Skip to content

Commit 8c06840

Browse files
CBL-Mariner-BotKavyaSree2610
CBL-Mariner-Bot
and
KavyaSree2610
authored
[AUTO-CHERRYPICK] Fix CVE-2024-10524 for wget :2.0 - branch main (#11187)
Co-authored-by: KavyaSree2610 <92566732+KavyaSree2610@users.noreply.github.com>
1 parent fad4d61 commit 8c06840

2 files changed

Lines changed: 187 additions & 1 deletion

File tree

‎SPECS/wget/CVE-2024-10524.patch‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
From 4cfddf2cd1aac9b0e36cd08df36f077ee68bd87b Mon Sep 17 00:00:00 2001
2+
From: kavyasree <kkaitepalli@microsoft.com>
3+
Date: Thu, 21 Nov 2024 12:17:03 +0530
4+
Subject: [PATCH] Fix CVE-2024-10524
5+
6+
---
7+
doc/wget.texi | 12 ++++-------
8+
src/html-url.c | 2 +-
9+
src/main.c | 2 +-
10+
src/retr.c | 2 +-
11+
src/url.c | 57 ++++++++++++++++----------------------------------
12+
src/url.h | 2 +-
13+
6 files changed, 26 insertions(+), 51 deletions(-)
14+
15+
diff --git a/doc/wget.texi b/doc/wget.texi
16+
index 0c282b3..d59994a 100644
17+
--- a/doc/wget.texi
18+
+++ b/doc/wget.texi
19+
@@ -314,8 +314,8 @@ for text files. Here is an example:
20+
ftp://host/directory/file;type=a
21+
@end example
22+
23+
-Two alternative variants of @sc{url} specification are also supported,
24+
-because of historical (hysterical?) reasons and their widespreaded use.
25+
+The two alternative variants of @sc{url} specifications are no longer
26+
+supported because of security considerations:
27+
28+
@sc{ftp}-only syntax (supported by @code{NcFTP}):
29+
@example
30+
@@ -327,12 +327,8 @@ host:/dir/file
31+
host[:port]/dir/file
32+
@end example
33+
34+
-These two alternative forms are deprecated, and may cease being
35+
-supported in the future.
36+
-
37+
-If you do not understand the difference between these notations, or do
38+
-not know which one to use, just use the plain ordinary format you use
39+
-with your favorite browser, like @code{Lynx} or @code{Netscape}.
40+
+These two alternative forms have been deprecated long time ago,
41+
+and support is removed with version 1.22.0.
42+
43+
@c man begin OPTIONS
44+
45+
diff --git a/src/html-url.c b/src/html-url.c
46+
index eaddc17..ab3ada6 100644
47+
--- a/src/html-url.c
48+
+++ b/src/html-url.c
49+
@@ -931,7 +931,7 @@ get_urls_file (const char *file)
50+
url_text = merged;
51+
}
52+
53+
- new_url = rewrite_shorthand_url (url_text);
54+
+ new_url = maybe_prepend_scheme (url_text);
55+
if (new_url)
56+
{
57+
xfree (url_text);
58+
diff --git a/src/main.c b/src/main.c
59+
index 7c27b0c..6e00ca7 100644
60+
--- a/src/main.c
61+
+++ b/src/main.c
62+
@@ -2120,7 +2120,7 @@ only if outputting to a regular file.\n"));
63+
struct iri *iri = iri_new ();
64+
struct url *url_parsed;
65+
66+
- t = rewrite_shorthand_url (argv[optind]);
67+
+ t = maybe_prepend_scheme (argv[optind]);
68+
if (!t)
69+
t = argv[optind];
70+
71+
diff --git a/src/retr.c b/src/retr.c
72+
index 2e18eae..7a34dd5 100644
73+
--- a/src/retr.c
74+
+++ b/src/retr.c
75+
@@ -1502,7 +1502,7 @@ getproxy (struct url *u)
76+
77+
/* Handle shorthands. `rewritten_storage' is a kludge to allow
78+
getproxy() to return static storage. */
79+
- rewritten_url = rewrite_shorthand_url (proxy);
80+
+ rewritten_url = maybe_prepend_scheme (proxy);
81+
if (rewritten_url)
82+
return rewritten_url;
83+
84+
diff --git a/src/url.c b/src/url.c
85+
index 65dd27d..01a4391 100644
86+
--- a/src/url.c
87+
+++ b/src/url.c
88+
@@ -594,60 +594,39 @@ parse_credentials (const char *beg, const char *end, char **user, char **passwd)
89+
return true;
90+
}
91+
92+
-/* Used by main.c: detect URLs written using the "shorthand" URL forms
93+
- originally popularized by Netscape and NcFTP. HTTP shorthands look
94+
- like this:
95+
-
96+
- www.foo.com[:port]/dir/file -> http://www.foo.com[:port]/dir/file
97+
