From patchwork Tue Jul 28 10:43:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93726 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D06BBC53219 for ; Tue, 28 Jul 2026 10:44:17 +0000 (UTC) Received: from DB3PR0202CU003.outbound.protection.outlook.com (DB3PR0202CU003.outbound.protection.outlook.com [52.101.84.14]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8613.1785235454301242327 for ; Tue, 28 Jul 2026 03:44:14 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=Wfb+wTZG; spf=pass (domain: est.tech, ip: 52.101.84.14, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=GIz5K1fFoMnlhNjF3p74XiALHi3Jw5IQMsQbxJpz6Lt5RA4VfA+ktpfENkKUBmWW9BXOAuS2mnjpp9kxal2ikysRcNYLn0aA4PuyNxZfuyH+mXKrxaAKsOd2nytBvpYI7WR3arRPLxJgucGttr4TXAJp/Z2/DQsiJAcbNOrpeAPuPaa+gQasS5W1/thFS7eT3qVfY8eSy/TI8h3pzxt8hULQbd2/Z+rfVWT+Ozk9enm56pbTJusGuUNHmk3DVtbbAVRJ97pOCl1CI+BLcFLA6cfZHItDLspu2RMCy3c/1mgiBaPSmpGDFy5XbvkvglRibqnjLg1L9E5MMfwaamZA7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BXfWJ07dvLEKpM455dx/pFovuGqsUHpIbra6+PmIVXI=; b=wL6n8VGpU59o9GUmNxsn7iKxTx3dR9e/j6jCYZ20yPVOSzEfeH23LisDmmVcLxljZwgCyUnpxcK/ev6mTzSOyE3CtPKnDqOK7NBHoi2FQFsmXm11f5rPxBmIdyduo3cnL9vOGoQsq5QEsD/fbpl8ChfXiRuOp5MI6HiAu4GUKpdhVIWBm67NOeAHFtpj/7vNyzejQGm4ZvO//Ifq7tx1xVNAsRK2xOr7DxB1GxyxjNBuSx47fnRvozqr+hylBLKc0vpQh9h1EuO+e1cbX6Ms4NrsIk5bgL6FoTPsCiFPSuDUU5RmvVx7AXUPeOoERhvBF8S7QnY1oR6dfpNmN6vlxg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BXfWJ07dvLEKpM455dx/pFovuGqsUHpIbra6+PmIVXI=; b=Wfb+wTZGDgfMREBgJaAbwyke1zD805cBrn7Oo/0JFFBldHhCxA710BaUhpj+w/fFRneAwCP74eCR1RqQEStI4oarbUabFr3gKVBmwzkHiHLbFniyy1ZDuiGT5fFrww95Le05R4DO6jTV4Cj8iAYWz6B/x7WWqge/Mq8YD71wPzSBik61uSgEsNlWyo9ki46xzzT4NhlpoG/tfPhqUxdNwoWz36gVsCdHARXCcPxOedufalX5vysG9boA9osTE4eMsH2sYbBLEBDZ/q3IFgGmPQd0h11YPj+wT29NzyH8UwDKf3I8FbIwn+kpbiowQtL0VU+g5AmjgDxhmX16uXTx6Q== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by AS8P189MB2246.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:570::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 10:44:10 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%6]) with mapi id 15.21.0270.006; Tue, 28 Jul 2026 10:44:10 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH v2 1/2] wget: fix CVE-2026-58469 Date: Tue, 28 Jul 2026 12:43:52 +0200 Message-ID: <20260728104404.27508-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZPR01CA0121.eurprd01.prod.exchangelabs.com (2603:10a6:10:4bc::11) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|AS8P189MB2246:EE_ X-MS-Office365-Filtering-Correlation-Id: f0a4e67c-ba7c-4057-bb72-08deec952819 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|1800799024|376014|11063799006|10067099003|56012099006|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: JkvDdzQ5ACsFAlorp1uBytZipfO+H1+1bJMUwCdA1jeAApmxA6uh7N4WHzPeXIKtWKKwNgPZsHEt3tMzoee+/kz/cX+/qwQAoY/JAIhVa9LS5xso5HSUqOdnuBwIVotjAKd2yxJIW17cI7Dd0xzBVcw1PRSDdmnHXbNMqrbuJBmMLS9VWeRCkEsnwy3zJpF2KHFaTLyjVqTAzfjZ4pGAL7ZHYv0HLuN5HbvodSiWvFnTv6AOHnBNX6UrwVyg+HAPG2G6zq8609YLbVIFlZppw0NMRpndltltW5Ev/4JWsT4WcW0q+W2L/iQOHw18HudOX3eqydnu7d3tF0qltJA/Kjv/QsGo36T0oveoWTTUozOOxmTsuo/LSv/uLY7OvnxtUTDvcrrQZdNcEB4uNYay2M+VJs887Ml3QxbRw4LfITgClbybF+GQTCn77C6u74tjXTM/cojZ+/E86pwcytvd6wlrjSgpRo/LekpfFpWA4ocbBmqToD24L9EAr0HcW0Cyc0cXdYROUVex2RDhB/IsddG80kmWxA2tSVyKkSWH/CjHP3w/K2tSjIynJta4esaFTKUBuKhbdajUt+5i6JHkBhP7H87fcHIbcwHxqxlsHuMx/H1fNFFXbHJn122Kgkun