From patchwork Wed Jul 22 08:23:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93130 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1C1EC44533 for ; Wed, 22 Jul 2026 08:23:42 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.0]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43243.1784708618923637436 for ; Wed, 22 Jul 2026 01:23:39 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=cy3SaOLM; spf=pass (domain: est.tech, ip: 52.101.69.0, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wVKUou4wOGlDEHVTaPer4Nis4QmS9SyUK085P85RYzgtv9e4Ys6wUow05NgAAIjsRSx/sLKEtlixKiZShvYL7338WkAO8h9sYXbgdlHMDljnwvYmDA3zMFiYlGm4eQ0naSMSXI7QZ0U9WTcQfRZqT9Ou2jWBM3UeYPGLueRCsg/qoq/VI1UtZqwAxgyj7UnpL0TLKSCd7f++jmhz7LHtxSfAU04iZc2Kq9Qkv8iugXOX4zFNklR1sxXFa3+uxEAinGKSHIJVsUN37a6WS3++KXzZN/FdrYmbCzACCfdkD4DbGL6I4WFoH2dxA9/ScBWzq/yAnHhb1AEQuZsmgMauiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pMtuuBOLNYXWghShusNF9/ilkh0V7AS+rK6lexogSCY=; b=uMMUHOelSpfFKLK/XhXZt4E143ItmTKZmBLohUBCG2JPpnIyjQhC6z04GtKpBLrjvActNZbmnDEy6F5T3aH8KFW6Dm+hrHbTspvcKTXzjdo6rRaCizYdb7Lu2dg5pTyu/XWGUAgo6YVmocpj3F4r5rxhifN+Lx91pC3RHZFPVyl8vH4/AIHSU13E3IMOQtu8iMjqbYoxQwf5ggMCJgdi912LRG8mxayr1bSyQ2NGLQulCCMjo4XQ6axiiTB8RAaGaoIM/U3mKQZAwVycpN7MDPIrA7SqnYJ7tZxBLRDM/JVPgMZ7QUrhzRZa1Ga5jRdfLwTo2TJLpLZRuzzNHfyEAg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pMtuuBOLNYXWghShusNF9/ilkh0V7AS+rK6lexogSCY=; b=cy3SaOLMwVltahxoW+O3GY2FMQVGfvsziBwpY9nTlGB+iVEBr3CVEklkDuBi/Exqlwcsex9TKDKceknIyQ+C3HGMilsW8wqktclI76UI93nwkwo2jU/exJ1BMdUC6yVE/H7wBkrT56oz3d9H6mUCFS3p3Wxw9le8ohVycXan4gVjl52v3rQ+/kqSmebpUWxMA4zSHwoMb84VOPG35f66cEc4Q1lfq9SbkLd/Ve6svuqelgfrrx96NQhqs7Wks+98mUOaS/OHqoySmWjeg6UNQNsYgaaJijwwXvQFfroxkxkUyx7O/Fi3myH9YNX/tt3peQbhHqfLW3WlvEVi4MJeqg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV4P189MB3630.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:23:35 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:23:35 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH 1/5] wget: fix CVE-2026-58470 Date: Wed, 22 Jul 2026 10:23:20 +0200 Message-ID: <20260722082330.15415-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DB8P191CA0026.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:130::36) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV4P189MB3630:EE_ X-MS-Office365-Filtering-Correlation-Id: d2669416-c2b4-470b-be9d-08dee7ca85e6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|11063799006|10067099003|56012099006|18002099003; X-Microsoft-Antispam-Message-Info: BhCY6YYUiD0905TOJXX9hU32yIepyfb0LUBe/H+4IlyXEoLf+9bYRKxCUt2e4l4cVeWLfSBfxkmJt+CMS3ebtHPwHkH3Cg2LZXMJMOnb++H14pWapGN8ET2zP6Wp9nGP4Fx7zwgchkYA0f/zYMtkLSAKmwfrhEl59xu8RKvs3D/w3ex71IVNdyRg5zwZr3olbCRKt4zPV6MO8Mv3WT9+tkqoMkudOzPbQKL2FY50Tmjlrba+2um87typR3fQ/JPsqAxZXnLvhW3+rlZM5OlT6/FfvgrtRkCf1APquWMogL6P/ZRTgRyzvqzzVqDXo5mgRPxwvP1A92Q7251cse2r3L5dd080ysvgoolOJFdEkFv+bx3Q0zSqz9xJ/APpdoK9NuYnhIr9lmZai4QLAUqjGtjW0u8Wx+HhQ44UCB8lCqM/GU8UuPFjZOxDt+nYCrUmJgKeu0tu6QMm6a1kmLHndYgVRWMw+yQCzV5UBo/AFRPNnHuYFA91/m/zk1vhZfDSpAe6n+hLfnLLWCHp8/Zxl4EBpyW4aYRCZR74nQHl18dIwq5qaCXazDXhF2SB6S8J9T60JpwZHCaeyTEzh8SjwLoS69AttYxM9b+bMuBW8A+JJq3q+s+cyeoDVuemvG4S X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(11063799006)(10067099003)(56012099006)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: wT7jwgJXxblDAxthvRYDXC9s5W6Vj6+6ldb4IIzrObkTEIehS53twYM3cQs2g5acbluWwxtlhZ2N4LWg+uut3WJTveWyAmngAEJNsa0hhmjHsiWawTuIQoeqTst6J+P0H8UK0raQL4RbU6Jibx9hFsZIjZr0O5z2FzvY1VAwrD9CUkU6uTSFOWl/bw/cK3uD/IkLn3myb18dyQbyQDWoMDlcnPp0aOR5jaIyBi35DMoILTDeg5uB+7j1KvDQi1d7BKPXe0weD6kru9pR9xGFEDgiBpHh7KPzdIyzerxRExO9mxa7WhzzyWm+vaxBHEfm4sS+HXAFPWI3vHR8lWZYKhFZFByZmvSjBNQGvwY+0I6uPIWLiis5IFid2/D/xu25gZUotWPVV0SeaGykl4fA55g99BywQD5/X40IKot0mobJ1DDBnWIBFSJlugwgEqJutCS9XR8+8H1anGAww7H6VuDBbcmk2zowfAIV6er85UcBhGpOfvlUoWrjYaVl2CGzovJ/hE2lbs4vikvKl+AL0GCVgA1jVE+adHSByUk1iqXAH4zW/1vNc/ouxMoh2mGaxOuXFlQrv8w/INeumoIv5O72JfvC4YTwtkBpyHQIDt9QzciWGYt+7yJx1dfRTAD6aylD4AwDcAnaYY/Ui9mpfsNI1Alsz+zMnzxu4FM25Yvkl9dt+XyCFBTPbvX8KT7owQyI8MfU1+OK9mYyYWe832r+zzV6Sh5m51HcgkQsPeludr/8YHSkb0MfcHynSndVboKuidjUTZJ+Q16lA0TPeJ9pRRlMBDgiQ6naT0Ri1+KxZYsYw6HIhFLENhu4lLmFB6QGMvL2HCUPSHJuNt8r/RYWWXx2T9Cfqfw1RfQPWD12xsHundnJx2ztKS8mfZKWNJMuV8vWjJf8VTi7mFIRDtQcT9voooIVO65se8n0FF6p2jw3vrxwavP9+94i/TFTuDAVF8ci3II5pSa/VJ7fzGZ5ZmRF95yoft/8vjlA9goGpOaD6McNnSJZGsTjtKji6vNMky8k1X+W8FcKd/2qkCxSsI6XZkfmUsQVlDyoY7IrP61QxiZx9Oq04+/bAYwazxUcXntuCro5Ezi78d856RiIadSo2k1zokGgF0j8h3Daw3a00I5d4dPfre+ZhEOO3he66grp7q6ZfMv3mwlBXwXDI216HRb4GxDmX3JGmDMmahpXIAs8Z2/dHzl7mR6nCRTlW9x5JGqGAPKFpPLqEC5ukwkP9RCTRm2chdNV56XISeQuiUq5oBih3VtQuAtRJa7WGo6EXiO+yuToIVrQ6bicZSrGCcmOgG8GfUzdjrAFERWtRg7fPsP1gGQTbLf6DLhjcwxqryO3LfHvQwIOkIPyPRDhfAdm5IVrFokrp/1ftG/Y/Lm2tKGiVWFX3uIsCIE+6BPwP3kmzU+4Qm45YJUVlWGYg1JedXPypQRDHqhkxmVSjPhUxbWxrCdrxA5ORkbbEp5DVO3s3UtYJXG7qFOYci/t2LfdTiIZK7ETR6mDrJSaox378qEMMl/T0n3a+mgG72ppxKjHMpMAiwXL3gHwxOzBejZ8w4+Q0xoNOQYAe4+wgphfPbie3I2sMaoWUwlVdbs7Cm4Gl5WfYLtK7tjTHlUFLLyrWYeWkbbmFswlpCiHtZn0N8P10VEPsbhVasLha8pBmTK1cayjJLUr9s66chLkGHlVfKUIk1c1NpXsi9bvKH+qVCefq7dyZktHJoX7Jv1AAkqobajUg972Kg== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: d2669416-c2b4-470b-be9d-08dee7ca85e6 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:23:34.9873 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jPaLRDv9ARSTY/+Um08xN1bKpTisAPZQ6wLP1C3dYyI+E+x4o18YKFDoCRSIbRU3dmYM7FZ8P1VdPV/FBe2idw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3630 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:23:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241621 From: Amaury Couderc Backport patch to fix CVE-2026-58470. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58470 https://www.cve.org/CVERecord?id=CVE-2026-58470 https://security-tracker.debian.org/tracker/CVE-2026-58470 https://ubuntu.com/security/CVE-2026-58470 https://osv.dev/list?q=CVE-2026-58470 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58470.patch | 78 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.21.4.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58470.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58470.patch b/meta/recipes-extended/wget/wget/CVE-2026-58470.patch new file mode 100644 index 0000000000..02f9ba13f8 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58470.patch @@ -0,0 +1,78 @@ +From 1edd2898a9b041ededdf92caebd6f707cc9f192d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:57:54 +0200 +Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58470 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf] + +Signed-off-by: Amaury Couderc +--- + src/http.c | 35 ++++++++++++++++++++++++----------- + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/src/http.c b/src/http.c +index 116a93a3..4dc6b70f 100644 +--- a/src/http.c ++++ b/src/http.c +@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, + wgint *last_byte_ptr, wgint *entity_length_ptr) + { + wgint num; ++ char *end; + + /* Ancient versions of Netscape proxy server, presumably predating + rfc2068, sent out `Content-Range' without the "bytes" +@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, + } + if (!c_isdigit (*hdr)) + return false; +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); +- if (*hdr != '-' || !c_isdigit (*(hdr + 1))) ++ ++ errno = 0; ++ num = strtol(hdr, &end, 10); ++ if (errno == ERANGE) ++ return false; ++ hdr = end; ++ ++ if (*hdr++ != '-' || !c_isdigit (*hdr)) + return false; + *first_byte_ptr = num; +- ++hdr; +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); +- if (*hdr != '/') ++ ++ errno = 0; ++ num = strtol(hdr, &end, 10); ++ if (errno == ERANGE) ++ return false; ++ hdr = end; ++ ++ if (*hdr++ != '/') + return false; + *last_byte_ptr = num; +- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*')) ++ if (!(c_isdigit (*hdr) || *hdr == '*')) + return false; + if (*last_byte_ptr < *first_byte_ptr) + return false; +- ++hdr; + if (*hdr == '*') + num = -1; + else +- for (num = 0; c_isdigit (*hdr); hdr++) +- num = 10 * num + (*hdr - '0'); ++ { ++ errno = 0; ++ num = strtol(hdr, NULL, 10); ++ if (errno == ERANGE) ++ return false; ++ } + *entity_length_ptr = num; + if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1) + return false; diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index b5f50f6c84..6d66ab46d0 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -2,6 +2,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ file://CVE-2024-38428.patch \ file://CVE-2024-10524.patch \ + file://CVE-2026-58470.patch \ " SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c" From patchwork Wed Jul 22 08:23:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93131 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7C35C4452D for ; Wed, 22 Jul 2026 08:24:12 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.7]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43374.1784708645748756678 for ; Wed, 22 Jul 2026 01:24:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=aHQ66+iD; spf=pass (domain: est.tech, ip: 40.107.159.7, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dlokgP0KGjIah3Q0d8BBk6E2V3o1nWNfGsYyh84UzM+hpl7U6LVZtspVPs7sD46DWFmm0s9bbPPOKLPTjZauKj/1thE4H8hBku5+BRts6sYr1LPIyh2Wl2FpJT+z50g9I12cPjc4Ylm92TzsUCN1m80hyhOaG+uKtmm8leg2aNV3ewWps2YmWqxj6gPMj7T5EjKdowPMa7Zzpb4LVn+Z+fJhy70jM6D7xCjVpbZnBJr+lxhNSpZG9fHMPSuyW6/sQaUbpjPHEr17dX350pUVGsfE3dNyuKwsLzAKrIR7j4MNdFmdUFjQXZVDRFpQauifm6IeAapUpOFWhOla3345Ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=uh26d/wwwcfcnEufyIOIqNKPVAintsZu/rq9r1qCr5s=; b=ST/ZzRleCjzcEBU2qSSuHdTyHg9J0llfEnW3I8i8ouoVQZ/cFe12ImIg8eXWeCMO/o+xc1zQIb0khUQLHnmHn2JPdzvDL04GOHujNlGEcknwg3Z2QOOcAgO7ZminelHsOJP0UyKOJv9Y5G5XkS7X/hGFljm9AiENV37xe2N9Z3lUGlw3gmJXeOhF6aJxUlxzgdKELZxoXaGsu2s4UDgN2cB8QNLDZR3J4cTmp3hpvrNeHoTdj8ExCu+/pg6niz7kt7ef+99DhYXw5bgmM1le3enYZGN8imVP0vx+VwpUBtPWb1BiaCHAi3bsUjziZwl4Zn7Ti4+MKLfcFj7gNL+ezQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uh26d/wwwcfcnEufyIOIqNKPVAintsZu/rq9r1qCr5s=; b=aHQ66+iDswchvrYrNGYT1C84Rm2XEWkTJfDebLG5PQTdrwP7yxt42UD+gdtIVNhTwZSQF1LdCj/ukFG8pxqYS3HwtG8yX9wY/IwPa3aaLWu9gCV40LiGe93EVtFlTAraE6pFt4Xf/kNur4IThQPetnVjLzYKnghFhbY6evc1JtAixbyo/ycz3hzq5GfAin6QXyLhglG3tvppIatpu95d+oO+OHYNK3qJ9aX27DW4WFEFnEyk06KqcvvN4fU4EMJwu6AMMmx5TAcvdAGLBE8l9uhYo0OYclo1fDIdHEaGOt81gQV4Fus8yFWUctiQ3OyGWc2qB6hL4T9/f9AwAy9Npw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by GV4P189MB3630.