Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wget for openSUSE:Factory checked in at 2026-07-17 18:47:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wget (Old) and /work/SRC/openSUSE:Factory/.wget.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wget" Fri Jul 17 18:47:06 2026 rev:76 rq:1365982 version:1.25.0 Changes: -------- --- /work/SRC/openSUSE:Factory/wget/wget.changes 2026-07-10 17:35:29.689197795 +0200 +++ /work/SRC/openSUSE:Factory/.wget.new.24530/wget.changes 2026-07-17 18:47:17.808832496 +0200 @@ -1,0 +2,7 @@ +Wed Jul 15 13:02:15 UTC 2026 - Valentin Lefebvre <[email protected]> + +- ftp validate PASV/LPSV response address against control connection peer + [bsc#1271320, CVE-2026-15146] + * CVE-2026-15146.patch + +------------------------------------------------------------------- New: ---- CVE-2026-15146.patch ----------(New B)---------- New: [bsc#1271320, CVE-2026-15146] * CVE-2026-15146.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wget.spec ++++++ --- /var/tmp/diff_new_pack.rzMxVi/_old 2026-07-17 18:47:18.708862979 +0200 +++ /var/tmp/diff_new_pack.rzMxVi/_new 2026-07-17 18:47:18.712863114 +0200 @@ -44,6 +44,8 @@ Patch8: CVE-2026-58471.patch #PATCH-FIX-UPSTREAM commit dd692d9cea5335b181d877ae917fe6e75587a812 Patch9: CVE-2026-58472.patch +#PATCH-FIX-UPSTREAM commit 4f85853f641863d5915786a8413e1a213726a62b +Patch10: CVE-2026-15146.patch BuildRequires: makeinfo BuildRequires: pkgconfig >= 0.9.0 BuildRequires: pkgconfig(gpgme) >= 0.4.2 ++++++ CVE-2026-15146.patch ++++++ >From 4f85853f641863d5915786a8413e1a213726a62b Mon Sep 17 00:00:00 2001 From: Acts1631 <[email protected]> Date: Sun, 5 Jul 2026 17:22:55 -0400 Subject: [PATCH] ftp: validate PASV/LPSV response address against control connection peer * src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised address, (ftp_lpsv): Likewise. ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in the server's 227 response without checking that it matched the peer of the control connection. A malicious or compromised FTP server could therefore direct wget's data connection to an arbitrary host and port of its choosing (e.g. an internal service unreachable from the attacker directly), which is a server-side request forgery. ftp_epsv() was already safe since it only extracts a port and reuses the pre-filled control-connection address. Fix ftp_pasv() and ftp_lpsv() the same way: capture the control connection's peer address via socket_ip_address() before parsing the response, and reject the response (FTPINVPASV) if the parsed address does not match. Verified with a fake FTP server that returns a PASV response pointing at a different loopback address (127.0.0.2 instead of the real peer 127.0.0.1): before the fix wget connects to the spoofed address, after the fix it rejects the response with "Cannot parse PASV response." Legitimate transfers using a correctly-addressed PASV response continue to work. Copyright-paperwork-exempt: Yes --- src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/src/ftp-basic.c b/src/ftp-basic.c index 4870256a..0f4bb821 100644 --- a/src/ftp-basic.c +++ b/src/ftp-basic.c @@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port) int nwritten, i; uerr_t err; unsigned char tmp[6]; + ip_address peer_addr; assert (addr != NULL); assert (port != NULL); + /* Remember who we are talking to on the control connection, so that + the address returned in the PASV response can be checked below. + Accepting an arbitrary server-supplied address would let a + malicious FTP server redirect our data connection to any host of + its choosing (SSRF). */ + if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) + return FTPINVPASV; + xzero (*addr); /* Form the request. */ @@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port) memcpy (IP_INADDR_DATA (addr), tmp, 4); *port = ((tmp[4] << 8) & 0xff00) + tmp[5]; + /* Reject the response if the advertised address does not match the + control connection's peer. */ + if (peer_addr.family != AF_INET + || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0) + { + xzero (*addr); + *port = 0; + return FTPINVPASV; + } + return FTPOK; } @@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port) uerr_t err; unsigned char tmp[16]; unsigned char tmpprt[2]; + ip_address peer_addr; assert (addr != NULL); assert (port != NULL); + /* Remember who we are talking to on the control connection, so that + the address returned in the LPSV response can be checked below. + Accepting an arbitrary server-supplied address would let a + malicious FTP server redirect our data connection to any host of + its choosing (SSRF). */ + if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) + return FTPINVPASV; + xzero (*addr); /* Form the request. */ @@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port) DEBUGP (("*port is: %d\n", *port)); } + /* Reject the response if the advertised address does not match the + control connection's peer. */ + if (peer_addr.family != addr->family + || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), + af == 4 ? 4 : 16) != 0) + { + xzero (*addr); + *port = 0; + xfree (respline); + return FTPINVPASV; + } + xfree (respline); return FTPOK; } -- 2.54.0