X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(1800799024)(376014)(11063799006)(10067099003)(56012099006)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: w4TeiqeErbq2wt5ItQV5awisyVCM0/7TjidExwYYm+SvJ/AuS/Nk3ORN3O7zkfaBGoFAU/rQFXNtnePBo3tO8PVNeI7jnuEm6kxBN7x+xPOFKT/jeEdzPb2xYlF0den/0J4C+PjHQbic4r9/FeI41hJjnwMxXrG7NZRKaGb2fyRKoGGsAPEDvwjkP54Byub/3DPb1Xh5jXrO4nexGTYUWVdLgbJc/kieNNWPs2bBZOch2ZwC11LzbLgUR7zy7PC3vAUVB+sPbE4fdtU2TD/BnSyMQa5hGrxcutcGSkP6ybhBsxaoA3x9URnqK9e60uFfRuIXlpqUsIpExe9ARz2+segJKKCImQjDHeUFgTvdkbT7BePNot6/87t+59P9xIlqhIj/DCOZHbBoZx3NKW+32MrJX2tf08XNyyq6d+nfbdH5nilg9ztdPqUvH02Y5JtLvNikbekOZLtNFVsA1LLaga+xXX5d/G0HylcabeOeEvZTtVlx5nOdmsy7IfKhql+89KMyCTg68eHkeLKehpDFD4EeVrTq+PGdZoaQhZzAIq5d/oCfQPd0hQ7pQa6N+MIsBjUXv0TBEok+77dgfviuKDm4DjL13MmskPa2pmjQ2OHUiK/WDpDra5MKi0XPllCkJH2FEX8+fGRt4vYdq4rj8dEGx7bFgLsSEKyZNizHYvdOKUv7ILxenQM7wqgUFupkhzVUf1S+xoWOpf5B9P295WhIJqQWkX9xYY2PEr6WN1tpWmTkiKccww7sgbZww344FPFMvAuxrZkQVagFsMsufzU9D+yCkaNMgzrdEM1On+8eJ2gDP2yc83+bh6Tsjbv6PSeOWreDXyi686uhhUbeD1wiBZF7E1L4cYH+VvLquk2CP+QjvnoYGJeJaLo9i30yiAsnVVIB+2u9tv9Z+/lg4wXvJDRHp03tuY4gTZnRNBYExrFvwzpeKPrhPk0KyNvsVaqJT1t3hEj3XMBlUlGuiNcuopf4ZYYn5TxBE4t6FdZ1nhaMfkn8i6Ta23SSn/EefrnHlB/B2vJ0jEhhbSIZLsEDzs7SSMGcBtgaYwPEGA4DIzQDwiDKRSkjAjXz/8SJRlt74UpXs3Rljxi24aZp/hLb3RRgObpLoEOJPXTYpB86xnR3VxaPq6AL9DqXNCPmw2krn4FCA+PIk1h8qY8id7qDTTvw4fdhspTEYoK3erFi1/JkGf6+mHMZvQ5sdRLKLm+vdXpN3O9Yh2lq1nviDTxjNaFmnL3+D8mskw3OFN7QDjSJAfxvaMezUQrGWyBr735kO6qg7X8id8hYJ7acthPksZLOVEQ9cEGE44KTGYuCepsxCJc90z2rFt5ctuHM+pT7ZGQq6h9NrOnjI5ri3dvO1votQlCh+Us00L9h59/I7GFknevXFWUCXWiGQ+6De1JWRsPw0UJK07h8e9/g89IfmBHbeDETu8QpRzIu4wJx5dQqKbhD6UATGb0kwn+/yJrnOfsbnTGjLHaqMkoHNlJ08Bc0Do/RldzI9dyZH9h7yx+Ts8UjAATBM5g7Mg5mBKnVLC2C1ajJHMwYjW4yKcIiMguEozu3xn+UiJhBGfvMjeCIjXK3WMbZWHBRMLC1MyOUTWD/A9uxOYBK4dDkVf2QoCgiGcxHSZarIYPx83BBCgMSqZmI4ACFncLrBd47EoCffshaFkhPOOsH17fgbXAE6dnezdGp9yEQWvJa6eqWhAyWV+Oq3S/yUePv3kbWonb6reRCjd9+nqU0PUZamQ== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: f0a4e67c-ba7c-4057-bb72-08deec952819 X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jul 2026 10:44:10.1352 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: QFyFPOqqEBe0FRDWOO4l9Er36rBTx2VwBTK62eYWPkTLWdNi2JMdPHz6Hm6GRlYvv5VSbYVvffOb1XtkUH8bDA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB2246 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 28 Jul 2026 10:44:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242181 From: Amaury Couderc Backport patch to fix CVE-2026-58469. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58469 https://www.cve.org/CVERecord?id=CVE-2026-58469 https://security-tracker.debian.org/tracker/CVE-2026-58469 https://ubuntu.com/security/CVE-2026-58469 https://osv.dev/list?q=CVE-2026-58469 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 [nvd] https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1 Signed-off-by: Amaury Couderc --- .../wget/CVE-2026-58469-regression_p1.patch | 41 +++++++++++++++ .../wget/CVE-2026-58469-regression_p2.patch | 28 ++++++++++ .../wget/wget/CVE-2026-58469.patch | 52 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 3 ++ 4 files changed, 