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 08:24:01 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:24:01 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH 2/5] wget: fix CVE-2026-58469 Date: Wed, 22 Jul 2026 10:23:46 +0200 Message-ID: <20260722082356.15455-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU2PR04CA0038.eurprd04.prod.outlook.com (2603:10a6:10:234::13) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|GV4P189MB3630:EE_ X-MS-Office365-Filtering-Correlation-Id: 1aa397dd-840d-4f65-fe20-08dee7ca95eb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|11063799006|10067099003|56012099006|18002099003; X-Microsoft-Antispam-Message-Info: 0NDqw6A8nyL8P4hpLQSCCEyN6wq2KbZqQsuPrMonT2HVD9J1zBmMT2/z632/m0U0CCsvIi4+4aXpJykQ9Q2zbDJT7NdHikNOyC/UV5k5GxT4bqxepiRCZLrzsn0CD6d3tfdFv7KDO9GGiPP92aVHQV5giGbMIK2k2Nald9gOsUE/L/HQkfozhML+VNRnfkHOPmc4HFg6PWAUaEmn1fOj1GhHhCe6rS9MLB/nsih3D3lgOaNgzlA7UxxUepZNuewwXF/t+obkE5trQE4V2YwDLCczCHvvS8zVqhKhqCxGClLqNZb6RahDXICw9/IaLADhbaiVPxLHPXjU/uYsWHPPyNo44zqpQEPkVPdE9nlbe0+mz9MeDRDMnhr0+e6IBIrT+0aSfGHlqH/+ith5uhyQYlKKel5AeZuCbr7AUKDtpgSEywmGukmNZAhjiSUOWWZKaJgPRsBMU1buhP5b8xv3QEcyaZHj/6cFvkAMASD9oUDxwKn83ZDV242KpI+B+H5UiCbuFrCkPCN4BqkPx41zsQC20tbPyqYOtxa7vqgW2xmIfcZ7ed+8ngtS+Z9S6BB8MhXwj36wq03RDX5DAfDCmjL4xK+B7Z/l9r6/hJwS7gBOk23o9HNfhDiOny/e9UwR X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(11063799006)(10067099003)(56012099006)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: S2pSQadHKN1qfXghoVks3bcAGiWze0IMxemcp0ivHb8jQyDq7Tzsf8cM4BuWSiAXrZ9FKbJ18vxe5HE/Z8QF6fOIZnagY0aMeqdP0bmjeBY6h+ATMCiCjpdZne6eCgEfjl/ENNZi7nTXuS5sQr3NGUkyNDDi9BFQdoTJ72Pt/OdMedCir64DcJgwZxMfjh2OAp/HWQr8LojAfM5L3bBuc4qhOone9ztzIrXgvuMllFAu7TZn0BxkYT8M14kOLhGMYORKM+Zv725lkPatqY5DJDdMtfCm7YCyPVGWpP/9Og6exEocIEYVRUUT9E5RVqdG0cl1gyA+Sr8F7uh0sbatI3Fv06yML/FxhCOtqF9l7Omq6QOaSJojj5gVUlmcxaSeDeeOBfi742mkYO831XoYRBERHAsKGDU7ZfOYqSGed2aH4i4dnqk5zPoO7XzlRm+NqLQD/E/1qDb5c8PPhR9ktvizhYx07Ti1kQtW5hMpWEwwtJy2HX4bczLcftqvBLM0I7fWggf49n6lQtz8s5jed6+SU4+huO568zsHBP3SaAKDU0Q4bx8fuyDSB6oLmIMCbstKEhqXu+y9EeLs1PeIOa0DpHxR7BKG27U8OE6vqBW5a94cdxXVadwTUPW6YU86+tkjwaQb02oKTLLxH+57ldjKA4glwxoTPO0Sm7fO0BT2DYlssur/RPvFm+UDuPqnOD3CWJF79b64IkOB6BfyRZP3UFBFUriOhNEkufdWBWeMKQguGAgS3jvMUlAvwV3elS0sE+9tlOwEROMkS5w4s4znyqvk9gwyHcLI47dc7TSHX7ZMvPlpTNBpcjYkJK+tRis0MFzk2NCkV26KSr030PDRh/7E9RJrQxbcsZOsKIP0b7oeGGMz2s4lSG+5z1K0wv68KBEAA5z3unAWdZtL1EzPyPDye52FC6l/cSfTZB/OMeGRxbxHuWI5oVi0XClvuBfIt9yVxw8To7hfTP1jSiyz38D4YaTQeeFvQAZQbymXDxiH1ifb02iAi79nsbn0Fw0ePhft6QhTQvrkZnzzvnD1c9BWETpkPNqqFf2LKGQxUq2KYQLsZpUZplXPlE2qXcNIByP8UHwmeUfriKqEd02Whsz2bS42NmH0oAyy9zAYAl6lN7AfHSIGF863q3tRVuXJRDaZwn9IFvtKfTW61fLSezT9tDFMuAmFaV7UEUCCZ14drtLq8eBMZzC/+Hc7Ea0NHIfSOdRoEzO/EIwTqWmXdrq3JyU/ibereeYJpVeKwCsM+1FecNPE/H5N2knOcE6amZxMkCMDCCBS4YokWg03A1P/7xZsV/DFHLdGwHIrWfYiBf3mBPNmny1S7z5stXm5cxH8+yyhjZ+N49fcFGRUlwM9zCK0XQB3VgZN1KK6qVrz8fmlTkyJY7M9XHcY+Snwezks8b/aQunzdY95UWF7RJVihXLv0wBCSabYKhsrW1ykXIVIhX9OUD1iQ6yKrYNqUIM6pIwLTfunalZ5dKEImU+KXjhvN52qBJ1UbXkt0QS65H3t3XbZ5kgb7/u+pwzAhG4Yfgxh6Ht/cDJ2eeB6S5p6dgOGApH8d0kZftpYu0A4FZtCYqymWp06vcYxlPhXWs4e0zNpgMtuwKsOWUVIqkjCLQTTrUIAnUaacUBHFdOD64dV7TWvUrbj7py0DgJSDdaq0ATjCRi6p0e+WKtwFd9e2/lLFatV919rJPFsUNarjbuZZPGWu31iubzjMWu9ekK69ibC27dl5P7gHA== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 1aa397dd-840d-4f65-fe20-08dee7ca95eb X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:24:01.8571 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UiD+UfzDRU/Pd3W6GVz/YZ1RugC0hF5XQ8Kb+F/UVJsLxzAD3wJ5Auog0LuJOqswuW6apqItR8aHGRH9Fl/bZg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3630 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:24:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241622 From: Amaury Couderc Backport patch to fix CVE-2026-58469. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58469 https://www.cve.org/CVERecord?id=CVE-2026-58469 https://security-tracker.debian.org/tracker/CVE-2026-58469 https://ubuntu.com/security/CVE-2026-58469 https://osv.dev/list?q=CVE-2026-58469 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58469.patch | 52 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.21.4.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch new file mode 100644 index 0000000000..a86d89259d --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch @@ -0,0 +1,52 @@ +From b33c317397db195f9584082be835f051d56bb163 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:32:02 +0200 +Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer + underflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58469 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826] + +Signed-off-by: Amaury Couderc +--- + src/metalink.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/src/metalink.c b/src/metalink.c +index eca839c2..10d58cf7 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1041,7 +1041,6 @@ void + clean_metalink_string (char **str) + { + int c; +- size_t len; + char *new, *beg, *end; + + if (!str || !