Fix CVE-2026-58469: buffer underflow in clean_metalink_string()
Backport fix for CVE-2026-58469 to wget-1.19.5. The patch addresses a buffer underflow in clean_metalink_string() in src/metalink.c by replacing manual whitespace checks with isspace(), adding a bounds guard, fixing an inverted trailing-space condition, and including the required ctype.h header. Three upstream commits (37a40fcb, 7b1cdecc, 82d945ff) are combined into a single patch. CVE: CVE-2026-58469 Upstream patches: -37a40fcb45.patch -7b1cdecc49.patch -82d945ff5d.patch Resolves: RHEL-212496 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
19edc769bb
commit
cd93d10bd8
103
wget-1.19.5-CVE-2026-58469.patch
Normal file
103
wget-1.19.5-CVE-2026-58469.patch
Normal file
@ -0,0 +1,103 @@
|
||||
From b2f6dfe67d78c82071842e3d7ea3447b3ff24e8f Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
|
||||
Date: Mon, 29 Jun 2026 18:32:02 +0200
|
||||
Subject: [PATCH 1/3] * src/metalink.c (clean_metalink_string): Fix buffer
|
||||
underflow
|
||||
|
||||
Reported-by: TristanInSec@gmail.com
|
||||
---
|
||||
src/metalink.c | 9 +++------
|
||||
1 file changed, 3 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/metalink.c b/src/metalink.c
|
||||
index 47c8acc..58a9fd5 100644
|
||||
--- a/src/metalink.c
|
||||
+++ b/src/metalink.c
|
||||
@@ -1043,7 +1043,6 @@ void
|
||||
clean_metalink_string (char **str)
|
||||
{
|
||||
int c;
|
||||
- size_t len;
|
||||
char *new, *beg, *end;
|
||||
|
||||
if (!str || !*str)
|
||||
@@ -1051,7 +1050,7 @@ clean_metalink_string (char **str)
|
||||
|
||||
beg = *str;
|
||||
|
||||
- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
|
||||
+ while (isspace(*beg))
|
||||
beg++;
|
||||
|
||||
end = beg;
|
||||
@@ -1064,12 +1063,10 @@ clean_metalink_string (char **str)
|
||||
/* If we are at the end of the string, search the first legit
|
||||
character going backward. */
|
||||
if (*end == '\0')
|
||||
- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
|
||||
+ while (end > beg && !isspace(*(end - 1)))
|
||||
end--;
|
||||
|
||||
- len = end - beg;
|
||||
-
|
||||
- new = xmemdup0 (beg, len);
|
||||
+ new = xmemdup0 (beg, end - beg);
|
||||
xfree (*str);
|
||||
*str = new;
|
||||
}
|
||||
|
||||
From 989ba32056757509631d6588e47a59a9a06f8a36 Mon Sep 17 00:00:00 2001
|
||||
From: ChenYanpan <chenyanpan@xfusion.com>
|
||||
Date: Wed, 8 Jul 2026 12:09:55 +0800
|
||||
Subject: [PATCH 2/3] * src/metalink.c (clean_metalink_string): Fix inverted
|
||||
trailing-space check
|
||||
|
||||
37a40fcb added an `end > beg' bound guard to prevent a buffer
|
||||
underflow, but accidentally flipped the condition from `isspace' to
|
||||
`!isspace'. The loop therefore walked back over non-space characters
|
||||
instead of trailing whitespace, collapsing any string without a
|
||||
trailing newline to "". Every Metalink/HTTP resource URL was wiped,
|
||||
so wget could not follow any mirror and
|
||||
testenv/Test-metalink-http.py failed ("Expected file test.meta not
|
||||
found"). Restore the `isspace' condition.
|
||||
|
||||
Copyright-paperwork-exempt: Yes
|
||||
---
|
||||
src/metalink.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/metalink.c b/src/metalink.c
|
||||
index 58a9fd5..084c262 100644
|
||||
--- a/src/metalink.c
|
||||
+++ b/src/metalink.c
|
||||
@@ -1063,7 +1063,7 @@ clean_metalink_string (char **str)
|
||||
/* If we are at the end of the string, search the first legit
|
||||
character going backward. */
|
||||
if (*end == '\0')
|
||||
- while (end > beg && !isspace(*(end - 1)))
|
||||
+ while (end > beg && isspace(*(end - 1)))
|
||||
end--;
|
||||
|
||||
new = xmemdup0 (beg, end - beg);
|
||||
|
||||
From 26af7a227b1af4219ba66898afbedec62c26bcd8 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
|
||||
Date: Thu, 9 Jul 2026 14:50:40 +0200
|
||||
Subject: [PATCH 3/3] * src/metalink.c: Include ctype.h
|
||||
|
||||
---
|
||||
src/metalink.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/src/metalink.c b/src/metalink.c
|
||||
index 084c262..96bfd46 100644
|
||||
--- a/src/metalink.c
|
||||
+++ b/src/metalink.c
|
||||
@@ -46,6 +46,7 @@ as that of the covered work. */
|
||||
#include "c-strcase.h"
|
||||
#include <errno.h>
|
||||
#include <unistd.h> /* For unlink. */
|
||||
+#include <ctype.h>
|
||||
#include <metalink/metalink_parser.h>
|
||||
#ifdef HAVE_GPGME
|
||||
#include <gpgme.h>
|
||||
11
wget.spec
11
wget.spec
@ -1,7 +1,7 @@
|
||||
Summary: A utility for retrieving files using the HTTP or FTP protocols
|
||||
Name: wget
|
||||
Version: 1.19.5
|
||||
Release: 14%{?dist}
|
||||
Release: 15%{?dist}
|
||||
License: GPLv3+
|
||||
Group: Applications/Internet
|
||||
Url: http://www.gnu.org/software/wget/
|
||||
@ -29,6 +29,10 @@ Patch13: wget-1.19.5-CVE-2024-38428.patch
|
||||
Patch14: wget-1.19.5-CVE-2026-58472.patch
|
||||
# https://gitlab.com/gnuwget/wget/-/commit/3514c0f2ad4e3d8a2e9ad0893accdb7a21cae729
|
||||
Patch15: wget-1.19.5-CVE-2026-58471.patch
|
||||
# https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
|
||||
# https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
|
||||
# https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1
|
||||
Patch16: wget-1.19.5-CVE-2026-58469.patch
|
||||
|
||||
Provides: webclient
|
||||
Provides: bundled(gnulib)
|
||||
@ -69,6 +73,7 @@ grep "PACKAGE_STRING='wget .* (Red Hat modified)'" configure || exit 1
|
||||
%patch13 -p1 -b .CVE-2024-38428
|
||||
%patch14 -p1 -b .CVE-2026-58472
|
||||
%patch15 -p1 -b .CVE-2026-58471
|
||||
%patch16 -p1 -b .CVE-2026-58469
|
||||
|
||||
%build
|
||||
%configure \
|
||||
@ -115,6 +120,10 @@ rm -rf $RPM_BUILD_ROOT
|
||||
%{_infodir}/*
|
||||
|
||||
%changelog
|
||||
* Tue Jul 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.19.5-15
|
||||
- Fix CVE-2026-58469: buffer underflow in clean_metalink_string()
|
||||
- Resolves: RHEL-212496
|
||||
|
||||
* Wed Jul 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.19.5-14
|
||||
- Fix CVE-2026-58471: buffer overflow in convert_fname()
|
||||
- Resolves: RHEL-194519
|
||||
|
||||
Loading…
Reference in New Issue
Block a user