wget: CVE-2019-5953

Debian Bug report logs - #926389
wget: CVE-2019-5953

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: wget: CVE-2019-5953

Date: Thu, 04 Apr 2019 12:40:32 +0200

Source: wget
Version: 1.20.1-1
Severity: important
Tags: security upstream fixed-upstream

Hi,

The following vulnerability was published for wget.

CVE-2019-5953[0]:
Buffer overflow vulnerability

It was mentioned in the 1.20.2 release, [1]. It might be related to
[2], but not sure as the references do not give much details.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-5953
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5953
[1] https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00012.html
[2] https://git.savannah.gnu.org/cgit/wget.git/commit/?id=5d87635c66aaa01bdf95f6b093b66c3d2768b696

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 926389@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#926389: wget: CVE-2019-5953

Date: Thu, 4 Apr 2019 13:07:37 +0200

Hi,

On Thu, Apr 04, 2019 at 12:40:32PM +0200, Salvatore Bonaccorso wrote:
> Source: wget
> Version: 1.20.1-1
> Severity: important
> Tags: security upstream fixed-upstream
> 
> Hi,
> 
> The following vulnerability was published for wget.
> 
> CVE-2019-5953[0]:
> Buffer overflow vulnerability
> 
> It was mentioned in the 1.20.2 release, [1]. It might be related to
> [2], but not sure as the references do not give much details.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2019-5953
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5953
> [1] https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00012.html
> [2] https://git.savannah.gnu.org/cgit/wget.git/commit/?id=5d87635c66aaa01bdf95f6b093b66c3d2768b696

Sorry, just to be clear, it is not confirmed that either
5d87635c66aaa01bdf95f6b093b66c3d2768b696 or maybe would be meant.
CVE-2019-5953 is associated with a 'buffer overflow vulnerability'
fixed in 1.20.2 but is without details so far.

Regards,
Salvatore

Message #15 received at 926389@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#926389: wget: CVE-2019-5953

Date: Fri, 5 Apr 2019 14:42:48 +0200

Hi,

On Thu, Apr 04, 2019 at 01:07:37PM +0200, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Thu, Apr 04, 2019 at 12:40:32PM +0200, Salvatore Bonaccorso wrote:
> > Source: wget
> > Version: 1.20.1-1
> > Severity: important
> > Tags: security upstream fixed-upstream
> > 
> > Hi,
> > 
> > The following vulnerability was published for wget.
> > 
> > CVE-2019-5953[0]:
> > Buffer overflow vulnerability
> > 
> > It was mentioned in the 1.20.2 release, [1]. It might be related to
> > [2], but not sure as the references do not give much details.
> > 
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> > 
> > For further information see:
> > 
> > [0] https://security-tracker.debian.org/tracker/CVE-2019-5953
> >     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5953
> > [1] https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00012.html
> > [2] https://git.savannah.gnu.org/cgit/wget.git/commit/?id=5d87635c66aaa01bdf95f6b093b66c3d2768b696
> 
> Sorry, just to be clear, it is not confirmed that either
> 5d87635c66aaa01bdf95f6b093b66c3d2768b696 or maybe would be meant.
> CVE-2019-5953 is associated with a 'buffer overflow vulnerability'
> fixed in 1.20.2 but is without details so far.

Actually given
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=a220ead43505bc3e0ea8efb1572919111dbbf6dc
the real fix would be
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
and is only in 1.20.3 but not in 1.20.2.

Regards,
Salvatore

Message #28 received at 926389@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389@bugs.debian.org, Nol Kthe <noel@debian.org>

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#926389: wget: CVE-2019-5953

Date: Fri, 5 Apr 2019 15:45:01 +0200

[Message part 1 (text/plain, inline)]

Hi Noèl

On Fri, Apr 05, 2019 at 02:42:48PM +0200, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Thu, Apr 04, 2019 at 01:07:37PM +0200, Salvatore Bonaccorso wrote:
> > Hi,
> > 
> > On Thu, Apr 04, 2019 at 12:40:32PM +0200, Salvatore Bonaccorso wrote:
> > > Source: wget
> > > Version: 1.20.1-1
> > > Severity: important
> > > Tags: security upstream fixed-upstream
> > > 
> > > Hi,
> > > 
> > > The following vulnerability was published for wget.
> > > 
> > > CVE-2019-5953[0]:
> > > Buffer overflow vulnerability
> > > 
> > > It was mentioned in the 1.20.2 release, [1]. It might be related to
> > > [2], but not sure as the references do not give much details.
> > > 
> > > If you fix the vulnerability please also make sure to include the
> > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> > > 
> > > For further information see:
> > > 
> > > [0] https://security-tracker.debian.org/tracker/CVE-2019-5953
> > >     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5953
> > > [1] https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00012.html
> > > [2] https://git.savannah.gnu.org/cgit/wget.git/commit/?id=5d87635c66aaa01bdf95f6b093b66c3d2768b696
> > 
> > Sorry, just to be clear, it is not confirmed that either
> > 5d87635c66aaa01bdf95f6b093b66c3d2768b696 or maybe would be meant.
> > CVE-2019-5953 is associated with a 'buffer overflow vulnerability'
> > fixed in 1.20.2 but is without details so far.
> 
> Actually given
> https://git.savannah.gnu.org/cgit/wget.git/commit/?id=a220ead43505bc3e0ea8efb1572919111dbbf6dc
> the real fix would be
> https://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
> and is only in 1.20.3 but not in 1.20.2.

