Repository navigation
wget: backport CVE-2026-15146 fix (FTP PASV address SSRF) - #916
Merged
Merged
Conversation
ftp_pasv() and ftp_lpsv() used the IP address in the server's PASV/LPSV reply without checking it against the control connection's peer. A malicious FTP server, or an HTTP redirect to one, could aim wget's data connection at any host and port (SSRF). 1.25.0, our version and still the latest, is affected. Upstream fixed it in gnuwget/wget 4f85853f6418, which is unreleased. Debian carries the same fix as 1.25.0-3. - Carry the upstream commit verbatim as a fifth CVE patch, in the same shape as the existing four. It is applied with `patch -Np1` and fails closed. - Add a build-time regression test. A gawk fake FTP server answers PASV with 127.0.0.2, and the build requires wget to reject the reply and never connect there. Negative control: with the patch skipped, wget prints "couldn't connect to 127.0.0.2 port 9" and the build fails. Refs gominimal/pkgmgr-rs#848 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 3 billable files and costs up to $0.75.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 32 minutes for your next included review. View limit details
Comment |
norrietaylor
approved these changes
Oct 19, 2026
Member
There was a problem hiding this comment.
LGTM. The patch is identical to gnuwget/wget@4f85853f, applies cleanly to v1.25.0 with no overlap with the existing patches, and adds no new deps.
Nits:
- Possible flake (
build.sh:60-72): the readiness probe at line 65 uses up gawk's single-accept/inetlistener, so a fastwget --tries=1can get ECONNREFUSED while gawk re-listens. It fails closed, so the risk is a spurious build failure, never a false pass. Drop the probe and retry wget a few times, or sleep briefly after the probe. - The timeout
exit 1at line 67 leaves the gawk process running. - FYI: upstream
e9697d98(unbounded MD5 loop in FTP OPIE, same file, DoS, no CVE) could be a follow-up.
Generated by Claude Code
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
Oct 19, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
Oct 19, 2026
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
CVE-2026-15146. In wget 1.25.0,
ftp_pasv()andftp_lpsv()(src/ftp-basic.c) take the IP address from the server's227/228reply and never check it against the peer of the control connection. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can therefore point wget's data connection at any host and port: a server-side request forgery against localhost or the internal network.gnuwget/wget@4f85853f(2026-07-05). It is not in any release yet.1.25.0-3. We found this through the Ruby on Rails development support: chromedriver, Ruby 3.x, initdb locale fix, dev-loop tools #848 Debian-revision audit, and it was hand-verified against security-tracker.debian.org (gominimal/pkgmgr-rs#848). It was not among the four CVE patches we already carry.Changes
CVE-2026-15146.patch. This is the upstream commit's.patch, unmodified. It is the fifth CVE patch, added the same way as the existing four: listed inbuild.ncland applied inbuild.shwithpatch -Np1underset -e, so a stale hunk fails the build. It touches onlysrc/ftp-basic.c, and none of the other four patches touch that file.PASVwith127,0,0,2,0,9. gawk's/inetsockets mean the test needs no new build dep.Cannot parse PASV response.and requires that127.0.0.2never appears in the log.==> PASV ... couldn't connect to 127.0.0.2 port 9: Connection refused, and the build fails.Verification
All runs were in a
min sessionwith thepkgbuildloadout, on arm64:min package build --rebuild --verbose wget: all 5 patches apply and the regression test passes (Cannot parse PASV response.). Result:build finished.min check --packages wget: all checks pass.Notes
update. On the first wget release that contains4f85853, the patch will reverse-apply and be removed automatically, together with itsbuild.nclentry andbuild.shline.GnuProject wgetidentity will report it against 1.25.0 even though this patch is carried. That will need a VEXnot_affected / inline_mitigations_already_existuntil the next release.icedtea-7,icedtea-8) and 19 packages transitively, through the openjdk boot ladder.Refs gominimal/pkgmgr-rs#848
🤖 Generated with Claude Code