Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wget for openSUSE:Factory checked in at 2026-08-29 17:40:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wget (Old) and /work/SRC/openSUSE:Factory/.wget.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wget" Sat Aug 29 17:40:00 2026 rev:79 rq:1374200 version:1.25.0 Changes: -------- --- /work/SRC/openSUSE:Factory/wget/wget.changes 2026-08-15 22:40:08.921578006 +0200 +++ /work/SRC/openSUSE:Factory/.wget.new.1265/wget.changes 2026-08-29 17:40:05.273228774 +0200 @@ -1,0 +2,7 @@ +Thu Aug 27 16:06:00 UTC 2026 - Valentin Lefebvre <[email protected]> + +- Fix server-controlled unbounded MD5 loop in FTP OPIE + [bsc#1276962; CVE-2026-16599] + * CVE-2026-16599.patch + +------------------------------------------------------------------- New: ---- CVE-2026-16599.patch ----------(New B)---------- New: [bsc#1276962; CVE-2026-16599] * CVE-2026-16599.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wget.spec ++++++ --- /var/tmp/diff_new_pack.JQx3bn/_old 2026-08-29 17:40:06.431269740 +0200 +++ /var/tmp/diff_new_pack.JQx3bn/_new 2026-08-29 17:40:06.435269881 +0200 @@ -48,6 +48,8 @@ Patch10: CVE-2026-15146.patch #PATCH-FIX-UPSTREAM commit aaf77cb98e4c7ba4d775923444e5f0d93ae0e5d3 Patch11: Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch +#PATCH-FIX-UPSTREAM commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa +Patch12: CVE-2026-16599.patch BuildRequires: makeinfo BuildRequires: pkgconfig >= 0.9.0 BuildRequires: pkgconfig(gpgme) >= 0.4.2 ++++++ CVE-2026-16599.patch ++++++ >From e9697d98e7249b0f68a6be040a4f3dcc5bc101fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20R=C3=BChsen?= <[email protected]> Date: Sat, 20 Jun 2026 14:39:54 +0200 Subject: [PATCH] Fix server-controlled unbounded MD5 loop in FTP OPIE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * src/ftp-basic.c (ftp_login): Limit the skey sequence to 9999. Report: wget accepts an unbounded server-controlled integer as the iteration count for its OPIE/S-KEY MD5 key-derivation loop. No upper bound is enforced on the sequence number supplied by the server in the FTP challenge line. The value is passed directly to skey_response() as a loop counter, causing wget to perform up to ~2.1 billion full MD5 computations before responding to the authentication challenge. Reported-by: Michał Majchrowicz and Marcin Wyczechowski --- src/ftp-basic.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/ftp-basic.c b/src/ftp-basic.c index 0f4bb821..af38a69a 100644 --- a/src/ftp-basic.c +++ b/src/ftp-basic.c @@ -204,12 +204,11 @@ ftp_login (int csock, const char *acc, const char *pass) "331 s/key ", "331 opiekey " }; - size_t i; const char *seed = NULL; - for (i = 0; i < countof (skey_head); i++) + for (size_t i = 0; i < countof (skey_head); i++) { - int l = strlen (skey_head[i]); + size_t l = strlen (skey_head[i]); if (0 == c_strncasecmp (skey_head[i], respline, l)) { seed = respline + l; @@ -222,7 +221,15 @@ ftp_login (int csock, const char *acc, const char *pass) /* Extract the sequence from SEED. */ for (; c_isdigit (*seed); seed++) - skey_sequence = 10 * skey_sequence + *seed - '0'; + { + skey_sequence = 10 * skey_sequence + *seed - '0'; + if (skey_sequence > 9999) + { + xfree (respline); + return FTPLOGREFUSED; + } + } + if (*seed == ' ') ++seed; else -- 2.54.0
