On Mon, Aug 07, 2017 at 05:59:17AM +0000, Denis OSTERLAND wrote:
> Signed-off-by: Denis Osterland <denis.osterl...@diehl.com>
This patch does not apply.
Michael
> ---
> patches/wget-1.19.1/CVE-2017-6508.patch | 31 +++++++++++++++++++++++++++++++
> patches/wget-1.19.1/series | 1 +
> rules/wget.make | 5 ++---
> 3 files changed, 34 insertions(+), 3 deletions(-)
> create mode 100644 patches/wget-1.19.1/CVE-2017-6508.patch
> create mode 100644 patches/wget-1.19.1/series
>
> diff --git a/patches/wget-1.19.1/CVE-2017-6508.patch
> b/patches/wget-1.19.1/CVE-2017-6508.patch
> new file mode 100644
> index 0000000..bb2f63f
> --- /dev/null
> +++ b/patches/wget-1.19.1/CVE-2017-6508.patch
> @@ -0,0 +1,31 @@
> +From: Tim Rühsen <tim.rueh...@gmx.de>
> +Date: Mon Mar 6 10:04:22 2017 +0100
> +Subject: Fix CRLF injection in Wget host part
> +
> +* src/url.c (url_parse): Reject control characters in host part of URL
> +
> +Reported-by: Orange Tsai
> +
> +commit 4d729e322fae359a1aefaafec1144764a54e8ad4
> +diff --git a/src/url.c b/src/url.c
> +index 8f8ff0b8..7d36b27d 100644
> +--- a/src/url.c
> ++++ b/src/url.c
> +@@ -925,6 +925,17 @@ url_parse (const char *url, int *error, struct iri
> *iri, bool percent_encode)
> + url_unescape (u->host);
> + host_modified = true;
> +
> ++ /* check for invalid control characters in host name */
> ++ for (p = u->host; *p; p++)
> ++ {
> ++ if (c_iscntrl(*p))
> ++ {
> ++ url_free(u);
> ++ error_code = PE_INVALID_HOST_NAME;
> ++ goto error;
> ++ }
> ++ }
> ++
> + /* Apply IDNA regardless of iri->utf8_encode status */
> + if (opt.enable_iri && iri)
> + {
> diff --git a/patches/wget-1.19.1/series b/patches/wget-1.19.1/series
> new file mode 100644
> index 0000000..f58bfe3
> --- /dev/null
> +++ b/patches/wget-1.19.1/series
> @@ -0,0 +1 @@
> +CVE-2017-6508.patch
> diff --git a/rules/wget.make b/rules/wget.make
> index a315e01..d4d3494 100644
> --- a/rules/wget.make
> +++ b/rules/wget.make
> @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_WGET) += wget
> #
> # Paths and names
> #
> -WGET_VERSION := 1.11.4
> -WGET_MD5 := 69e8a7296c0e12c53bd9ffd786462e87
> +WGET_VERSION := 1.19.1
> +WGET_MD5 := 87cea36b7161fd43e3fd51a4e8b89689
> WGET := wget-$(WGET_VERSION)
> WGET_SUFFIX := tar.gz
> WGET_URL := $(call ptx/mirror, GNU, wget/$(WGET).$(WGET_SUFFIX))
> @@ -40,7 +40,6 @@ WGET_ENV := \
> WGET_AUTOCONF := \
> $(CROSS_AUTOCONF_USR) \
> $(GLOBAL_IPV6_OPTION) \
> - --without-socks \
> --without-ssl
>
> #
> ----------------------------------------------------------------------------
> --
> 2.7.4
>
>
> Diehl AKO Stiftung & Co. KG, Pfannerstraße 75-83, 88239 Wangen im Allgäu
> Bereichsvorstand: Dipl.-Ing. Michael Siedentop (Sprecher), Josef Fellner
> (Mitglied)
> Sitz der Gesellschaft: Wangen i.A. – Registergericht: Amtsgericht Ulm HRA
> 620609 – Persönlich haftende Gesellschafterin: Diehl Verwaltungs-Stiftung –
> Sitz: Nürnberg – Registergericht: Amtsgericht Nürnberg HRA 11756 –
> Vorstand: Dr.-Ing. E.h. Thomas Diehl (†) (Vorsitzender), Herr
> Dipl.-Wirtsch.-Ing. Wolfgang Weggen (stellvertretender Vorsitzender),
> Dipl.-Kfm. Claus Günther, Dipl.-Kfm. Frank Gutzeit, Dr.-Ing. Heinrich Schunk,
> Dr.-Ing. Michael Siedentop , Dipl.-Kfm. Dr.-Ing. Martin Sommer, Dipl.-Ing.
> (FH) Rainer von Borstel, Vorsitzender des Aufsichtsrates: Dr. Klaus Maier
> ___________________________________________________________________________________________________
> Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese E-Mail
> enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen.
> Informieren Sie uns bitte, wenn Sie diese E-Mail faelschlicherweise erhalten
> haben. Bitte loeschen Sie in diesem Fall die Nachricht. Jede unerlaubte Form
> der Reproduktion, Bekanntgabe, Aenderung, Verteilung und/oder Publikation
> dieser E-Mail ist strengstens untersagt.
> The contents of the above mentioned e-mail is not legally binding. This
> e-mail contains confidential and/or legally protected information. Please
> inform us if you have received this e-mail by mistake and delete it in such a
> case. Each unauthorized reproduction, disclosure, alteration, distribution
> and/or publication of this e-mail is strictly prohibited.
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
--
Pengutronix e.K. | |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
