From: Amaury Couderc <[email protected]> Backport patch to fix CVE-2026-15146.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-15146 https://www.cve.org/CVERecord?id=CVE-2026-15146 https://security-tracker.debian.org/tracker/CVE-2026-15146 https://ubuntu.com/security/CVE-2026-15146 Upstream fix: https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b [nvd] Signed-off-by: Amaury Couderc <[email protected]> --- .../wget/wget/CVE-2026-15146.patch | 122 ++++++++++++++++++ meta/recipes-extended/wget/wget_1.21.4.bb | 1 + 2 files changed, 123 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-15146.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-15146.patch b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch new file mode 100644 index 0000000000..3c1704fffe --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-15146.patch @@ -0,0 +1,122 @@ +From 89e62f8db81e8bc09cd6eb79a4f52ed75aa0253c Mon Sep 17 00:00:00 2001 +From: Acts1631 <[email protected]> +Date: Sun, 5 Jul 2026 17:22:55 -0400 +Subject: [PATCH] ftp: validate PASV/LPSV response address against control + connection peer + +* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised + address, + (ftp_lpsv): Likewise. + +ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in +the server's 227 response without checking that it matched the peer +of the control connection. A malicious or compromised FTP server +could therefore direct wget's data connection to an arbitrary host and +port of its choosing (e.g. an internal service unreachable from the +attacker directly), which is a server-side request forgery. + +ftp_epsv() was already safe since it only extracts a port and reuses +the pre-filled control-connection address. + +Fix ftp_pasv() and ftp_lpsv() the same way: capture the control +connection's peer address via socket_ip_address() before parsing the +response, and reject the response (FTPINVPASV) if the parsed address +does not match. + +Verified with a fake FTP server that returns a PASV response pointing +at a different loopback address (127.0.0.2 instead of the real peer +127.0.0.1): before the fix wget connects to the spoofed address, after +the fix it rejects the response with "Cannot parse PASV response." +Legitimate transfers using a correctly-addressed PASV response +continue to work. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-15146 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b] + +Signed-off-by: Amaury Couderc <[email protected]> +--- + src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/src/ftp-basic.c b/src/ftp-basic.c +index d999027a..fd87578d 100644 +--- a/src/ftp-basic.c ++++ b/src/ftp-basic.c +@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port) + int nwritten, i; + uerr_t err; + unsigned char tmp[6]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the PASV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port) + memcpy (IP_INADDR_DATA (addr), tmp, 4); + *port = ((tmp[4] << 8) & 0xff00) + tmp[5]; + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != AF_INET ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ return FTPINVPASV; ++ } ++ + return FTPOK; + } + +@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + uerr_t err; + unsigned char tmp[16]; + unsigned char tmpprt[2]; ++ ip_address peer_addr; + + assert (addr != NULL); + assert (port != NULL); + ++ /* Remember who we are talking to on the control connection, so that ++ the address returned in the LPSV response can be checked below. ++ Accepting an arbitrary server-supplied address would let a ++ malicious FTP server redirect our data connection to any host of ++ its choosing (SSRF). */ ++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER)) ++ return FTPINVPASV; ++ + xzero (*addr); + + /* Form the request. */ +@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port) + DEBUGP (("*port is: %d\n", *port)); + } + ++ /* Reject the response if the advertised address does not match the ++ control connection's peer. */ ++ if (peer_addr.family != addr->family ++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), ++ af == 4 ? 4 : 16) != 0) ++ { ++ xzero (*addr); ++ *port = 0; ++ xfree (respline); ++ return FTPINVPASV; ++ } ++ + xfree (respline); + return FTPOK; + } diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index 24594b3093..8d9923e7b3 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb @@ -6,6 +6,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ file://CVE-2026-58472.patch \ + file://CVE-2026-15146.patch \ " SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c" -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241626): https://lists.openembedded.org/g/openembedded-core/message/241626 Mute This Topic: https://lists.openembedded.org/mt/120390851/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