124 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch new file mode 100644 index 0000000000..637c92e221 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p1.patch @@ -0,0 +1,41 @@ +From 7b1cdecc49bc77bde220fc575c8a00386c3f3bcf Mon Sep 17 00:00:00 2001 +From: ChenYanpan +Date: Wed, 8 Jul 2026 12:09:55 +0800 +Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix inverted + trailing-space check + +37a40fcb added an `end > beg' bound guard to prevent a buffer +underflow, but accidentally flipped the condition from `isspace' to +`!isspace'. The loop therefore walked back over non-space characters +instead of trailing whitespace, collapsing any string without a +trailing newline to "". Every Metalink/HTTP resource URL was wiped, +so wget could not follow any mirror and +testenv/Test-metalink-http.py failed ("Expected file test.meta not +found"). Restore the `isspace' condition. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-58469 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf] + +Signed-off-by: Amaury Couderc +--- + src/metalink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/metalink.c b/src/metalink.c +index 3acdc3a2..3794909f 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1061,7 +1061,7 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while (end > beg && !isspace(*(end - 1))) ++ while (end > beg && isspace(*(end - 1))) + end--; + + new = xmemdup0 (beg, end - beg); +-- +GitLab + diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch new file mode 100644 index 0000000000..d082089a11 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469-regression_p2.patch @@ -0,0 +1,28 @@ +From 82d945ff5dc9942b78b2bf736aac298c24fe00a1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Thu, 9 Jul 2026 14:50:40 +0200 +Subject: [PATCH] * src/metalink.c: Include ctype.h + +CVE: CVE-2026-58469 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1] + +Signed-off-by: Amaury Couderc +--- + src/metalink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/metalink.c b/src/metalink.c +index 3794909f..954546d2 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -46,6 +46,7 @@ as that of the covered work. */ + #include "c-strcase.h" + #include + #include /* For unlink. */ ++#include + #include + #ifdef HAVE_GPGME + #include +-- +GitLab + diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch new file mode 100644 index 0000000000..c5d3df9090 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch @@ -0,0 +1,52 @@ +From c7d858a9ca8b9840e5edc520c36fe4f33f2e9cea Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:32:02 +0200 +Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer + underflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58469 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826] + +Signed-off-by: Amaury Couderc +--- + src/metalink.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/src/metalink.c b/src/metalink.c +index de2439c9..2d6e5846 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1041,7 +1041,6 @@ void + clean_metalink_string (char **str) + { + int c; +- size_t len; + char *new, *beg, *end; + + if (!str || !