*str) +@@ -1049,7 +1048,7 @@ clean_metalink_string (char **str) + + beg = *str; + +- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (isspace(*beg)) + beg++; + + end = beg; +@@ -1062,12 +1061,10 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (end > beg && !isspace(*(end - 1))) + end--; + +- len = end - beg; +- +- new = xmemdup0 (beg, len); ++ new = xmemdup0 (beg, end - beg); + xfree (*str); + *str = new; + } diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index 6d66ab46d0..031a9b3eff 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -2,6 +2,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ file://CVE-2024-38428.patch \ file://CVE-2024-10524.patch \ + file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ " From patchwork Wed Jul 22 08:24:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93132 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB6C7C4452D for ; Wed, 22 Jul 2026 08:24:42 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.57]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43256.1784708671868398014 for ; Wed, 22 Jul 2026 01:24:32 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=xgnU3ba7; spf=pass (domain: est.tech, ip: 40.107.162.57, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lgvbNQNBCWU6oQZhzS4bDqcKXGiLne7UkqgedwwBPLcSdDh2xc83s+uEiLqQkMRRTrJN+MCgfjTmeUMRJUsnD1NPqxNJVVo6h7JwuqJuUiaGmL1I0bZC8YUpa1mz+XFQqEDvINIQiXkQfZ+JSIYvQe1axSukXIZdaBZ/jsdYY4gfA18GwkO5QCSZQN4fo+RNZEVaa8MrmM6Rc6dAtmVqUjDklq3iEox2cdYO64Q42hSc7zRkGEfBZfrijfI1d4vgRcCvGTVj97u+WgOO9VJvszJ6LBCLlOTlUwWBUzoByAcEHI7++NWh9TGn5OlFha/9ahLQDpuXf/+7C5venenHng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OllrhwbH4Kb4vGIqT+ydnVVGhtgEajXeld+OEI1Wvmg=; b=oEJ2VuioHRK+6ht3p0Kr5CsjkmD1j9IuHcD72MTdNiyqXjWoqNg4Cqpl3IFtF/Zi9XgxuyNs+0FwZ4IGFXhUpj9EFVFbrTib/ObnJd5Hyz9PqN3m3+RvLBmSkrnYouhekKPCTl4oTx64/ftFnr/3YqZ9ocuGPgL0uI9hnhW8AXBGZxCUPHui3EUlAVLkIYkTFZ7pfKwDW/9WJuvLQGsQVPRXSupqTx/45azaqhL5X+M3dSDAB0bdAbkG0trJDdvJoNyv5u5XxFEy/+ErAPG+pG+qYaqHKxQ908lThjiKaL2+o4voYX0rNINT9udCarMvFcjwpvK3Esg46elNhvb4xw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OllrhwbH4Kb4vGIqT+ydnVVGhtgEajXeld+OEI1Wvmg=; b=xgnU3ba7uqwbXZZWxw57JG8E05R5mO/wMSf34JXqOUgm3O5tFB63aGsgJHFGgbtUsHQxOOXeVtatvMROPQIzFXo7hYxuAQPQb3utvp/17HlO+VLGZXg5ZLYkIirQPzFLFxQ5iQ6R56BlB221vyVJ237bC2Gi4iqnbkXANts6VlXHoeN6rJ+t7jAruCCm5g4PI+3f1noJqyJ29wZUU4BgKBCu6JPrEUIJ0SqPDTEr2FDZrf/GOAPaxLbJJ75iUAOMbv63DTLj4y1PkG8e8dXAuqEE3y3r3mtOg4y6m/uDw2lUASGEX/9IMYgNHotvKjSXaIZeoeCXRggEBc883nTRqQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by AS8P189MB2420.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5a0::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:24:29 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:24:29 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH 3/5] wget: fix CVE-2026-58471 Date: Wed, 22 Jul 2026 10:24:15 +0200 Message-ID: <20260722082424.15496-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DB9PR02CA0007.eurprd02.prod.outlook.com (2603:10a6:10:1d9::12) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|AS8P189MB2420:EE_ X-MS-Office365-Filtering-Correlation-Id: 665eff08-d957-4625-f5ab-08dee7caa655 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|18002099003|11063799006|3023799007|13003099007|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: Ve49PhRsg37Yzxvcm41KNpPmRF46mfxHX+uheULkbwAv8rN+ta+J3CtBiY9Ybc+A25W6NBVRlm56PExqspWVJQuf3Nt1R9ZqRt1O5OTv0TB8VD3EbixKpUD8yFBL7cA3hjxq5p7b7H2S2iTp7bPOHt87OuXqTnjBzequ+gzGEHkUb0aKXRaQWoTQfjStq00sTNIXcA3RyHdbdvOgEjJXVOG7V0yreFy0OhWNIV5tq7QWc9sH0slb9Te68T2nq0nM6vJ1HAwHYk/iZ7rpmkKMdxqSSbaCgmZfN4Ds/aXrN+15nXcDyum9sOiFRO9aC3oJaCgIvWqdHtJ9pIS6cr+fpdM+n4Jgir9isFR/wPUB7leP0QwpxbegPq36ln0sNPvkM8JIg7oHBj8pNO98NKgIletTuSUwm/3WwaeYQEtijluxQHOYfFtcnY0cTRvVXe/T+TtIS7yZIwWSj6snVIaif/FHpcNaReKYs+Bc3nkv57huKT2PdNhWUWNwXiqGevqTJaTUvyxMx8sT61jU0DezGADtBq7ZkL3CSM24N6a9YMrg8SWM+oOVeOO+t0uZ4YxDmW64WJnCbCLozi1D76f9Bs4DdySnhiKg4QU8jMjMrDc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(18002099003)(11063799006)(3023799007)(13003099007)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: cXiG1pg7+Mdk0sp9r3+zpdGg5QtJqUZAml5fFwELH4UnYeTHHgOAMhupStjmTf6l9edXPCbxEwbIRtA4B+eZJw+Mg4e1a276Ci9Y6j0+BOVaODKi537MOMPhB8uEUyyYUtn1448GFttvLjtZum+lurKGsRBhet0+2WIwtxn24+feaNemBJX0f2NJCd6cLYHR+3bSSuCnJKYKnfHN1Ob5E0Br4+6f3P1icKgBa+znoiW9a0KWT14JicSG0ltCxxbenWXbI1ZdyFRmYvRneABZRZ9Ksci+jB4d+aEALjJLy/wI1nIzQ+NaaxBvw1Df/wrc8Cbnunk/5Rn0HdOO3YBNY9ocbooHDdWDGpFHPtGxK9IML2Iz9fLVNs9d43iEblA5wxfXZfD5aMIuuBzM34LggkCTd1WkBeB41aYGnsn+y/w0P6WCHy112k0hrKaW+Vb7DvFtVkiNTy8O0fHMCL2D06JssEeZ0BGB2M8S5PyTKXXIEOR9Gtvp7Wu8ck11sWrCVP/GTLNjeLEuocuwa9eM8eIG3qPyEq/Aar9eD31ip2r2xqERUREqOXDiGuAk2OkvoGaxBqHwIqu/6Xrt26V44YBzhw924AHTbx1fC0CqDngeBnxZMfE1+zOh2G/0iUvaYZIbNH170dIdqDz2zcOBL9n8+ovi3jqBaS336DGurMcIln+HTYHXFDQbjd7HlWhGr2TLzmn8ccKswRVQYy5tpKXscKF/4aKXNIuEny5422sgS+i+Uchl422Wj6zoMaCYxXmbU8GevC5Z/st1S6VQjxODZFwoUH6xXXswL4Ud3CIgKP5np78yCr+QCLVEs8ys51fEtrafdzthqbAGevD545T+MhLBhMcLVmYio+jXjBL7lS/VO1aaOGeSXUle7BRXTpfbb1aTTkRXsexY0jw91QaPTEo3CXy+3He4plD5ILmD4Oulp/BXR+mLdLhB+lLOMW4qTZzcS+EB/5EsFUMfUVRZyJ0bxk46PWZjKpuUMXSyAdedOq7RdLTmUIyg61OUL3TbimHojRoKTfZzmWVCvvNiAwxTmZxI4hxhYMA2tsFrJ36r4LsTeH2Oy937uOwRcH9XD0UJ/B4SMv9c2gdzwG5Wo5vGk3y2atRRA4v4nKrByWUfRAbRoXa0TGguylA5Xbn4evMeTy5fBUHgtQMAfHRlVFvfOoDuYNnR05Wd2kVOtCGTH90sXUO+bLbkD4D5d7wQl+YZh+hdwILmi1k46pYOuWUI2+hDiPt10AId4Wms3CuLUwm3e4Fv/BmsY7XBGDUdFuMwvlXBzYBwvVH7Baq3ERaCvr9yLBPVhgjbcbVoJYB6tQ5ftmg6uW6eGdYoHL9RSfaFpHZHxHE12AZnShbciEwtQLnTsWKQdStohA50axv+vo9zl60kvlB2s0RUuFPfyf0en/tFXT/w0eqB74kH9GtWJ7mH5gcc0nxxUX/9OANGzDKnkqwsJFrKZ5W4g4HT0Tuh4gKiUEunGyhG6/vJyFviU5n1QOI07BV4gCXbg1TuS7Org/XSKHlmH+MfuPG3uju3wa4qLcQV6UtuWQ3re+CIWtaC9KCnWUwG190B6Y8HD2yo7sPuiszAlWwpfj0N3/BJaCmKzaf8RtS8S4x/KtKV9JdS9Tmc86kdPr/dU/fm7f2Pt7uDxb3bhHGRF/JtpPwpfOV9zHXqDhrlLoZMg2Y7en5L6ozDtgXYjvN+XenSjy7g+3JDajenpfR4KHjslWe4V6H5WYoXwhwZqQ== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 665eff08-d957-4625-f5ab-08dee7caa655 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:24:29.4231 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: crLhYgMYiDgvKruaA7FpMEQLH9sAmB26rqpjsSV38WnQk0YcNQByDzOujYL0MfbHDwzE7MD9yIUcPx8vJXlK7A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB2420 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:24:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241623 From: Amaury Couderc Backport patch to fix CVE-2026-58471. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58471 https://www.cve.org/CVERecord?id=CVE-2026-58471 https://security-tracker.debian.org/tracker/CVE-2026-58471 https://osv.dev/list?q=CVE-2026-58471 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58471.patch | 70 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.21.4.bb | 1 + 2 files changed, 71 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58471.patch b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch new file mode 100644 index 0000000000..679ca738dd --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch @@ -0,0 +1,70 @@ +From 70abbfebb48ea9d2f4b564cfaf1e9e417edfb449 Mon Sep 17 00:00:00 2001 +From: Arkadi Vainbrand +Date: Tue, 13 Jan 2026 12:22:04 +0200 +Subject: [PATCH] Fix buffer size handling in filename conversion + +* src/url.c (convert_fname): Fix buffer overflow. + +Copyright-paperwork-exempt: Yes +Signed-off-by: Arkadi Vainbrand + +CVE: CVE-2026-58471 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee] + +Signed-off-by: Amaury Couderc +--- + src/url.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/url.c b/src/url.c +index 68688256..6a9efe88 100644 +--- a/src/url.c ++++ b/src/url.c +@@ -1603,7 +1603,7 @@ convert_fname (char *fname) + const char *from_encoding = opt.encoding_remote; + const char *to_encoding = opt.locale; + iconv_t cd; +- size_t len, done, inlen, outlen; ++ size_t len, inlen, outlen; + char *s; + const char *orig_fname; + +@@ -1625,7 +1625,6 @@ convert_fname (char *fname) + inlen = strlen (fname); + len = outlen = inlen * 2; + converted_fname = s = xmalloc (outlen + 1); +- done = 0; + + for (;;) + { +@@ -1633,7 +1632,7 @@ convert_fname (char *fname) + if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0 + && iconv (cd, NULL, NULL, &s, &outlen) == 0) + { +- *(converted_fname + len - outlen - done) = '\0'; ++ *s = '\0'; + iconv_close (cd); + DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n", + orig_fname, from_encoding, converted_fname, to_encoding)); +@@ -1656,10 +1655,17 @@ convert_fname (char *fname) + } + else if (errno == E2BIG) /* Output buffer full */ + { +- done = len; +- len = outlen = done + inlen * 2; +- converted_fname = xrealloc (converted_fname, outlen + 1); +- s = converted_fname + done; ++ size_t used = s - converted_fname; ++ size_t newlen = used + inlen * 2 + 1; ++ ++ /* Ensure we actually grow the buffer */ ++ if (newlen <= len) ++ newlen = len * 2; ++ ++ converted_fname = xrealloc (converted_fname, newlen + 1); ++ len = newlen; ++ s = converted_fname + used; ++ outlen = len - used; + } + else /* Weird, we got an unspecified error */ + { diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index 031a9b3eff..6f6d02bf84 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -4,6 +4,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2024-10524.patch \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ + file://CVE-2026-58471.patch \ " SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c" From patchwork Wed Jul 22 08:24:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93134 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4B52C4452D for ; Wed, 22 Jul 2026 08:25:12 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.0]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43265.1784708706170883478 for ; Wed, 22 Jul 2026 01:25:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=AZFhlIHi; spf=pass (domain: est.tech, ip: 40.107.159.0, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Bu1P8HaAr3klfLXdY3nG0clKM2ptzpaNiw0kqzq3X+lNt4g0itK6KH++lawhnEsXmTVA58+di7QZNuSTk6+y9yTb3+8rAWrf/PjguQEdRxlv0bBUgqqyMRbVQ2/v5pXsulVa/aEDgRKEwtHSFzrgRS02YaUIJWEQ9kPqzZW4CvYOWNFu0xH+3otdY68MBsiYTnT5BNkohczD5Pe1NKbvIN8PE5QxNZapJtUznuY+Hn2UXDjkGVdqbaGBxlBj+BkuYSmXHBUtV9MN151wyhAxbkqco106B+EU/5qIcQOlDkarbLFxXsA14j88MukPYm0Wk4pdPXH5kQiE1z40plsDiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ap5IX+EQ/XT2gEq0S4uXnqRPiCPh5oQ7U4x/cIbW2v4=; b=b7s3c2Z2Li0mvoJ/1mISiFd49eZlTRETJbaRbbtOD/Wzmm+iirOehVMaSclge3sSpHL/Nh76sxH70O5mmxNgp1l/4poXFtFYXd7y/KOM+g4HM6u+Gud/NgXAmGTk39GLvwa/KKuLn0pK1pdDoGRK0i+Wr4ES9OGpVbC5L+8bg+Fjl8Mt8+fAlNKiA84/yU2gVKtNVoW3DodDjpvo1d0cPsM8DxJEhlviufezbEgDldE2qzWFOoBVlds8Fn9vsnuQSQSnnAQ1MOfXFG4KpP5EMNgcPf1eOkBUO2H7Df5kP9C/uF9ZzvG7UgfMbWFFaKWsL9HgXoD4I8EwSO3UYR88Sg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ap5IX+EQ/XT2gEq0S4uXnqRPiCPh5oQ7U4x/cIbW2v4=; b=AZFhlIHiJSVwz3qdI7iiwFCcNMvWSmhMN+7I4soLY/zS0sPhUxmWdsZluNOk+sSgM+7WU6RW8wCjspfzPAMOxoOVHahhmL1YDdjrX04J+6JihyDJ8bBaqeRUBcfrXp6fuRb87rVz0AkRTx5jgRwu/hH6Isl6y7roqghR4zH3yS0eCQGD5ullNWM38kmqWJWPjd1ycz4n9186liqansIv3TJajr7aRcBIq6jW0TN1/Z8O9OWshq2AxdwN8z7BiQFI89pjB5NkEGT/TJ0XQvRqPM0tO+lm6SHdDrufCVB7QA7Hd9gb4HQoVWvtCJkQw5nb6F7Uvhtvk1SyzMUZOFOpZg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by AS8P189MB2420.