69 lines
2.8 KiB
Diff
69 lines
2.8 KiB
Diff
From 871b0b55d092965b974201315d0a1487051901f2 Mon Sep 17 00:00:00 2001
|
|
From: leizhongkai <leizhongkai@huawei.com>
|
|
Date: Wed, 5 Jun 2019 15:12:45 +0800
|
|
Subject: [PATCH 2/2] busybox: fix CVE-2018-1000500
|
|
|
|
reason:fix CVE-2018-1000500
|
|
backport from https://git.busybox.net/busybox/commit/networking/wget.c?id=0972c7f7a570c38edb68e1c60a45614b7a7c7d55
|
|
see https://nvd.nist.gov/vuln/detail/CVE-2018-1000500 and https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000500.html
|
|
for more details
|
|
|
|
Signed-off-by: leizhongkai <leizhongkai@huawei.com>
|
|
---
|
|
networking/wget.c | 9 +++++++--
|
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/networking/wget.c b/networking/wget.c
|
|
index 309b983..6477f36 100644
|
|
--- a/networking/wget.c
|
|
+++ b/networking/wget.c
|
|
@@ -136,6 +136,7 @@
|
|
//usage: "Retrieve files via HTTP or FTP\n"
|
|
//usage: IF_FEATURE_WGET_LONG_OPTIONS(
|
|
//usage: "\n --spider Only check URL existence: $? is 0 if exists"
|
|
+///////: "\n --no-check-certificate Don't validate the server's certificate"
|
|
//usage: )
|
|
//usage: "\n -c Continue retrieval of aborted transfer"
|
|
//usage: "\n -q Quiet"
|
|
@@ -267,6 +268,7 @@ enum {
|
|
WGET_OPT_HEADER = (1 << 10) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
|
|
WGET_OPT_POST_DATA = (1 << 11) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
|
|
WGET_OPT_SPIDER = (1 << 12) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
|
|
+ WGET_OPT_NO_CHECK_CERT = (1 << 13) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
|
|
};
|
|
|
|
enum {
|
|
@@ -765,6 +767,9 @@ static void spawn_ssl_client(const char *host, int network_fd)
|
|
int pid;
|
|
char *servername, *p;
|
|
|
|
+ if (!(option_mask32 & WGET_OPT_NO_CHECK_CERT))
|
|
+ bb_error_msg("note: TLS certificate validation not implemented");
|
|
+
|
|
servername = xstrdup(host);
|
|
p = strrchr(servername, ':');
|
|
if (p) *p = '\0';
|
|
@@ -1362,10 +1367,9 @@ IF_DESKTOP( "tries\0" Required_argument "t")
|
|
"header\0" Required_argument "\xff"
|
|
"post-data\0" Required_argument "\xfe"
|
|
"spider\0" No_argument "\xfd"
|
|
+ "no-check-certificate\0" No_argument "\xfc"
|
|
/* Ignored (we always use PASV): */
|
|
IF_DESKTOP( "passive-ftp\0" No_argument "\xf0")
|
|
- /* Ignored (we don't do ssl) */
|
|
-IF_DESKTOP( "no-check-certificate\0" No_argument "\xf0")
|
|
/* Ignored (we don't support caching) */
|
|
IF_DESKTOP( "no-cache\0" No_argument "\xf0")
|
|
IF_DESKTOP( "no-verbose\0" No_argument "\xf0")
|
|
@@ -1425,6 +1429,7 @@ IF_DESKTOP( "no-parent\0" No_argument "\xf0")
|
|
if (option_mask32 & WGET_OPT_HEADER) bb_error_msg("--header");
|
|
if (option_mask32 & WGET_OPT_POST_DATA) bb_error_msg("--post-data");
|
|
if (option_mask32 & WGET_OPT_SPIDER) bb_error_msg("--spider");
|
|
+ if (option_mask32 & WGET_OPT_NO_CHECK_CERT) bb_error_msg("--no-check-certificate");
|
|
exit(0);
|
|
#endif
|
|
argv += optind;
|
|
--
|
|
1.8.3.1
|
|
|