From cd93d10bd8596557a78a1b4d1d0448c42f3c3e81 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Tue, 21 Jul 2026 09:20:00 +0000 Subject: [PATCH] Fix CVE-2026-58469: buffer underflow in clean_metalink_string() Backport fix for CVE-2026-58469 to wget-1.19.5. The patch addresses a buffer underflow in clean_metalink_string() in src/metalink.c by replacing manual whitespace checks with isspace(), adding a bounds guard, fixing an inverted trailing-space condition, and including the required ctype.h header. Three upstream commits (37a40fcb, 7b1cdecc, 82d945ff) are combined into a single patch. CVE: CVE-2026-58469 Upstream patches: - https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826.patch - https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf.patch - https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1.patch Resolves: RHEL-212496 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- wget-1.19.5-CVE-2026-58469.patch | 103 +++++++++++++++++++++++++++++++ wget.spec | 11 +++- 2 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 wget-1.19.5-CVE-2026-58469.patch diff --git a/wget-1.19.5-CVE-2026-58469.patch b/wget-1.19.5-CVE-2026-58469.patch new file mode 100644 index 0000000..18f32e6 --- /dev/null +++ b/wget-1.19.5-CVE-2026-58469.patch @@ -0,0 +1,103 @@ +From b2f6dfe67d78c82071842e3d7ea3447b3ff24e8f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 18:32:02 +0200 +Subject: [PATCH 1/3] * src/metalink.c (clean_metalink_string): Fix buffer + underflow + +Reported-by: TristanInSec@gmail.com +--- + src/metalink.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/src/metalink.c b/src/metalink.c +index 47c8acc..58a9fd5 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1043,7 +1043,6 @@ void + clean_metalink_string (char **str) + { + int c; +- size_t len; + char *new, *beg, *end; + + if (!str || !*str) +@@ -1051,7 +1050,7 @@ clean_metalink_string (char **str) + + beg = *str; + +- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (isspace(*beg)) + beg++; + + end = beg; +@@ -1064,12 +1063,10 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' ')) ++ while (end > beg && !isspace(*(end - 1))) + end--; + +- len = end - beg; +- +- new = xmemdup0 (beg, len); ++ new = xmemdup0 (beg, end - beg); + xfree (*str); + *str = new; + } + +From 989ba32056757509631d6588e47a59a9a06f8a36 Mon Sep 17 00:00:00 2001 +From: ChenYanpan +Date: Wed, 8 Jul 2026 12:09:55 +0800 +Subject: [PATCH 2/3] * src/metalink.c (clean_metalink_string): Fix inverted + trailing-space check + +37a40fcb added an `end > beg' bound guard to prevent a buffer +underflow, but accidentally flipped the condition from `isspace' to +`!isspace'. The loop therefore walked back over non-space characters +instead of trailing whitespace, collapsing any string without a +trailing newline to "". Every Metalink/HTTP resource URL was wiped, +so wget could not follow any mirror and +testenv/Test-metalink-http.py failed ("Expected file test.meta not +found"). Restore the `isspace' condition. + +Copyright-paperwork-exempt: Yes +--- + src/metalink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/metalink.c b/src/metalink.c +index 58a9fd5..084c262 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -1063,7 +1063,7 @@ clean_metalink_string (char **str) + /* If we are at the end of the string, search the first legit + character going backward. */ + if (*end == '\0') +- while (end > beg && !isspace(*(end - 1))) ++ while (end > beg && isspace(*(end - 1))) + end--; + + new = xmemdup0 (beg, end - beg); + +From 26af7a227b1af4219ba66898afbedec62c26bcd8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Thu, 9 Jul 2026 14:50:40 +0200 +Subject: [PATCH 3/3] * src/metalink.c: Include ctype.h + +--- + src/metalink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/metalink.c b/src/metalink.c +index 084c262..96bfd46 100644 +--- a/src/metalink.c ++++ b/src/metalink.c +@@ -46,6 +46,7 @@ as that of the covered work. */ + #include "c-strcase.h" + #include + #include /* For unlink. */ ++#include + #include + #ifdef HAVE_GPGME + #include diff --git a/wget.spec b/wget.spec index 981e3d7..e0933f8 100644 --- a/wget.spec +++ b/wget.spec @@ -1,7 +1,7 @@ Summary: A utility for retrieving files using the HTTP or FTP protocols Name: wget Version: 1.19.5 -Release: 14%{?dist} +Release: 15%{?dist} License: GPLv3+ Group: Applications/Internet Url: http://www.gnu.org/software/wget/ @@ -29,6 +29,10 @@ Patch13: wget-1.19.5-CVE-2024-38428.patch Patch14: wget-1.19.5-CVE-2026-58472.patch # https://gitlab.com/gnuwget/wget/-/commit/3514c0f2ad4e3d8a2e9ad0893accdb7a21cae729 Patch15: wget-1.19.5-CVE-2026-58471.patch +# https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 +# https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf +# https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1 +Patch16: wget-1.19.5-CVE-2026-58469.patch Provides: webclient Provides: bundled(gnulib) @@ -69,6 +73,7 @@ grep "PACKAGE_STRING='wget .* (Red Hat modified)'" configure || exit 1 %patch13 -p1 -b .CVE-2024-38428 %patch14 -p1 -b .CVE-2026-58472 %patch15 -p1 -b .CVE-2026-58471 +%patch16 -p1 -b .CVE-2026-58469 %build %configure \ @@ -115,6 +120,10 @@ rm -rf $RPM_BUILD_ROOT %{_infodir}/* %changelog +* Tue Jul 21 2026 RHEL Packaging Agent - 1.19.5-15 +- Fix CVE-2026-58469: buffer underflow in clean_metalink_string() +- Resolves: RHEL-212496 + * Wed Jul 15 2026 RHEL Packaging Agent - 1.19.5-14 - Fix CVE-2026-58471: buffer overflow in convert_fname() - Resolves: RHEL-194519