I have uploaded 1.18-5+deb9u3 for stretch-security with the attached
patch. Attached is as well proposed debdiff for unstable (and to reach
buster after an unblock).

Are you fine if I upload that or would you like to take care of it?

Regards,
Salvatore

[Fix-a-buffer-overflow-vulnerability.patch (text/x-diff, attachment)]

[wget_1.20.1-1.1.debdiff (text/plain, attachment)]

Message #33 received at 926389@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389@bugs.debian.org

Subject: wget: diff for NMU version 1.20.1-1.1

Date: Sat, 6 Apr 2019 10:05:45 +0200

[Message part 1 (text/plain, inline)]

Control: tags 926389 + patch
Control: tags 926389 + pending

Hie Noel,

I've prepared an NMU for wget (versioned as 1.20.1-1.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore

[wget-1.20.1-1.1-nmu.diff (text/x-diff, attachment)]

Message #42 received at 926389@bugs.debian.org (full text, mbox, reply):

From: John Brooks <john@fastquake.com>

To: 926389@bugs.debian.org, 926389-subscribe@bugs.debian.org

Date: Mon, 8 Apr 2019 15:56:18 -0400

Any progress on fixing this in Jessie?

Message #47 received at 926389@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: John Brooks <john@fastquake.com>, 926389@bugs.debian.org

Subject: Re: Bug#926389: (no subject)

Date: Wed, 10 Apr 2019 13:35:42 +0200

Hi,

On Mon, Apr 08, 2019 at 03:56:18PM -0400, John Brooks wrote:
> Any progress on fixing this in Jessie?

See: https://bugs.debian.org/926389#33

The Non-maintainer upload is pending in the delayed queue so it still
could be overriden by a maintainer upload and will reach otherwise
unstable in the upcoming day.

Regards,
Salvatore

Message #52 received at 926389@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389@bugs.debian.org

Cc: John Brooks <john@fastquake.com>

Subject: Re: Bug#926389: (no subject)

Date: Wed, 10 Apr 2019 13:48:15 +0200

On Wed, Apr 10, 2019 at 01:35:42PM +0200, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Mon, Apr 08, 2019 at 03:56:18PM -0400, John Brooks wrote:
> > Any progress on fixing this in Jessie?
> 
> See: https://bugs.debian.org/926389#33
> 
> The Non-maintainer upload is pending in the delayed queue so it still
> could be overriden by a maintainer upload and will reach otherwise
> unstable in the upcoming day.

Sorry I have misread the question. The question was about jessie. I
think Thorsten from the the LTS team is already working on an update
according to
https://salsa.debian.org/security-tracker-team/security-tracker/blob/master/data/dla-needed.txt#L113

Regards,
Salvatore

Message #57 received at 926389-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389-close@bugs.debian.org