*str) +@@ -1049,7 +1048,7 @@ clean_metalink_string (char **str) + + beg = *str; + +- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (isspace(*beg)) + beg++; + + end = beg; +@@ -1062,12 +1061,10 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (end > beg && !isspace(*(end - 1))) + end--; + +- len = end - beg; +- +- new = xmemdup0 (beg, len); ++ new = xmemdup0 (beg, end - beg); + xfree (*str); + *str = new; + } diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index f0d3458462..fb77754965 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -15,6 +15,9 @@ DEPENDS += "autoconf-archive-native pod2man-native" SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ + file://CVE-2026-58469.patch \ + file://CVE-2026-58469-regression_p1.patch \ + file://CVE-2026-58469-regression_p2.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" From patchwork Tue Jul 28 10:44:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amaury Couderc X-Patchwork-Id: 93727 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD214C531F9 for ; Tue, 28 Jul 2026 10:44:57 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.20]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8624.1785235487325636887 for ; Tue, 28 Jul 2026 03:44:47 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=aq1hi/qA; spf=pass (domain: est.tech, ip: 40.107.159.20, mailfrom: amaury.couderc@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HxAq6KdGFp72OCeYa/QxoJFuF4o/05erVjiPOzKVwrtqXmriQK12grjuxUMvXW2RbQ1fM56nR7syv0bAeX2JD2TjNG/4UW5NCdGmMkIcwaC5bPqeDxBet04LU3DH4PjhjBBdQc5giVkm14S/XeNzOagrtL9K+9ogxs2LCPR3O4j73OD0JafC7dgptFGRUete6be8Q6BRx5Mcd5FbbMQT0fRZLe+EaXWgHMRxC3J8elSDuKdJJK+VTy1mggr9EVU2g15S2xXB60h3pnJnueX9J2aL2jV8JgKNlyr2gMZFjedLwkiKW0oVYHOLivUf0qncsyxxZnZF+qJSomwQmIMrsQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NSCBvzkjocOLeqYuUv5sUUnqEKB4t/mo4uBnHFXdQSE=; b=xW5e1kjzJHEvX30G8sig8nuLqLZLJZldfqd2jhmiFQvywkUk3jA3cuw3/behwqz+iVWTw3JnOD4nZ6H6/yJRne2uFQTthzyvPwGkcy68MbdOV+AUNDzr4iRDCclsrjH/YtDjAlATmd3GVagnjIqEjLgE8ILSuAQqyZflh290nAlgQ+lu/ouc2fefFMz9GeVCh0rc7ocbrRppjN7is/s9p7THmyrQM8GrOur9lz3R6AzbeAO4cJBV6lwfPylcQjlqnBHYMIU3MS664GhbYnqItcPRqwKD/8HaX/2TGnLy+87d34XK5HSR5G4V76cScgPauq0g4XLg9lRLE47lcnW7CQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NSCBvzkjocOLeqYuUv5sUUnqEKB4t/mo4uBnHFXdQSE=; b=aq1hi/qAqkwH6MiDj3dlaa3jtY2Jx+XHJpvyPiNoYvlHGDx3tMyNmZ7+E6VgWfedxVxu2Ph6aDOSj7tjWLdaffUdTyN5S8zEJsnQW1HQtrNAUTgDfBa+c72owrNsGvCpKPLc+Jd4zKLhadUlpAW/l34Wy5RMmRcr/TkwntU6yPt6RIWQPuCLG7u8qOcBh3VoM36sf3HQfbnf+4iTfd6HqZEsxvRDr5bL5mMb4f0pkcpaCMAyeIUDAAuKwveSW5afrFW4xCM6FC+6iCVOlvsXqgnnMck8PYehbcggQwt8E25l5xARPn8nPRUOyw/J5sRAJSljtbZewyCe+NX0A+ArQg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) by AS8P189MB2246.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:570::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 10:44:40 +0000 Received: from AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95]) by AMBP189MB3196.EURP189.PROD.OUTLOOK.COM ([fe80::1afd:f059:542:3d95%6]) with mapi id 15.21.0270.006; Tue, 28 Jul 2026 10:44:39 +0000 From: amaury.couderc@est.tech To: openembedded-core@lists.openembedded.org Subject: [PATCH v2 2/2] wget: fix CVE-2026-58472 Date: Tue, 28 Jul 2026 12:44:20 +0200 Message-ID: <20260728104433.27561-1-amaury.couderc@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DUZP191CA0032.