bugGNU Wget - Bugs: bug #41919, wildcard certificate matching way...

 
 

bug #41919: wildcard certificate matching way too permissive

Submitted by:  None
Submitted on:  Fri 21 Mar 2014 06:11:16 AM UTC  
 
Category: Protocol IssueSeverity: 3 - Normal
Priority: 5 - NormalStatus: Confirmed
Privacy: PublicAssigned to: None
Originator Name: Steffen UllrichOriginator Email: -unavailable-
Open/Closed: OpenRelease: trunk
Operating System: NoneReproducibility: Every Time
Fixed Release: NonePlanned Release: None
Regression: NoneWork Required: None
Patch Included: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 08 Jun 2014 02:30:17 PM UTC, comment #1:

Hi,

Thanks for the report. Could you kindly check against the latest git HEAD?

We've updated the way Wget does cookie domain matching by using an external library for the same.

Darshit Shah <darnir>
Project Administrator
Fri 21 Mar 2014 06:11:16 AM UTC, original submission:

Hi,
wget allows to match any number of wildcards in the certificate and will thus match http://www.google.com aganst ..com or even ..*. While RFC2818 is not specific about this topic RFC6125 says quit clearly, that a wildcard match should only be done against the left-most label (section 6.4.3) and that's how the browsers behave.
It also says, that no wildcard matching should be done against IDNA labels, e.g. labels starting with "xn--".

Regards,
Steffen

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by darnir (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 08 Jun 2014 02:31:52 PM UTCdarnirStatusNone=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup