi5FTBLyBgMRtBUaXKc1O7Brx32VhwGoSxn8NLZTVZs057YYOu3ad4/YjQCn64NEkq2IVwA3zzC9taoJk0D7FbT1e0Y3fAgJoelftAj/pQENC3t/GXv6VEXrD13TrNVg1Ow1vDhrHKlewh8V2NpvNVDQQQMKlf1SNzWyiasQ7hN2ZK/N9Xs0imjlDJGvk207gYDfuEX0cVhPusTk/nJSFT1PYe3YKIfLfjAbPrngR5YJnbpYO1E7nXUnwnsHv03fmtHoCV+tkc7FbxvFu0zVtbtKKf6l3r3R5rgLdyLwXOUl/pF0MuVL/1nRjWZWBPheBUhLcP8zQzhuddAnC0aznhcU527hsEO+pupR6BcQehEc8RDQvnDKEbRB5mdqunXQ6aRE0VB0VfzGJnoa1AUdozZ3rFEyj2z+m/qUOWi83jKB2SqqDe4htXTweMABojiy/xZH+PA6GjMha0jCsYV4m2zAZ7WGyjFaXf/tkbUcmZIY6OmUWpC9ha63Q2vpwmmUwgeEj0bACKyAKb3PHscPKvUGmXyd3uF4StTFRdIWuQ4NFMd+QQyLTICd9SQD5keEhiTGmW98XEFvK3HZB+5+zhQnvLFK0f/q4okOwUQszTiKfuezYaq855lLxhiyNp1YHMiXxgRfsWArPTagZ+xSNFRSqJTk7A+gEo7Ms7y/yVJSga6qZlocC9X+SWvrREa7xtg2pnlGlrct7saz/Nl/X1CyvVayZdTKy1xQOpOtNULYc+SYM3/WKEI+3KGkxBYxVan8fqfc4AmXmxwl4pC6kjt6RIHpwraEzoOwbRGO6bY25C2CzVohKOCIDnu5RpgTwTmLwdDXQ1V2Vr5O7hAsQmgWPQUCyvjqwvhobdvVd6kUIBbs6XxQCDesMn89Xqw4LxUTq5JHnIuwD+s+4eJ1xCOSKWMcBqT6hISYW0Euoc/4FTSBKhW+UFlHrgotly3P7dBiatc8cgQ71H1fEIhyNGq4decvGZQbKZas5WsrFPFMGTk77auyAdQhhHu7I14kkQOpJ+63CIqYsh1+H95Ptccwuysb1f7h4heM6LWVMYAGqfcyWZnHM5DrpXlLhSFT/OTx34s5pUMgmwp7wmRWXyJe2AWUp0XWQzeg6SAFXmuzhzbjS8GOsWu/KB7SA3Acd5KtKOw+8oya/822nPwrwyqCPS1iXmH0RYSC3sdRqvJp8apakWeIy+jF1yGQMnAJSaW3iULc5qVCAllMMaZE/M6B25la2gd9qEdfCBCTyk+OSEpivSkkyA839XDUfeHEWZbBnfVtcEq/X2+/ST6xVf/wzTudpGYDK+rZ9yq0qXSJ4X/s8Iz01ZjjpkZmGhD8VVtzznUMfwQyIPFqU3LeJbVG4P+JxyGFlHXcKEVUWtRDIxH/XdG8DZd7Z8TDHsTy9/HXKyZibEdwTij7+aV79QkUz+VUyLg/PHtw4sG1B6yuGKd+/wsNLW+6WJoQzAflgYZdd71uzWGE1/z8ydhHt/dYqnZPmWKi1ColYJ/QG5zg5PYgT1m2Hvt2zFj4KZTlxmdt6Vq9Q7UM9f68x/aSpq0Y0UriqwZvYCqxBcsJ34th9rGA6JxUYbnFCxhuDt7d+FCkoG33mumS8v9TBqOYKdN2KzZBFncIR9heuN2E5wn2UPveM5ljf+ZEk10o/PhN/juOZiQGfXFvSnLvcX5l4Y83S4xv/CY8no7EeuxqzAnemp1XJp0ECJe7gVaA== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 8692ed71-0f2b-4c2c-8c43-08dee7ca4f2a X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:22:03.1443 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Ycot9LBVCLg4sh510wBDHYJym3S0CZxNwousOdqG+IJ3LDh/IPn+n1lLysPF1bqcDBhuko8AR4ZN4hhVlZODGA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3630 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:22:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241618 From: Amaury Couderc Backport patch to fix CVE-2026-58472. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58472 https://www.cve.org/CVERecord?id=CVE-2026-58472 https://security-tracker.debian.org/tracker/CVE-2026-58472 https://ubuntu.com/security/CVE-2026-58472 https://osv.dev/list?q=CVE-2026-58472 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58472.patch | 73 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch new file mode 100644 index 0000000000..3499f298a9 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch @@ -0,0 +1,73 @@ +From e4b70d86b2347f03bbe17ae258c68a77cdf6ee52 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 19:13:15 +0200 +Subject: [PATCH] * src/convert.c (html_quote_string): Fix integer+buffer + overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58472 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812] + +Signed-off-by: Amaury Couderc +--- + src/convert.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index 2e5bc22b..d1cbab88 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -36,6 +36,7 @@ as that of the covered work. */ + #include + #include + #include ++#include + #include "convert.h" + #include "url.h" + #include "recur.h" +@@ -1178,21 +1179,37 @@ html_quote_string (const char *s) + { + const char *b = s; + char *p, *res; +- int i; ++ size_t i; ++ int ok; + + /* Pass through the string, and count the new size. */ +- for (i = 0; *s; s++, i++) ++ for (i = 0; *s; s++) + { + if (*s == '&') +- i += 4; /* `amp;' */ ++ ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- i += 3; /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- i += 5; /* `quot;' */ ++ ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ + else if (*s == ' ') +- i += 4; /* #32; */ ++ ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ else ++ ok = INT_ADD_OK (i, 1, &i); ++ ++ if (!ok) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } + } +- res = xmalloc (i + 1); ++ ++ if (!INT_ADD_OK (i, 1, &i)) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } ++ ++ res = xmalloc (i); + s = b; + for (p = res; *s; s++) + { diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index 8d9b983de5..b773081753 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -18,6 +18,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ + file://CVE-2026-58472.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Wed Jul 22 08:22:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93129 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D32E0C44533 for ; Wed, 22 Jul 2026 08:22:42 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.65]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43358.1784708554557569841 for ; Wed, 22 Jul 2026 01:22:34 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=jp0OFClk; spf=pass (domain: est.tech, ip: 52.101.65.65, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yjB4gmujWEUqbhqW/DjJNwkR3hjUSqagVFfUTOzpHWIy8YhtaQJCU/EVjFYtPMHquTa+zWVRKcyYsZAvLkQQcFnmpCWvAeSihal+Wq8P8NDn1tjt8C2EV8oLlx9D0v4iJJ1VRwva/6KFsquGqXF3gZQZ7/StdjMqXlT2UAkyzmXIo3bYiKmjVT8gFqF06nsCJ/O76QJZ7waS3dwVYpRjNqVLM9BPonv/iSkkwmULXVINWvwob7ENlrrpoFnOgcU146X2uz2f/gIxXMaATgzeq0wWs5e3Dh4yCvp0NG/Q3mlHOycxZFIjoyAZaHBBpP0QLdqyqDLeWX2TiGf86yd+EA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=b18ZUBPBSsHbl8TnU+E5HYcWuwIu+iBdmKHx/GpWz3s=; b=sUcbhqUnY/afmspvYCyec5+yCfona9c6jRN3yLJGQSPVS1ZIVde1N+/nZ5wiFDdbOdCimfEO7W0tt/lquKIlaW8uBfY/VlkZEdKkvss9rOIypmDoUDf/Sg7ZceztROWx9XRTBmSn3cj6Ek9jkE3AQZ0/fuh2y+AzOStNwd12C0HCF6YgGyDyqySQbjjYsk7zfZ7ET/g8tVCLqqENFgNLWnaKLRElgzpTWxUildGiUXYmNGspoLED2A+hdLtx8cuF8iUA/4+MGdiAd+7jR3PExGt0mdpN+F02AiC1hcmKLPxNcPw8gx/LsLquOhpKDyXntfjq1NWaaOXCkkKiFGgW8A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=b18ZUBPBSsHbl8TnU+E5HYcWuwIu+iBdmKHx/GpWz3s=; b=jp0OFClklyJ/RMLcoK47f5p3HAdXS6AD4kvZ3U0JklBgaSoyx3YH/yH3z+Jc0c3pkOUiit+GDAcGaERU4GzznQuAN6i/zwC3+Epc+6PCHy+mbSbilF1S3QVuXKpmhiYAzLA1G3TyG3bHCZ3aPxwuFrfTgdQ18bIQ1l0g6a73lC2t8m9YONxpI0S4+VnTHzyVB+ert6rRjOGBcynrDqiRVntWnYZKYXrvZKb9bfygYYrc0P7I/arOux9kX0wa/6FWjRROFvqu3cilaolNxx9gJGsA/NUQXTcZwWFrslfqlTb4k5JWf8O8CUuEFZSJahq7y67zmf7bSwU6hDRNVigmxA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by AS8P189MB2420.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5a0::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:22:30 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:22:30 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 5/5] wget: fix CVE-2026-15146 Date: Wed, 22 Jul 2026 10:22:15 +0200 Message-ID: <20260722082225.15296-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZPR01CA0173.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b3::27) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|AS8P189MB2420:EE_ X-MS-Office365-Filtering-Correlation-Id: 0caa532f-6f31-4692-851b-08dee7ca5fa8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|18002099003|11063799006|13003099007|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: lhrGAzCatJzyAX+OrLSdk4RRkZaemDun3JgiTfI8xW927g2K+tQiXO9zzNkzCl8TtHepo7gZn9OAJL8+ydVXjmHp/oVC3UfdKVu8aUp3KWMAOSDsEwtSb1JnIYEKV2ghjPIqT53HoLs5YuiTvlCTdRYAzNaCtbo4LYxvmT2gUaZM9T2HGa/7A2GP67OyFYEq6LTTQPgqwOOv8x+Rji7B9NLKxhnLAGzjssZqQAFzmnM6ypvfLvdRZYx6/oOyuTeu4yB59IbWlJFgnCmxd91/GJ+C1NJxZV6d2ULVNUCBL/co0aH2m/RherfjOawSgWY4XVZSQ3p2e8jjVEgxHzUDL5K2b3kplFQwBoHq2vcg96oyQQqZHe4RuzUotOc0EHks82v7Gt7sELCSsWlK83n3Wu1upSbrJtGSUBrPTNzudvHUa09U9tb1Ex0FL+D5m33F8FLc5ElrfV+DvnCUendnFU31Kg+08TeHnq8gXo8m3MtzaH2Bddzz2Kdt9mM+jogEw82z+n//M3vpglKSq1bs1IC/UWjH6Ly7V6QPoUU+qsYRtmu8NEfuQ790AkdNLwvjMwJyZjQg4U1TrvBd6kpcYjo1ppBbQJFZzceWtx9d6K4uxp7HFXj+ZjnptkwPO1SkOHI37NJRuJJzz20+YmzuCocDEgKgbYZjv8lFbVLYMwo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(18002099003)(11063799006)(13003099007)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: n8khwad4cHEjRaNfvq9ixl9ofbC5zemMmGrV8clNwAZY0GtE0OjCXjY4XEufTW6DNkHE/Qgd6wwD1U8HvOeQXJfdEBtwgjoroy8WE7K0nGffMKHsm94GZMIsK29OxXHBWkfJXtzLixZogJSq+Gzv0wqRRWY/jrrjqoRTbsFEXbCFi3t1TiQF8QFixThfxe9LpxKXWBcRPvbIZ9lRRcjGFkqEAZRJqryIsQiCZpArq6oFd8v+B99xG5nr0yJNg7r87tKeDe7QM5yyTwXN0GR9vxCHqPx2nAkm6FVDrhPHIFT9eNcy8Wz02FQXVtkHJhGlyz8ILpUfW2PfTyrwyprhQ7bPLPb+bVInQiZouzwAQtXm7UFDjjFsAm1JC1cLg/Z0receACCWcKC71g8r9kvb6jpZzUsCCbfQKRExxjO5tSmOJGN6fPObFRA4Z12Ho1XC7zSieBse/B5ulTpC5xkFVQ0cRhy4a6zp6ocJoD+iHvLoUBcpZU0M4Hh9SEx2ONIaNBoIpUzXamFV9LQig7z9jl/mlyRlG2JJXjmI1cbCpKTdIPfvvNhPuBaG1fEv6SRprLMg0UCjwrbiz73P6xSHlKtQDv8XFmSoaA3mAwrIQxlW5vv4EEdZrc0gQYFHBTSzdHZ3Vg133Zkes1tqHBu2uyc1dKXgQTNPRKKKVjYH2KT+UdOPAOXSOW+Ixj/E2Ge/U1CrYZ04Pn9v1T0bW3U1zZbNdxCF4fTjoAtkBjTG3pN/3k7sSxMJJzNbYlUIuLH4OkpawFi1/FEE07n+1oPz8cnLg2rawQw+biH6pcFoOnU9ObU8oOG8fFICbXIXZzlo294TYWhviO6lI7SfJ7sQ/miCmW9IwhMbI6x1LSOcCIMWsFv7QYrJj+B6UtIBYhuFV9DQE2RmkXnZDEtfJzcKLEB9/TiH25jtJY9d/+1KyjZseHFjBUN4baPCBj4fbzlP+IL1mzzWLq7qLC5xQuYy36a4PQYEZAzuIHSSNE0dU4CS7TLId7KxX1iZVmGbpu57FGy7LzsiraimSdND1zLuPKGkxwkj9YHDp78Pz/JP3/nWqL8o4WrNmqDl1aOG9Pj57nE4urlNpMf9dZlI3CB5Hnmr7NJsCrDscXDzSfDKPwSDSlV98Sqgv4uEDCd/KE9mUFaWflEu7hE+rnrZH6WNbpTqoN6lpEZ2Cylg/YMx2qYBeIAFTA8ZbhvtEEIn1AX00nJYpuJDYG+d2mifRkVmeveT8luoNfTBAMKmWs4XNgocdHqAKuY40ZIO/4onz0H0QNY/Eqnaz32La7HCysPuIeDtGRmeiMZRovWs+RMe6mBz43RWqJB+lmO8BpGggDqZIyNSIwZLrxjCjylT1x6bUgJ2aH/JK4a9PI1SJSqX+K2sFSCW10CnN28gecC2RHwAAMObdRwIs53iXNAad98XlaPnmO4KkJP5+W+S7VqXAsjBuL/X3aoZRKYZSd+7SOX3MevQtMLKy1qI8hupnos2WIts6P4/ZvPAIx0KFs/y4chLc5Bjl/JTHgE+1R5sevwlxegPs39AynXU/HGbKUq5UNdF9Q8HaD7o64p0W9smUb8nPu183HpuzCFRYQS60s1R90MG9WC9dr4V83z/4AU/wqGdD3x71iqAj+VKDk3Kt+PpA6JQZ2xbJrKxyfidgcdIMsEz4oz4obfpZAnNlVSZh54o+Eb5mZO5Tl5aAdE5KzsPEK/tXmPQmRm2D3hQU9bKcjamdeN465w+tt/8ZCDXDA== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 0caa532f-6f31-4692-851b-08dee7ca5fa8 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:22:30.8240 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: nClhyYfoY+z8NgsUl3Brm4yWqmbCqnwCD2ZEQvsaGTjg9W6FxfibbAPtdH/LPoYtx8qFCLLVkXVbib/AGjwokA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB2420 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:22:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241619 From: Amaury Couderc Backport patch to fix CVE-2026-15146. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15146 https://www.cve.org/CVERecord?id=CVE-2026-15146 https://security-tracker.debian.org/tracker/CVE-2026-15146 https://ubuntu.com/security/CVE-2026-15146 Upstream fix: https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-15146.patch | 122 ++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 123 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-15146.