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:4f8::10) To AMBP189MB3196.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6ad::11) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMBP189MB3196:EE_|AS8P189MB2246:EE_ X-MS-Office365-Filtering-Correlation-Id: 35d7aaa3-97f0-48c2-6987-08deec9539ad X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|1800799024|376014|11063799006|10067099003|56012099006|6133799003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: mCL37g3oQoKkR8hGMCUKlldgND+F9H++xOxQQUzU9ZGpCtMlExv+5UmDnfObZ5TfrSY7F4nLaChk0ZaTEZrQoGG1pLPT9WEADcTx5T930FhWxZl77sTU7qVv8FcQzOkupQ8DEwUH/CUp74pvONrZiypfdLsLmLWYNIGIinSqa+J7Fcr3FVr3c+ciNCeS2np5s1FJ92GdOBOoUHgbTlcwTcy5mCzKcOX60XHf7giCnAyqKhptFQTWPOXK8sGt6hoKSaXkNuI4w4pcP51OnUYh64qO/xVWiFa57fuW/i+o4QqeTLNKRHAy2Uf5Xru0l81J24Gndgcevp+mEIQJBhwRFsswN4xXuFNCxn4m96IsJVOiEcFSULWrII8GKG9ZNVIcmTmPMBoEZrsQ99/yz/j4SNDARlmFipUy+sh6xeslBD7T/oz0Of6QUWzZcVJCoSZK/46+KY4FSCl5tjfkCQcln0oXU+RPu/kVsgxqW9Dx0H3Cq3QJfYA6sAVWsfWOVlbLl/CR2yu0HJXVsfh58CaIXqPYixRXSWPZ1Xy78JOzVtKYawbP0ujSluDr5gMaR4Dh3872I1JUICenPf01Jk1Rwp7esP+UPVR/7udR+LPDYhU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AMBP189MB3196.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(1800799024)(376014)(11063799006)(10067099003)(56012099006)(6133799003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 14bBxQCgjhOb3zh9k/IB+GIljLx0nkEIlEesqqv+Zc+J3pkEkg8pXnXtxo6zk4SMW/Q3Mqh3n5N6tSy2/JBQ22+0VHidZtrup48d7pQBegVKgCxv8CprHfJCMKtrxIEvRtD5OO8Nu3oBIJu8fq4/wO7o+qsgTQW/2Smwx/BP0do2OfCMBIPF4zBnphGNk99gYRoaBV/PIrKKSNmMrLGxno2D2hNhxvS8cXZMuOJw4T9Kr3MFn6UXGKU2lm+aova4p4trqnZTlwMoATEHxycpwIE1I02hXAzOeSNqb8N1QWwM11L6yEfY+FodGLH2W1LU7aBP6Wi7HUuuwNLiaPw6Z01mPyTJsxJatpyIxm32f5ulVutGVAvVdq6/O3yQW/Dd1QXRkdkqtWNwOzH802U05Bv1i6oovLUqIQX0OI2fzAKAGt+E0SqqsmlrQUCFNKiYh++921SS/N6fc0FAQntYcpYdbek7tlVkv1CmKVQA9g+F/voQORyZ0s0cyfmQ3rOaqfpalqzmn9NxrcfZrE05bc8dcHjvROwDT3Gy1wNrLO29XVuRddBXxNWOEGx/iIhb1nkJ6sH0ucVE8A1YMXaoKdaSoYEFY6IcxJXS/mGgrHxDwZmfj1hnZfLXQWXNLS4ygykSlVnd48zj0mx06ZA5ULjPRFHXf42+Hm51GHC8IOwM83it9IE2Bym4S8M9KfsTXSMw8Ck18chA6B8DRrymtV6WjGSSDDMoQ/TYXMjKMR3KhwmoB0WDZC0TynOgN3GFn9cT0+ic5pwbCR3TWKc9GpdkU5Dc35SOPtkAZJgDtmw9O2cCUlARY0OHJAs4Yl4R/JWxBM/VCZZQJDLEGhvaZ/HIJue2jFJ42+cgESq1iMLGn31l6l+XFcny+DKKIaKXC8P7xJReaCBJYYzvESve0xhS5Y8Um8hCld49LAc6tdbcAd9MkyllyrXj8+1rVQ4RmoHMs7pdq/sU75LZ59gXiT+hH/x5RfAZkHecdVzuuD0EUBR4MCyXyTVjS5Jn6GsUG79z0xiXR3jrKlm/RqF0ikw0mbqqXO4sS9Nm06z+Igg3OCfcrjmI0fdqzQsmveFyuulkhAKeiS6RdkM6KzdMsv6ORAWQEMWBVgnlaUr0fScCdAQoPLWlqD9rAc8C6E1q7TmCw3YGmrersAxoRDAFXtcbDB2k1Xt3Sse425Lxs1E+73O8hm/16gfJPBq7NfEdvux4K4vlpk4YhqODJtfVPF8qtaIVe9QePLDfk9+WYianbXBenNUg91Iz1iP3JuFrbRQ2BPShINUex7Cp9AYy6gVMg1LQ9rmFQa+S2dmyDwhRevy2FMRTg1IPpZpAn0YvYjqInNOkNKdnA7Gm1BunYZn10/4itGgkCOAnf4ksOjDrYVNM4bcTPB/1uyFqw7ZCj45X6I3+ahRPxN9+KppZOc20gTtJ65XfiP6Pt+ThECdnSP2zyD8ZxRf69bv9WHhJ+nBR4+ZDUFJpZPyaXPdhV6W0rKfXksHLwPEi+TTK4zv0K7Rys7Fk7MkUAYx839d8PmBZcGfeL3RPw3kvYZ/+ulIZwASEfXkL4JkvYuoc2ZfDEBfBstv3s/LPMMkihdIncKoSpD532hQJ323zafBynyLn0pO8Ccfu5VPjVw28qlfVNt02tSZePchfknsDiI14vjLg6TFIZgWeWjNGm57tDTWRH2TQQoPZ2Oc+EgluezmM4hfUu/hoToH/YDl2pnIs98RJJHle+oZSAWFfZC6J1g== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 35d7aaa3-97f0-48c2-6987-08deec9539ad X-MS-Exchange-CrossTenant-AuthSource: AMBP189MB3196.