Re: [OE-core] [wrynose][PATCH 1/5] wget: fix CVE-2026-58469

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Jul 22, 2026 at 10:20 AM CEST, Amaury Couderc via lists.openembedded.org wrote:
> From: Amaury Couderc <amaury.couderc@est.tech>
>
> Backport patch to fix CVE-2026-58469.
>
> References:
>   https://nvd.nist.gov/vuln/detail/CVE-2026-58469
>   https://www.cve.org/CVERecord?id=CVE-2026-58469
>   https://security-tracker.debian.org/tracker/CVE-2026-58469
>   https://ubuntu.com/security/CVE-2026-58469
>   https://osv.dev/list?q=CVE-2026-58469
>
> Upstream fix:
>   https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 [nvd]
>
> Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
> ---
>  .../wget/wget/CVE-2026-58469.patch            | 52 +++++++++++++++++++
>  meta/recipes-extended/wget/wget_1.25.0.bb     |  1 +
>  2 files changed, 53 insertions(+)
>  create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58469.patch

Review from Hetvi Thakar:
On Thu Jul 23, 2026 at 10:44 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> I reviewed the earlier series.
> It looks like the follow-up upstream regression fixes for
> CVE-2026-58469 and CVE-2026-58472 were not included in the backport.
> These follow-up commits are required to complete the backport, and I
> have included them in my series .
> I kindly request you to review my series as well.


> diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58469.patch b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch
> new file mode 100644
> index 0000000000..c5d3df9090
> --- /dev/null
> +++ b/meta/recipes-extended/wget/wget/CVE-2026-58469.patch
> @@ -0,0 +1,52 @@
> +From c7d858a9ca8b9840e5edc520c36fe4f33f2e9cea Mon Sep 17 00:00:00 2001
> +From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
> +Date: Mon, 29 Jun 2026 18:32:02 +0200
> +Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer
> + underflow
> +
> +Reported-by: TristanInSec@gmail.com
> +
> +CVE: CVE-2026-58469
> +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826]
> +
> +Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
> +---
> + src/metalink.c | 9 +++------
> + 1 file changed, 3 insertions(+), 6 deletions(-)
> +
> +diff --git a/src/metalink.c b/src/metalink.c
> +index de2439c9..2d6e5846 100644
> +--- a/src/metalink.c
> ++++ b/src/metalink.c
> +@@ -1041,7 +1041,6 @@ void
> + clean_metalink_string (char **str)
> + {
> +   int c;
> +-  size_t len;
> +   char *new, *beg, *end;
> + 
> +   if (!str || !*str)
> +@@ -1049,7 +1048,7 @@ clean_metalink_string (char **str)
> + 
> +   beg = *str;
> + 
> +-  while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
> ++  while (isspace(*beg))
> +     beg++;
> + 
> +   end = beg;
> +@@ -1062,12 +1061,10 @@ clean_metalink_string (char **str)
> +   /* If we are at the end of the string, search the first legit
> +      character going backward.  */
> +   if (*end == '\0')
> +-    while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
> ++    while (end > beg && !isspace(*(end - 1)))
> +       end--;
> + 
> +-  len = end - beg;
> +-
> +-  new = xmemdup0 (beg, len);
> ++  new = xmemdup0 (beg, end - beg);
> +   xfree (*str);
> +   *str = new;
> + }
> diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb
> index f0d3458462..a1f34dfb5c 100644
> --- a/meta/recipes-extended/wget/wget_1.25.0.bb
> +++ b/meta/recipes-extended/wget/wget_1.25.0.bb
> @@ -15,6 +15,7 @@ DEPENDS += "autoconf-archive-native pod2man-native"
>  
>  SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
>             file://0002-improve-reproducibility.patch \
> +           file://CVE-2026-58469.patch \
>             "
>  
>  SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"


-- 
Yoann Congal
Smile ECS