Compare commits
No commits in common. "c8-beta" and "c8" have entirely different histories.
99
SOURCES/wget-1.19.5-CVE-2024-38428.patch
Normal file
99
SOURCES/wget-1.19.5-CVE-2024-38428.patch
Normal file
@ -0,0 +1,99 @@
|
|||||||
|
From ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
|
||||||
|
Date: Sun, 2 Jun 2024 12:40:16 +0200
|
||||||
|
Subject: Properly re-implement userinfo parsing (rfc2396)
|
||||||
|
|
||||||
|
* src/url.c (url_skip_credentials): Properly re-implement userinfo parsing (rfc2396)
|
||||||
|
|
||||||
|
The reason why the implementation is based on RFC 2396, an outdated standard,
|
||||||
|
is that the whole file is based on that RFC, and mixing standard here might be
|
||||||
|
dangerous.
|
||||||
|
---
|
||||||
|
src/url.c | 40 ++++++++++++++++++++++++++++++++++------
|
||||||
|
1 file changed, 34 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/url.c b/src/url.c
|
||||||
|
index 69e948b..07c3bc8 100644
|
||||||
|
--- a/src/url.c
|
||||||
|
+++ b/src/url.c
|
||||||
|
@@ -41,6 +41,7 @@ as that of the covered work. */
|
||||||
|
#include "url.h"
|
||||||
|
#include "host.h" /* for is_valid_ipv6_address */
|
||||||
|
#include "c-strcase.h"
|
||||||
|
+#include "c-ctype.h"
|
||||||
|
|
||||||
|
#ifdef HAVE_ICONV
|
||||||
|
# include <iconv.h>
|
||||||
|
@@ -526,12 +527,39 @@ scheme_leading_string (enum url_scheme scheme)
|
||||||
|
static const char *
|
||||||
|
url_skip_credentials (const char *url)
|
||||||
|
{
|
||||||
|
- /* Look for '@' that comes before terminators, such as '/', '?',
|
||||||
|
- '#', or ';'. */
|
||||||
|
- const char *p = (const char *)strpbrk (url, "@/?#;");
|
||||||
|
- if (!p || *p != '@')
|
||||||
|
- return url;
|
||||||
|
- return p + 1;
|
||||||
|
+ /*
|
||||||
|
+ * This whole file implements https://www.rfc-editor.org/rfc/rfc2396 .
|
||||||
|
+ * RFC 2396 is outdated since 2005 and needs a rewrite or a thorough re-visit.
|
||||||
|
+ *
|
||||||
|
+ * The RFC says
|
||||||
|
+ * server = [ [ userinfo "@" ] hostport ]
|
||||||
|
+ * userinfo = *( unreserved | escaped | ";" | ":" | "&" | "=" | "+" | "$" | "," )
|
||||||
|
+ * unreserved = alphanum | mark
|
||||||
|
+ * mark = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
|
||||||
|
+ */
|
||||||
|
+ static const char *allowed = "-_.!~*'();:&=+$,";
|
||||||
|
+
|
||||||
|
+ for (const char *p = url; *p; p++)
|
||||||
|
+ {
|
||||||
|
+ if (c_isalnum(*p))
|
||||||
|
+ continue;
|
||||||
|
+
|
||||||
|
+ if (strchr(allowed, *p))
|
||||||
|
+ continue;
|
||||||
|
+
|
||||||
|
+ if (*p == '%' && c_isxdigit(p[1]) && c_isxdigit(p[2]))
|
||||||
|
+ {
|
||||||
|
+ p += 2;
|
||||||
|
+ continue;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (*p == '@')
|
||||||
|
+ return p + 1;
|
||||||
|
+
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return url;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Parse credentials contained in [BEG, END). The region is expected
|
||||||
|
--
|
||||||
|
cgit v1.1
|
||||||
|
|
||||||
|
diff --git a/tests/Test-proxied-https-auth.px.old b/tests/Test-proxied-https-auth.px
|
||||||
|
index 83e0210..76617ce 100755
|
||||||
|
--- a/tests/Test-proxied-https-auth.px.old
|
||||||
|
+++ b/tests/Test-proxied-https-auth.px
|
||||||
|
@@ -32,6 +32,7 @@ if (defined $srcdir) {
|
||||||
|
use HTTP::Daemon;
|
||||||
|
use HTTP::Request;
|
||||||
