bugGNU Wget - Bugs: bug #41919, wildcard certificate matching way...

 
 

bug #41919: wildcard certificate matching way too permissive

Submitter:  None
Submitted:  Fri 21 Mar 2014 06:11:16 AM UTC
   
 
Category:  Protocol Issue Severity:  3 - Normal
Priority:  5 - Normal Status:  Confirmed
Privacy:  Public Assigned to:  None
Originator Name:  Steffen Ullrich Originator Email:  -email is unavailable-
Open/Closed:  Open Release:  trunk
Operating System:  None Reproducibility:  Every Time
Fixed Release:  None Planned Release:  None
Regression:  None Work Required:  None
Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 08 Jun 2014 02:30:17 PM UTC, comment #1: 

Hi,

Thanks for the report. Could you kindly check against the latest git HEAD?

We've updated the way Wget does cookie domain matching by using an external library for the same.

Darshit Shah <darnir>
Group administrator
Fri 21 Mar 2014 06:11:16 AM UTC, original submission:  

Hi,
wget allows to match any number of wildcards in the certificate and will thus match www.google.com aganst ..com or even ..*. While RFC2818 is not specific about this topic RFC6125 says quit clearly, that a wildcard match should only be done against the left-most label (section 6.4.3) and that's how the browsers behave.
It also says, that no wildcard matching should be done against IDNA labels, e.g. labels starting with "xn--".

Regards,
Steffen

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-06-08 darnir StatusNone Confirmed

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code