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5a0::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:25:03 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:25:03 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH 4/5] wget: fix CVE-2026-58472 Date: Wed, 22 Jul 2026 10:24:47 +0200 Message-ID: <20260722082458.15574-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU6P191CA0030.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:53f::9) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|AS8P189MB2420:EE_ X-MS-Office365-Filtering-Correlation-Id: fae58d5b-3237-4d9e-f375-08dee7caba64 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|18002099003|11063799006|13003099007|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: 7yjmIFvwNYv+19qtUOG0xaq3Gu5zw4vaOLBDuRXQF1TaHHUstRCiL9aXKaywi4C4qXzC328krVvzmCWJzhWe1gRqz1G+yddWI/195VDS0+7h+Py0t8x0I0fbUQDrQzY0S7DMzWDegV8QYiLd/6/p73Fv7r61WH4kQg6wL0kg6fuEcXDJeqomONruPrTe6v9gbxbd052eBnOZjdrHEEWSvxVtefbBgCmhTURpf1IhFE67mQboR5ybVXLuNlsHytziLw+HvfaCZQN7qP4RV8oiSHrEQqrpvqioHC/8r2Rd6GhUzHpZ3dUU1Jfc9hmWMERVQ8zapL1uNLnOktJBRfO8/XO5MJdQOU9vddfUpuqNhPoOS3Mj1HTev7Xl6ZTVkENwI+thqt13vTnRBSveoBZfXYezhWYr8Ykx5IqjQowmsbeMVXGb3o8UVDpx0PZana2ItN25qIJO9c45S0nZJLabAk4xdYrCeu5446UmhbRFXCOfuw/XoHfbb5Kw7Z4MCVR9uCExKJoBvG6wCmnxnYhlFdebSNtDP2KkeJv7ukFR4WFqSvTWXS8lUj9p7x6qvKCMnnMYy3XdFWTuyeyiWix19FJEDlHG+aVdhYK17A6kbAg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(18002099003)(11063799006)(13003099007)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: XNxJ64pYCNq1t4z3BfFVigT0Vxr8QYhM5UTMrlWON8RYGrQBKDdQB3eu6U5z6KMmp2I+qO8f2QBOXX9gi52nlN9w/oc9wXUlr8x8T0RwIKB0rNseeNX3VXIT5iO9mewNFF/HqrTeR8nb7BCQMJob6UZ2O8L1aRfFy5r6TD3o3i1ij40ERM26uygsk13bZCuCmd/RbdERg4AtcMN9i+kcSH6d6KBrfPd40JT0n3QWOyc8IKnH6fR9mGwu7tcFGsmbUXsJ3N0HJSJEXDDueO5/QDfzeRYHVvHqkuTqrWZBSLllvQhUdZu38HxEBgiksnAI8AjtJq/E7cVXtm9lhriCPqawSZ2ykHibmffzn2rR3hS/58jOwq/+ZGTbB5Dqj24LGqARPi3KPdUR1b3ee2kt1Ro4qK3qZ1PLlwVNuR7Oib8JVdBNniJlgl29iwmaSfKP9wDAmaS4mTiUgBj300fV8I4z2TCYUwd7hp9aDK7a3l4iQU/w61T0+jjMdJpFeS8g64jfoj5Hl7dgLi51bIhkXcpgV1OdHAH2aS8+HwxBmwuLfnFP7Jai/Ytg8H2lCplfxmzqZpDiveIAisBzIUG+0S4kBPff8YwiilUI2xKbqzLuykQ5HA3cx6HPT+2MZV+XsPTvB6+Sx88OjE+TJ4OCnta6NwePLd6zBN10QKVIuIfTeKzqHFnBTWyCcolndbO+D3/dhsjns2mWJ85wtxC5HAsPqNhlursj5K1AhWM/8MCo7y05vR0YGwdz+az8C5PhKQOUTHIgAXrjNDtsl62xklvYgprxhDrJSna5y2/4ZdxSwZLBS1JQuoKyELbyed8FWKwE5W2DqHsgaIubvNPJ/KBoCoXgI+Bb0u+QpBiub0awkCYoJZ8r9hbCYeN5mtF71+MD8eq+oH2tmfXNAfN8hXw76OhWstmTggEhmzD1TMG6lmoyGeiXpfwHTpNXjQ7xIZErCLqSkAOZw/L+MskqgnVi70H+Sf+1Qph3IifWnLWPg2rnfie7mzc5aMz2LSZMYoK75mvq+eLHudSvFm2Op6LVhLgG86fZ57ymZ/22UXKLDGKqC+35BDl7FTGTxGWkszUOpWUyBAIUGovTr/MYFPeYhEoXO6a+wNuc3B4lCL4uLRuIcStxJpVXFZgjhTajiHcfld2D3QLtYrtg2xfv6CnDm2K6+0D6tvRgV8qki2LYqm75g1dkuy9L+Pq4tHddJxh4Y6aKfkMe6nldsY4sneoNhkRWcDk6gR/91E3nKChdF3a8slSlo7DMnPevYYFoZH0WEgjQD7i5SXo1gSTGIU9jFdbgy/AbTrCu6Tj0ee4HgQe+IsO+mex1hGDRIk2tdG9dL7b8pIY0A/7IaXT9e6qM8+2l+XatCx/UKSBoj9zHkNqtc8KY47B9C07PNKt7J+9fa1z3wD6FqFD3y8OQysUixCt/zsDe5kXMTiiStMbLAOscsk8tBo6cgKzh7ZUxHRYHfrtEisrFloIK0b1cAC21G9zIYR9E1IyWbFDGI2/jpzEIgSOKXmNBqDmwtP5oKxFADFiDoKMqVPczahDq2iaZlZLztKWFuZn7uiUU3vSMPvitBSGVe0JyigYU/8OwyTKnWJprUqYdfmBMkHygzwBivR8GBABB9bouKl58KjL/2OiwnW6GtIr+bP9Y+SuwRRM1Y2X8KxLqmrQMXUWrfK0jMCHYSzjLgWLuiGL9VL2dc2OpzHIaaxtQrjbD0XZsX83KL7kLeXOEi25HWlrU7w== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: fae58d5b-3237-4d9e-f375-08dee7caba64 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:25:03.0491 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ftvGteesDr1fDF8Wm4OqglEg8aLcTCNtkeEvoq0ko6l3qWptWC8zzpRkWPUuwe/+csLj43mFqLlgAa7qXEvqPg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB2420 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:25:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241625 From: Amaury Couderc Backport patch to fix CVE-2026-58472. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58472 https://www.cve.org/CVERecord?id=CVE-2026-58472 https://security-tracker.debian.org/tracker/CVE-2026-58472 https://ubuntu.com/security/CVE-2026-58472 https://osv.dev/list?q=CVE-2026-58472 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58472.patch | 73 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.21.4.bb | 1 + 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch new file mode 100644 index 0000000000..96d01e735e --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch @@ -0,0 +1,73 @@ +From 132786a69d88d8afd376fa2d0193b47a54396533 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 19:13:15 +0200 +Subject: [PATCH] * src/convert.c (html_quote_string): Fix integer+buffer + overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58472 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812] + +Signed-off-by: Amaury Couderc +--- + src/convert.