ECHO-1fcb-1955-3c69
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-1fcb-1955-3c69.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-1fcb-1955-3c69
- Upstream
- Withdrawn
- 2026-10-16T12:30:03Z
- Published
- 2026-08-19T22:59:36Z
- Modified
- 2026-10-16T13:15:03Z
- Summary
- NULL pointer write in the wget applet's -T/--timeout handling (networking/wget.c): getopt32() is handed NULL as the -T storage only when busybox is built with CONFIG_WGET but WITHOUT CONFIG_FEATURE_WGET_TIMEOUT ("IF_NOT_FEATURE_WGET_TIMEOUT(NULL)"). Every busybox Echo ships is built from Debian's own configs, where that combination never occurs: debian/config/pkg/deb and debian/config/pkg/static (busybox, busybox-static, busybox-syslogd, udhcpc, udhcpd) set CONFIG_FEATURE_WGET_TIMEOUT=y, so -T is stored in G.timeout_seconds, and debian/config/pkg/udeb does not build wget at all. Verified on 1:1.38.0-3: a build from debian/config/pkg/deb and Debian's busybox and busybox-static binaries answer "wget -T 5" and "wget --timeout 5" normally, while the same tree with only FEATURE_WGET_TIMEOUT turned off segfaults on "wget -T 5". The cited "patch" 83a40bf is a commit in a third-party fork, not in upstream busybox, and bundles unrelated applet changes. Debian rates the CVE unimportant ("crash in CLI tool, no security impact").
- Details
- References