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jul 2026 10:44:39.5867 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: VXi313i/sMHigTC9fZzL1AkqJ806xcpVkMU2CIQgAPDbQ4q46Filb2BazKbbOOiPnb/rvbhiwwpq/bHRGTminQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB2246 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 28 Jul 2026 10:44:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242182 From: Amaury Couderc Backport patch to fix CVE-2026-58472. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58472 https://www.cve.org/CVERecord?id=CVE-2026-58472 https://security-tracker.debian.org/tracker/CVE-2026-58472 https://ubuntu.com/security/CVE-2026-58472 https://osv.dev/list?q=CVE-2026-58472 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 [nvd] https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2 Signed-off-by: Amaury Couderc --- .../wget/wget/CVE-2026-58472-regression.patch | 235 ++++++++++++++++++ .../wget/wget/CVE-2026-58472.patch | 73 ++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 2 + 3 files changed, 310 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch new file mode 100644 index 0000000000..f8b532292f --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58472-regression.patch @@ -0,0 +1,235 @@ +From f76978a51ba9365e7ecaed96c1cfb73197a38ca2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Thu, 2 Jul 2026 13:13:07 +0200 +Subject: [PATCH] Regression: Fix buffer overflow in html_quote_string() + +The regression has been introduced in commit dd692d9 and +is not part of any release. + +The tests allow the address sanitizer to find the issue. + +* src/convert.c: Fix string size calculation. +* tests/unit-tests.c: Added tests including tests for html_quote_string(). +* tests/unit-tests.h: Add definitions for the test functions. + +Reported-by: Trung Nguyen + +CVE: CVE-2026-58472 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2] + +Signed-off-by: Amaury Couderc +--- + src/convert.c | 148 +++++++++++++++++++++++++++++++++++++++++++-- + tests/unit-tests.c | 4 ++ + tests/unit-tests.h | 4 ++ + 3 files changed, 152 insertions(+), 4 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index 3baec850..482676d9 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -48,6 +48,9 @@ as that of the covered work. */ + #include "css-url.h" + #include "iri.h" + #include "xstrndup.h" ++#ifdef TESTING ++#include "../tests/unit-tests.h" ++#endif + + static struct hash_table *dl_file_url_map; + struct hash_table *dl_url_file_map; +@@ -1186,13 +1189,13 @@ html_quote_string (const char *s) + for (i = 0; *s; s++) + { + if (*s == '&') +- ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ ++ ok = INT_ADD_OK (i, 4 + 1, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3 + 1, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ ++ ok = INT_ADD_OK (i, 5 + 1, &i); /* `quot;' */ + else if (*s == ' ') +- ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ ok = INT_ADD_OK (i, 4 + 1, &i); /* #32; */ + else + ok = INT_ADD_OK (i, 1, &i); + +@@ -1251,6 +1254,143 @@ html_quote_string (const char *s) + return res; + } + ++#ifdef TESTING ++ ++const char * ++test_construct_relative (void) ++{ ++ static const struct { ++ const char *basefile; ++ const char *linkfile; ++ const char *expected; ++ } test_array[] = { ++ { "foo", "bar", "bar" }, ++ { "A/foo", "A/bar", "bar" }, ++ { "A/foo", "A/B/bar", "B/bar" }, ++ { "A/X/foo", "A/Y/bar", "../Y/bar" }, ++ { "X/", "Y/bar", "../Y/bar" }, ++ { "/foo", "/bar", "bar" }, ++ { "/a/b/c", "/a/b/d", "d" }, ++ { "/a/b/c", "/a/b/c/d", "c/d" }, ++ { "/a/b/c", "/a/b/c/d/e", "c/d/e" }, ++ { "/a/b/c", "/x/y/z", "../../x/y/z" }, ++ { "a/b", "c/d", "../c/d" }, ++ { "./foo", "./bar", "bar" }, ++ }; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ char *result = construct_relative (test_array[i].basefile, ++ test_array[i].linkfile); ++ mu_assert ("test_construct_relative: wrong result", ++ strcmp (result, test_array[i].expected) == 0); ++ xfree (result); ++ } ++ ++ return NULL; ++} ++ ++const char * ++test_match_except_index (void) ++{ ++ static const struct { ++ const char *s1; ++ const char *s2; ++ bool expected; ++ } test_array[] = { ++ { "foo/index.html", "foo/", true }, ++ { "foo/", "foo/index.html", true }, ++ { "foo", "foo/index.html", true }, ++ { "foo", "foo/", true }, ++ { "foo", "foo", true }, ++ { "/foo/index.html", "/foo/", true }, ++ { "/foo/", "/foo/index.html", true }, ++ { "/foo", "/foo/index.html", true }, ++ { "/foo", "/foo/", true }, ++ { "foo/bar", "foo/qux", false }, ++ { "foo/bar", "bar/foo", false }, ++ }; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ bool result = match_except_index (test_array[i].s1, test_array[i].s2); ++ mu_assert ("test_match_except_index: wrong result", ++ result == test_array[i].expected); ++ } ++ ++ return NULL; ++} ++ ++const char * ++test_find_fragment (void) ++{ ++ static const struct { ++ const char *input; ++ int size; ++ bool has_fragment; ++ const char *fragment; ++ } test_array[] = { ++ { "http://example.com#section", 26, true, "#section" }, ++ { "http://example.com", 18, false, NULL }, ++ { "http://example.com?a=1#frag", 24, true, "#frag" }, ++ { "http://example.com?a=1%26#frag", 28, true, "#frag" }, ++ { "http://example.com?a=1&b=2#frag", 30, true, "#frag" }, ++ { "a#b", 3, true, "#b" }, ++ { "a", 1, false, NULL }, ++ }; ++ const char *bp, *ep; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ bool result = find_fragment (test_array[i].input, ++ test_array[i].size, &bp, &ep); ++ mu_assert ("test_find_fragment: wrong result", ++ result == test_array[i].has_fragment); ++ if (test_array[i].has_fragment) ++ { ++ mu_assert ("test_find_fragment: wrong fragment", bp != NULL); ++ mu_assert ("test_find_fragment: fragment mismatch", ++ strncmp (bp, test_array[i].fragment, ++ strlen (test_array[i].fragment)) == 0 && ++ ep == test_array[i].input + test_array[i].size); ++ } ++ } ++ ++ return NULL; ++} ++ ++const char * ++test_html_quote_string (void) ++{ ++ static const struct { ++ const char *input; ++ const char *expected; ++ } test_array[] = { ++ { "hello", "hello" }, ++ { "a&b", "a&b" }, ++ { "", "<tag>" }, ++ { "\"quote\"", ""quote"" }, ++ { "space here", "space here" }, ++ { "&<>\" ", "&<>" " }, ++ { "no special", "no special" }, ++ { "&&&&", "&&&&" }, ++ { "<<>>", "<<>>" }, ++ { "" , "" }, ++ }; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ char *result = html_quote_string (test_array[i].input); ++ mu_assert ("test_html_quote_string: wrong result", ++ strcmp (result, test_array[i].expected) == 