Subject: Bug#926389: fixed in wget 1.20.1-1.1

Date: Thu, 11 Apr 2019 08:36:39 +0000

Source: wget
Source-Version: 1.20.1-1.1

We believe that the bug you reported is fixed in the latest version of
wget, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 926389@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated wget package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2019 15:36:38 +0200
Source: wget
Architecture: source
Version: 1.20.1-1.1
Distribution: unstable
Urgency: high
Maintainer: Noël Köthe <noel@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 926389
Changes:
 wget (1.20.1-1.1) unstable; urgency=high
 .
   * Non-maintainer upload.
   * Fix a buffer overflow vulnerability (CVE-2019-5953) (Closes: #926389)
Checksums-Sha1: 
 0d9569a779f484639a08f62523158c63b338a3a9 2092 wget_1.20.1-1.1.dsc
 8750ca48611630f4c594a4ca3ab901826c379fbf 60872 wget_1.20.1-1.1.debian.tar.xz
Checksums-Sha256: 
 b193fdf37cc33955e366ae1fdb6df5425d13769d9e131c52382ae132ad931261 2092 wget_1.20.1-1.1.dsc
 7eee4b6b9394a495888d1fc0db951c6b3bd883ca522a11df3433732dc116001e 60872 wget_1.20.1-1.1.debian.tar.xz
Files: 
 7a84dd8efb09001dcb9af1576b35992c 2092 web standard wget_1.20.1-1.1.dsc
 e0ed66f143f4d81dd0f27a8f01a9c5c8 60872 web standard wget_1.20.1-1.1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlynWudfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89Er6sP/1BW0FyfN8/E3RuJ+5kKLucSkF9GB73g
Gi04TFtGz2UfyqyVRv/p81eEsZ+Ps4cXzPFa2xODs6Qnn7DE5jSlX1xQzfUArkOt
SnwSpOBEwEeR0czoSJ3h9zwVtb0o61fG+nHLzRD0fyuMu77J8KtiiPQOiYvqfsFi
pbyzGibIU2hjB/TGyYlHS3IyZfPUVjhUlxOIMT5GJhwrfIAhVcmWyKzxjaLxqe7E
zffh4SWFzg2+jKRVsh4UInIWDfgcqTowBt+HlBbpKIarX3nOxS+QR3rz3ZSPoBDv
fdfv3rd86kk4SHw7rK/gZBhwJJNxnY2k89wzSBq3oIBbZ3WvXlnUGTBn5uxfAyQ8
6zaeLNh4d/KcrS6pK7+JE32DqfFHHOJ7MB0uwDQ7sDy5vWpawYm6X+JkMhiV2zet
jhZ9RXUbZ5UybxQKeXUlHKnVgpXGjPdbD2ICaicbgMo4Zv+nosz5FzZve1quwUXk
4I7/1rrSbhTeJzlE9/UbXbeDZbJji2QCV74NST3H08RowITeJgOwtptxrv9VQhM4
t2OIbcuBoeEBBUSldvakYKAQbRCcJYaCoFEuTsVs80kOl0hmJgmUKmCJj85TUmHU
KtRXD1xmgE2woyBRJCg91x3J2cT6GU3JSLod7OyWFboM0fc0FVF3yH7VEpyWbKLb
rI1AESkdAmxf
=MxK/
-----END PGP SIGNATURE-----

Message #62 received at 926389-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 926389-close@bugs.debian.org

Subject: Bug#926389: fixed in wget 1.18-5+deb9u3

Date: Sun, 14 Apr 2019 10:33:17 +0000

Source: wget
Source-Version: 1.18-5+deb9u3

We believe that the bug you reported is fixed in the latest version of
wget, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 926389@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated wget package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 05 Apr 2019 15:05:06 +0200
Source: wget
Architecture: source
Version: 1.18-5+deb9u3
Distribution: stretch-security
Urgency: high
Maintainer: Noël Köthe <noel@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 926389
Changes:
 wget (1.18-5+deb9u3) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix a buffer overflow vulnerability (CVE-2019-5953) (Closes: #926389)
Checksums-Sha1: 
 2bf174b06cc0425f97479aa05546948465db1d94 2085 wget_1.18-5+deb9u3.dsc
 d0993735e38ee05a74f52c7ab7166bdc58b33e78 23672 wget_1.18-5+deb9u3.debian.tar.xz
Checksums-Sha256: 
 0ffd4ef70f0e0c919fd60aa0135ca4b920ebaa9793935dd3a615103f7d209525 2085 wget_1.18-5+deb9u3.dsc
 da643e00461f2a4451256ec2547a3c2d9d3c9819f3657e459d6cbdaa6c5390ad 23672 wget_1.18-5+deb9u3.debian.tar.xz
Files: 
 ded18cd2cff5ca6cdbddef8379be6b6d 2085 web important wget_1.18-5+deb9u3.dsc
 8b6c1a8d16fd9cf9bc2123c90dc32dcb 23672 web important wget_1.18-5+deb9u3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlynU35fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EYX0P/0MOqPIEsC8YYfhVVATg0vJ/XxM53igA
JnGJtw9QplSM9QnsxL7Df+J8wA/DutAyqbRuYQ+XLLEAqW2r12wn7zF3dKtSOMjk
7ysCz6pAxR5iu6vJN+5ftAoZ55maL0RntZMi4wG5zQKZFvN2Itv5HZEP+ub4bxL2
jovSpW0yU+vwIP3y0hWb0zSj3BcDN2p4Wcxw3e1arr2JPCMh6iZ/5Ho2ZuQXhmZR
/jITyQAbhjFRuGVoo540Grlkx6yVYtg5BmrVliFcRVPcFNhJ48nSh0HlUqOzRPol
oORIMI/xQpajby1B0vypYtGej0Gwa1yAcHGfvq5GpsF5xZKsPqhsxA+1qihfiXBV
ZvZ5WAbZeF2iFKGSMwMrxlOCafl7Hzoa8FNSanlvC0Uiu3ZuQuIyVl2xvxjTXQKJ
sX3ZHr7x9KjLxh/oTpSRFvxDx0kPokR3y4D7R+TJDFjSaUGn95AT9/mx8HmyujcK
57NkFliQb8hY3a7qUXRTgu8D3/9y8U1VsOCL1fz3+GB9efr6pJ4uAe3ymi7Sm/OM
ZZ+KYaVOgWHdBOK2GT3Y7nrkZNznIO/fEUvM1ETBMScttSHEHlDoLIRhy0Kh4WpP
C8vgU6crD0gS2CbGL5gqQCy7eF2Y4PP72+Eg9tfbbpKoi3M8A5Ux2gHEH7jbRiLF
c5UIp8/ti755
=ldp6
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.