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index b934d49b..51636340 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -36,6 +36,7 @@ as that of the covered work. */ + #include + #include + #include ++#include + #include "convert.h" + #include "url.h" + #include "recur.h" +@@ -1169,21 +1170,37 @@ html_quote_string (const char *s) + { + const char *b = s; + char *p, *res; +- int i; ++ size_t i; ++ int ok; + + /* Pass through the string, and count the new size. */ +- for (i = 0; *s; s++, i++) ++ for (i = 0; *s; s++) + { + if (*s == '&') +- i += 4; /* `amp;' */ ++ ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- i += 3; /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- i += 5; /* `quot;' */ ++ ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ + else if (*s == ' ') +- i += 4; /* #32; */ ++ ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ else ++ ok = INT_ADD_OK (i, 1, &i); ++ ++ if (!ok) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } + } +- res = xmalloc (i + 1); ++ ++ if (!INT_ADD_OK (i, 1, &i)) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } ++ ++ res = xmalloc (i); + s = b; + for (p = res; *s; s++) + { diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index 6f6d02bf84..24594b3093 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -5,6 +5,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ + file://CVE-2026-58472.patch \ " SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c" From patchwork Wed Jul 22 08:25:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93135 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3A0BC4452D for ; Wed, 22 Jul 2026 08:25:42 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.62]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43276.1784708736089901582 for ; Wed, 22 Jul 2026 01:25:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=UaTWZhik; spf=pass (domain: est.tech, ip: 52.101.66.62, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UpFQ2tUv7iZJrte04fdwlEIV9vB0SojjCF2J9F6i1PY8KGU5pgDcvlovW06ol1V0x7cIxo3wt0qPz8MhzauAGrZy1d3ioME7ID838OF4s0Bhb5FtxqBI/kdO/juNLuIciYVzUy+8SbSPlZ4ElddARCJzyT94HpFESbEO/QMdGT93575t6/UPoKIrT9PVtiJf3G46rGeaXV00N7MOAEQc9I0NeLbXAo7/WVdrnXB4U6ZMjPGUBfLrDmoRYeR2U2pt9uyayCH/iFBrLpvs5+RrrgvyVrv19RTYj0bJv3Inx8Qwi76XrlRXhrdDlij4UWRHlBjQ9FADlJ8epHwZf9w5/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NGb2N4ROKaRNi9wj/US+TD7P6Sdvc8XMNxTi3wiAGjg=; b=RcZ2zolAACyj3xbTc8tfyAaB+JwxuDDGHCHe7WhQIsC4u8t3UWoZg2tmxpiftJdiO3v/AqCrbcPgsT7cgQgrzBi4MT7c+e7Jsf0fxKjsCtRbuTS4UVBqhTfikHEhZi6pH3ko8X9mDuqeKHrO31b3fSqWeQB5TB/DT3SIEHs503espLB3J07phjzgaB3VIIdQ2BkkpRV5IzTMTqFJ+0vOkoUufJ172mHjEslIcO6myr93wGKVUvIWcXbLE4rPHK4uCDQ4yCi8ZNYMc00KT+TlYlfhZ7VGhlu/NqszGUG0AvpsX2txrZiXGCpGvNszJ7A3jUJ9t9rth8prevGjROuZoQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NGb2N4ROKaRNi9wj/US+TD7P6Sdvc8XMNxTi3wiAGjg=; b=UaTWZhik0ZkZhgVn9cHSR3vrXN5Yz8B9iwNnHZneQ81XFE0jhLhvH/CXRfluDUhWgCCrbLBq4feQiWqHThI80MiNMo2XyGyAlM1q5wyH0FvoSvvQtN3VrrK2fJgveayxvKgZ4vV2ywau/UtFFb1h2/EkVgucpfwlDB/5LX0mey5yN1iT3eaUpOF3gcsj+nsHZI3ii0yDOlO7guFZr86mOTtCc/ONQza90UZeuWpBBEPuucpOHDScbcx4r9/pzBtpbLaX0b/qSZXHizkjUPNriTZn71EcOETrnYtSh8IQrKptPNagljECqB46SlWud/07LzQNmnj+cZ0c+WRspSZ3pA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by AS8P189MB2420.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5a0::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5; Wed, 22 Jul 2026 08:25:33 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%4]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 08:25:33 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH 5/5] wget: fix CVE-2026-15146 Date: Wed, 22 Jul 2026 10:25:16 +0200 Message-ID: <20260722082528.15618-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: PA7P264CA0434.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:37d::25) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|AS8P189MB2420:EE_ X-MS-Office365-Filtering-Correlation-Id: 35c9b678-387c-42cb-61d0-08dee7cacc45 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|18002099003|11063799006|13003099007|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: oqwhNbLc+BmAvu4q2abQrkPtR/4VJH7SP9Hi2G3wvZb6BefsOApoUJFlodrOwsPAvROFTgVSK3Uf/YnbSUZ5wCrQHk74eur/pSyXq703B9pgX7B7IMctTp54l6KR/nCSi3Co6ezkHsJNNQwbviUiskQ3TazplLQ32apiIfMuuquyW8mjOc61v8A3IY08SJEOk8jmiZ8bXlkRqJMi8Bt3TCkSNTuxTXFffrwvRQifZybiEFsdbYEkjLmBzQClpb6fLEbsvB6yh4FlF0L0l31O2E1nexpFXp2+/7Rx1xtadHNpeMyZ8A6KHD9Gk6QBiDCeWHQz9UVrb4xtWgP5xOA8L5upLuqv1/Dceaq/Xu6G1eOY1nYJnPR0MwamNvuaoytOivJQtraUi4tGkpAmzwJGiDkU/kFYMVTxBbsPkadv+1QH2k3TuVAtrJ9D/CfGAiaPZP8/fegQEfwth9VNFshRt2nI7IeesU27ZHud+IQKg6Eg1on2QH8xK6pn/lLNlY7TX9DKJoF4VOOdi8BARLThaLh+sA71aju0kLBEZmoJLAEnoIXtBM0lTwPeP8WmuMksEwXfWWXjYG8Ta2mi1gDezVka+F5lh7D+L1iNRT2mA1jopOg/QlXhq6a2JZta6CF/3QbF9dxFXHsPDCNPAxOrppZf99TxjsiznB93EBe0ZpQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(18002099003)(11063799006)(13003099007)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: cF52eglOU4ykj6rX4ubC8rN7pug15L3SAU5EMMVKvD6qSK1oW+zcSCY9zQ2b9WDmY0PYiwlRC9vmdZSr7SqBWxBItblUq8FPLwHlo1yjYhKAWekGSf27hpYV4CEiyMinV07JwvXfb07totscnQFuDZyRw+qmvSQJgpoWjftDA8wfDQ7FtdZc9xAVwb/L1tWlJzhttZ1AMdPHcTBojCsWy4mk/yHlStg6gMKSZ4J7MRUf52voB85eg9nzkW05zmhEgzYotJxu2WuetwbaEoWo5OSEYZ5Z+Xfku4mxvK7uwyHjuph+y/k+c2AfUUkQx+5WMaOpJ/PtvGXdcdtrc8hjhx11KcWwVl2LkfG302tHSb6t8VDWfY5f53ZiDfNzTihdTv5DAA5uPhHTmpYwtgZ5ufsoGe87FQEsQ7cjPaLG5MR2FI1Ct8hFL9BixUcE+9altQYxUqR6B9DJ5n/ecjq3hG6nrP5+9Ibw/X4V7s8AR0IRMSRKg6vVoZwtj38AJMM59/hbSI46Geji0qbk5AeIjbbRByahEiiliHcWmMRk+DW2x1SF4wbUodDQuqEGSZ6TDBFqy8AFEzUbl7E63/A9j8ad5Yx3JcIArINyka56cUsgfPutsctuxk19WNA4ILf87XFy1CwCREUjf0tZSrnWlNR7wU8eb6Zd7fJJC9UPdwP/9J4QJg6IYSfXJX5dQNu/p08GR4e0vl2iUgnlIUPt58oeOoVOQT+RnnM0Tw5/h0BpcjAf21nR/vdArd9ts6SIChLXMp7uTNvi5XfnDq7xh/7vFQlZI0lYdqPofFg1YSUPTVfpYplwAg6rHmAvHpyTTvw9c2g9UGjxAVDyW7ROKjNBpTiynDkT5tG4gS6kvE6u2cTvnvmbYbPeyUYf