- www.foo.com[:port] -> http://www.foo.com[:port]
98+
-
99+
- FTP shorthands look like this:
100+
-
101+
- foo.bar.com:dir/file -> ftp://foo.bar.com/dir/file
102+
- foo.bar.com:/absdir/file -> ftp://foo.bar.com//absdir/file
103+
+static bool is_valid_port(const char *p)
104+
+{
105+
+ unsigned port = (unsigned) atoi (p);
106+
+ if (port == 0 || port > 65535)
107+
+ return false;
108+
109+
- If the URL needs not or cannot be rewritten, return NULL. */
110+
+ int digits = strspn (p, "0123456789");
111+
+ return digits && (p[digits] == '/' || p[digits] == '\0');
112+
+}
113+
114+
+/* Prepend "http://" to url if scheme is missing, otherwise return NULL. */
115+
char *
116+
-rewrite_shorthand_url (const char *url)
117+
+maybe_prepend_scheme (const char *url)
118+
{
119+
- const char *p;
120+
- char *ret;
121+
-
122+
if (url_scheme (url) != SCHEME_INVALID)
123+
return NULL;
124+
125+
- /* Look for a ':' or '/'. The former signifies NcFTP syntax, the
126+
- latter Netscape. */
127+
- p = strpbrk (url, ":/");
128+
+ const char *p = strchr (url, ':');
129+
if (p == url)
130+
return NULL;
131+
132+
/* If we're looking at "://", it means the URL uses a scheme we
133+
don't support, which may include "https" when compiled without
134+
- SSL support. Don't bogusly rewrite such URLs. */
135+
+ SSL support. Don't bogusly prepend "http://" to such URLs. */
136+
if (p && p[0] == ':' && p[1] == '/' && p[2] == '/')
137+
return NULL;
138+
139+
- if (p && *p == ':')
140+
- {
141+
- /* Colon indicates ftp, as in foo.bar.com:path. Check for
142+
- special case of http port number ("localhost:10000"). */
143+
- int digits = strspn (p + 1, "0123456789");
144+
- if (digits && (p[1 + digits] == '/' || p[1 + digits] == '\0'))
145+
- goto http;
146+
-
147+
- /* Turn "foo.bar.com:path" to "ftp://foo.bar.com/path". */
148+
- if ((ret = aprintf ("ftp://%s", url)) != NULL)
149+
- ret[6 + (p - url)] = '/';
150+
- }
151+
- else
152+
- {
153+
- http:
154+
- /* Just prepend "http://" to URL. */
155+
- ret = aprintf ("http://%s", url);
156+
- }
157+
- return ret;
158+
+ if (p && p[0] == ':' && !is_valid_port (p + 1))
159+
+ return NULL;
160+
+
161+
+
162+
+ fprintf(stderr, "Prepended http:// to '%s'\n", url);
163+
+ return aprintf ("http://%s", url);
164+
}
165+
166+
static void split_path (const char *, char **, char **);
167+
diff --git a/src/url.h b/src/url.h
168+
index 29c591d..804c0a7 100644
169+
--- a/src/url.h
170+
+++ b/src/url.h
171+
@@ -128,7 +128,7 @@ char *uri_merge (const char *, const char *);
172+
173+
int mkalldirs (const char *);
174+
175+
-char *rewrite_shorthand_url (const char *);
176+
+char *maybe_prepend_scheme (const char *);
177+
bool schemes_are_similar_p (enum url_scheme a, enum url_scheme b);
178+
179+
bool are_urls_equal (const char *u1, const char *u2);
180+
--
181+
2.34.1
182+

‎SPECS/wget/wget.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: A network utility to retrieve files from the Web
22
Name: wget
33
Version: 1.21.2
4-
Release: 3%{?dist}
4+
Release: 4%{?dist}
55
License: GPL-3.0-or-later AND LGPL-3.0-or-later
66
URL: https://www.gnu.org/software/wget/wget.html
77
Group: System Environment/NetworkingPrograms
88
Vendor: Microsoft Corporation
99
Distribution: Mariner
1010
Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.gz
1111
Patch0: CVE-2024-38428.patch
12+
Patch1: CVE-2024-10524.patch
1213
BuildRequires: openssl-devel
1314
%if %{with_check}
1415
BuildRequires: perl
@@ -55,6 +56,9 @@ rm -rf %{buildroot}/%{_infodir}
5556
%{_datadir}/locale/*/LC_MESSAGES/*.mo
5657

5758
%changelog
59+
* Thu Nov 21 2024 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 1.21.2-4
60+
- Patch for CVE-2024-10524
61+
5862
* Wed Jun 19 2024 Saul Paredes <saulparedes@microsoft.com> - 1.21.2-3
5963
- Patch for CVE-2024-38428
6064

0 commit comments

Comments
 (0)