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-15146.patch b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch new file mode 100644 index 0000000000..a48b230cf3 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch @@ -0,0 +1,122 @@ +From 17e1d62264c07da2fd748f0714043b856d0925d8 Mon Sep 17 00:00:00 2001 +From: Acts1631 +Date: Sun, 5 Jul 2026 17:22:55 -0400 +Subject: [PATCH] ftp: validate PASV/LPSV response address against control + connection peer + +* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised + address, + (ftp_lpsv): Likewise. + +ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in +the server's 227 response without checking that it matched the peer +of the control connection. A malicious or compromised FTP server +could therefore direct wget's data connection to an arbitrary host and +port of its choosing (e.g. an internal service unreachable from the +attacker directly), which is a server-side request forgery. + +ftp_epsv() was already safe since it only extracts a port and reuses +the pre-filled control-connection address. + +Fix ftp_pasv() and ftp_lpsv() the same way: capture the control +connection's peer address via socket_ip_address() before parsing the +response, and reject the response (FTPINVPASV) if the parsed address +does not match. + +Verified with a fake FTP server that returns a PASV response pointing +at a different loopback address (127.0.0.2 instead of the real peer +127.0.0.1): before the fix wget connects to the spoofed address, after +the fix it rejects the response with "Cannot parse PASV response." +Legitimate transfers using a correctly-addressed PASV response +continue to work. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-15146 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b] + +Signed-off-by: Amaury Couderc +--- + src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/src/ftp-basic.c b/src/ftp-basic.c +index 8f7d19c1..9c7bba1c 100644 +--- a/src/ftp-basic.c ++++ b/src/ftp-basic.c +@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port) + int nwritten, i; + uerr_t err; + unsigned char tmp[6]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the PASV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port) + memcpy (IP_INADDR_DATA (addr), tmp, 4); + *port = ((tmp[4] << 8) & 0xff00) + tmp[5]; + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != AF_INET ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ return FTPINVPASV; ++ } ++ + return FTPOK; + } + +@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + uerr_t err; + unsigned char tmp[16]; + unsigned char tmpprt[2]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the LPSV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + DEBUGP (("*port is: %d\n", *port)); + } + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != addr->family ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), ++ af == 4 ? 4 : 16) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ xfree (respline); ++ return FTPINVPASV; ++ } ++ + xfree (respline); + return FTPOK; + } diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index b773081753..2b00aaefff 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -19,6 +19,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ file://CVE-2026-58472.patch \ + file://CVE-2026-15146.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"