Hello community, here is the log from the commit of package wget for openSUSE:Factory checked in at 2017-03-10 21:44:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wget (Old) and /work/SRC/openSUSE:Factory/.wget.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wget" Fri Mar 10 21:44:33 2017 rev:46 rq:477531 version:1.19.1 Changes: -------- --- /work/SRC/openSUSE:Factory/wget/wget.changes 2017-02-20 14:29:44.305321418 +0100 +++ /work/SRC/openSUSE:Factory/.wget.new/wget.changes 2017-03-10 21:44:34.257212285 +0100 @@ -1,0 +2,7 @@ +Tue Mar 7 13:40:10 UTC 2017 - [email protected] + +- src/url.c (url_parse): Reject control characters in host part + of URL + (CVE-2017-6508, wget-CVE-2017-6508.patch, bsc#1028301) + +------------------------------------------------------------------- New: ---- wget-CVE-2017-6508.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wget.spec ++++++ --- /var/tmp/diff_new_pack.HUvr0T/_old 2017-03-10 21:44:35.145086351 +0100 +++ /var/tmp/diff_new_pack.HUvr0T/_new 2017-03-10 21:44:35.153085218 +0100 @@ -33,6 +33,7 @@ # PATCH-FIX-OPENSUSE fix pod syntax for perl 5.18 [email protected] Patch7: wget-fix-pod-syntax.diff Patch8: wget-errno-clobber.patch +Patch9: wget-CVE-2017-6508.patch BuildRequires: automake BuildRequires: gpgme-devel >= 0.4.2 BuildRequires: libcares-devel @@ -79,6 +80,7 @@ %patch6 %patch7 -p1 %patch8 -p1 +%patch9 -p1 %build %if 0%{?suse_version} > 1110 ++++++ wget-CVE-2017-6508.patch ++++++ diff --git a/src/url.c b/src/url.c index 8f8ff0b..7d36b27 100644 --- a/src/url.c +++ b/src/url.c @@ -925,6 +925,17 @@ url_parse (const char *url, int *error, struct iri *iri, bool percent_encode) url_unescape (u->host); host_modified = true; + /* check for invalid control characters in host name */ + for (p = u->host; *p; p++) + { + if (c_iscntrl(*p)) + { + url_free(u); + error_code = PE_INVALID_HOST_NAME; + goto error; + } + } + /* Apply IDNA regardless of iri->utf8_encode status */ if (opt.enable_iri && iri) {