8rTl0sRhoQCciv0jbwLE2kduEZNKMrIPOFH/GghNUf99ACEjp844YyfUdvF9FZEC1eP7Z7d56/TZ7gikoPtak1iwMZbsonRU8MsUiB6/gO8reRl+X/JSXbwFoLT428Ef5d2iv83iZgwl6wJbljgo/zNOxzDGBOTLkbMd7dJ6nCWX2piE3vhUmy+7isV62q+7kITT+xlmKK8182MWRqMJi3ZwWhL9voN5JowiSBC9tEiKSKADhaNdkoqLeSCCv3XpoJWW+aFMG8ticR+hxtOOAmbZRr2XcdHBHLSTRmOysvlg7DL1C5bLKKBovMsP+uZM3xzdQBlWI3b9TrnynLaulQkSvQQ/fIYfxTV0TSmsRuIDTwC4biOLvPobqwhfGFrJ1kjjVsiCMZIEVjBS4xA3UMKlW830kOB/WCCDxoLauViGWEF0smv+n2Vd1IDccPMOjn7Yv3a3dHnPtV7QIP8wAPQXk2FTlr7vEvUgUFflb7g0mGLjGacmoMlICnUd0uUsoFl42qgH6/Adzfx9wYatvHS9OaCfYW5jJ1XzWW5X7MmdPf2E7QPPJlQRc3a0SKP+ferW9fXHneM1aRlxxudTwBCL7UCOY0K1x94TtP/ZRaXVw02sU+Koqg9yHZl/JwMjaiK2qQB5do7JKARLPshCtT4p513BgA3Ix4NQ/tQ4C+WF+PrlASFN3lMGLQCqzqJkmBap3r/qy7cGNpxv1+pRMHORAa0IPwGl9lDKWw1H1LAHnfW1HcSIsTguB3UQ5nrkGXuDITOsOwiycFCSzw2yndHzoyvzVnKjJL4ofY/E6+QjuwmMHEfrRwz41wDRGVHx12FOUw5AN6nyZnSxzUuh4WuEpw== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 35c9b678-387c-42cb-61d0-08dee7cacc45 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2026 08:25:33.0367 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 71VTKL6/hZK4kPtx6/RXFZjWqGlQ5uTCBPKhLWPMkU5q3mlKdXTufvM6B8DtkWC42e3g8/q72a1gYYg9j9qNaA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB2420 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 22 Jul 2026 08:25:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241626 From: Amaury Couderc Backport patch to fix CVE-2026-15146. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15146 https://www.cve.org/CVERecord?id=CVE-2026-15146 https://security-tracker.debian.org/tracker/CVE-2026-15146 https://ubuntu.com/security/CVE-2026-15146 Upstream fix: https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b [nvd] Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-15146.patch | 122 ++++++++++++++++++ meta/recipes-extended/wget/wget_1.21.4.bb | 1 + 2 files changed, 123 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-15146.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-15146.patch b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch new file mode 100644 index 0000000000..3c1704fffe --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch @@ -0,0 +1,122 @@ +From 89e62f8db81e8bc09cd6eb79a4f52ed75aa0253c Mon Sep 17 00:00:00 2001 +From: Acts1631 +Date: Sun, 5 Jul 2026 17:22:55 -0400 +Subject: [PATCH] ftp: validate PASV/LPSV response address against control + connection peer + +* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised + address, + (ftp_lpsv): Likewise. + +ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in +the server's 227 response without checking that it matched the peer +of the control connection. A malicious or compromised FTP server +could therefore direct wget's data connection to an arbitrary host and +port of its choosing (e.g. an internal service unreachable from the +attacker directly), which is a server-side request forgery. + +ftp_epsv() was already safe since it only extracts a port and reuses +the pre-filled control-connection address. + +Fix ftp_pasv() and ftp_lpsv() the same way: capture the control +connection's peer address via socket_ip_address() before parsing the +response, and reject the response (FTPINVPASV) if the parsed address +does not match. + +Verified with a fake FTP server that returns a PASV response pointing +at a different loopback address (127.0.0.2 instead of the real peer +127.0.0.1): before the fix wget connects to the spoofed address, after +the fix it rejects the response with "Cannot parse PASV response." +Legitimate transfers using a correctly-addressed PASV response +continue to work. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-15146 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b] + +Signed-off-by: Amaury Couderc +--- + src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/src/ftp-basic.c b/src/ftp-basic.c +index d999027a..fd87578d 100644 +--- a/src/ftp-basic.c ++++ b/src/ftp-basic.c +@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port) + int nwritten, i; + uerr_t err; + unsigned char tmp[6]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the PASV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port) + memcpy (IP_INADDR_DATA (addr), tmp, 4); + *port = ((tmp[4] << 8) & 0xff00) + tmp[5]; + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != AF_INET ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ return FTPINVPASV; ++ } ++ + return FTPOK; + } + +@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + uerr_t err; + unsigned char tmp[16]; + unsigned char tmpprt[2]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the LPSV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + DEBUGP (("*port is: %d\n", *port)); + } + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != addr->family ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), ++ af == 4 ? 4 : 16) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ xfree (respline); ++ return FTPINVPASV; ++ } ++ + xfree (respline); + return FTPOK; + } diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index 24594b3093..8d9923e7b3 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -6,6 +6,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ file://CVE-2026-58472.patch \ + file://CVE-2026-15146.patch \ " SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c"