|
# Skip this test rather than fail it when the module isn't installed
|
||||||
|
+exit 77;
|
||||||
|
if (!eval {require IO::Socket::SSL;1;}) {
|
||||||
|
print STDERR "This test needs the perl module \"IO::Socket::SSL\".\n";
|
||||||
|
print STDERR "Install e.g. on Debian with 'apt-get install libio-socket-ssl-perl'\n";
|
||||||
|
diff --git a/tests/Test-proxied-https-auth-keepalive.px.old b/tests/Test-proxied-https-auth-keepalive.px
|
||||||
|
index 2a18ccf..80a8603 100755
|
||||||
|
--- a/tests/Test-proxied-https-auth-keepalive.px.old
|
||||||
|
+++ b/tests/Test-proxied-https-auth-keepalive.px
|
||||||
|
@@ -32,6 +32,7 @@ if (defined $srcdir) {
|
||||||
|
use HTTP::Daemon;
|
||||||
|
use HTTP::Request;
|
||||||
|
# Skip this test rather than fail it when the module isn't installed
|
||||||
|
+exit 77;
|
||||||
|
if (!eval {require IO::Socket::SSL;1;}) {
|
||||||
|
print STDERR "This test needs the perl module \"IO::Socket::SSL\".\n";
|
||||||
|
print STDERR "Install e.g. on Debian with 'apt-get install libio-socket-ssl-perl'\n";
|
@ -1,7 +1,7 @@
|
|||||||
Summary: A utility for retrieving files using the HTTP or FTP protocols
|
Summary: A utility for retrieving files using the HTTP or FTP protocols
|
||||||
Name: wget
|
Name: wget
|
||||||
Version: 1.19.5
|
Version: 1.19.5
|
||||||
Release: 11%{?dist}
|
Release: 12%{?dist}
|
||||||
License: GPLv3+
|
License: GPLv3+
|
||||||
Group: Applications/Internet
|
Group: Applications/Internet
|
||||||
Url: http://www.gnu.org/software/wget/
|
Url: http://www.gnu.org/software/wget/
|
||||||
@ -23,6 +23,7 @@ Patch10: wget-1.19.5-no_proxy-tests.patch
|
|||||||
# http://git.savannah.gnu.org/cgit/wget.git/commit/?id=706e71564cadc7192ac21efbf51b661c967f35b5
|
# http://git.savannah.gnu.org/cgit/wget.git/commit/?id=706e71564cadc7192ac21efbf51b661c967f35b5
|
||||||
Patch11: wget-1.19.5-ca-cert-too-verbose.patch
|
Patch11: wget-1.19.5-ca-cert-too-verbose.patch
|
||||||
Patch12: wget-1.19.5-no-log-when-quiet.patch
|
Patch12: wget-1.19.5-no-log-when-quiet.patch
|
||||||
|
Patch13: wget-1.19.5-CVE-2024-38428.patch
|
||||||
|
|
||||||
Provides: webclient
|
Provides: webclient
|
||||||
Provides: bundled(gnulib)
|
Provides: bundled(gnulib)
|
||||||
@ -60,6 +61,7 @@ grep "PACKAGE_STRING='wget .* (Red Hat modified)'" configure || exit 1
|
|||||||
%patch10 -p1 -b .no_proxy-test
|
%patch10 -p1 -b .no_proxy-test
|
||||||
%patch11 -p1 -b .too_verbose
|
%patch11 -p1 -b .too_verbose
|
||||||
%patch12 -p1 -b .no-log-quiet
|
%patch12 -p1 -b .no-log-quiet
|
||||||
|
%patch13 -p1 -b .CVE-2024-38428
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%configure \
|
%configure \
|
||||||
@ -106,6 +108,9 @@ rm -rf $RPM_BUILD_ROOT
|
|||||||
%{_infodir}/*
|
%{_infodir}/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jul 10 2024 Michal Ruprich <mruprich@redhat.com> - 1.19.5-12
|
||||||
|
- Resolves: RHEL-43559 - Misinterpretation of input may lead to improper behavior
|
||||||
|
|
||||||
* Tue Dec 13 2022 Michal Ruprich <mruprich@redhat.com> - 1.19.5-11
|
* Tue Dec 13 2022 Michal Ruprich <mruprich@redhat.com> - 1.19.5-11
|
||||||
- Resolves: #2152731 - Running wget with -O and -q in the background yields a file wget-log
|
- Resolves: #2152731 - Running wget with -O and -q in the background yields a file wget-log
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user