0); ++ xfree (result); ++ } ++ ++ return NULL; ++} ++ ++#endif /* TESTING */ ++ + /* + * vim: et ts=2 sw=2 + */ +diff --git a/tests/unit-tests.c b/tests/unit-tests.c +index e9695e98..0a820ae6 100644 +--- a/tests/unit-tests.c ++++ b/tests/unit-tests.c +@@ -68,6 +68,10 @@ all_tests(void) + #endif + mu_run_test (test_parse_netrc); + mu_run_test (test_retr_rate); ++ mu_run_test (test_construct_relative); ++ mu_run_test (test_match_except_index); ++ mu_run_test (test_find_fragment); ++ mu_run_test (test_html_quote_string); + + return NULL; + } +diff --git a/tests/unit-tests.h b/tests/unit-tests.h +index 4402c017..9ad1957e 100644 +--- a/tests/unit-tests.h ++++ b/tests/unit-tests.h +@@ -64,6 +64,10 @@ const char *test_hsts_url_rewrite_congruent(void); + const char *test_hsts_read_database(void); + const char *test_parse_netrc(void); + const char *test_retr_rate(void); ++const char *test_construct_relative(void); ++const char *test_match_except_index(void); ++const char *test_find_fragment(void); ++const char *test_html_quote_string(void); + + #endif /* TEST_H */ + +-- +GitLab + diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch new file mode 100644 index 0000000000..96d01e735e --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch @@ -0,0 +1,73 @@ +From 132786a69d88d8afd376fa2d0193b47a54396533 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 19:13:15 +0200 +Subject: [PATCH] * src/convert.c (html_quote_string): Fix integer+buffer + overflow + +Reported-by: TristanInSec@gmail.com + +CVE: CVE-2026-58472 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812] + +Signed-off-by: Amaury Couderc +--- + src/convert.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index b934d49b..51636340 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -36,6 +36,7 @@ as that of the covered work. */ + #include + #include + #include ++#include + #include "convert.h" + #include "url.h" + #include "recur.h" +@@ -1169,21 +1170,37 @@ html_quote_string (const char *s) + { + const char *b = s; + char *p, *res; +- int i; ++ size_t i; ++ int ok; + + /* Pass through the string, and count the new size. */ +- for (i = 0; *s; s++, i++) ++ for (i = 0; *s; s++) + { + if (*s == '&') +- i += 4; /* `amp;' */ ++ ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- i += 3; /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- i += 5; /* `quot;' */ ++ ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ + else if (*s == ' ') +- i += 4; /* #32; */ ++ ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ else ++ ok = INT_ADD_OK (i, 1, &i); ++ ++ if (!ok) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } + } +- res = xmalloc (i + 1); ++ ++ if (!INT_ADD_OK (i, 1, &i)) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } ++ ++ res = xmalloc (i); + s = b; + for (p = res; *s; s++) + { diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index fb77754965..8df11c9d75 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -18,6 +18,8 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58469.patch \ file://CVE-2026-58469-regression_p1.patch \ file://CVE-2026-58469-regression_p2.patch \ + file://CVE-2026-58472.patch \ + file://CVE-2026-58472-regression.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"