bugGNU Wget - Bugs: bug #41919, wildcard certificate matching way...


bug #41919: wildcard certificate matching way too permissive

Submitted by:  None
Submitted on:  Fri 21 Mar 2014 06:11:16 AM UTC  
Category:  Protocol Issue Severity:  3 - Normal
Priority:  5 - Normal Status:  Confirmed
Privacy:  Public Assigned to:  None
Originator Name:  Steffen Ullrich Originator Email:  -email is unavailable-
Open/Closed:  Open Release:  trunk
Operating System:  None Reproducibility:  Every Time
Fixed Release:  None Planned Release:  None
Regression:  None Work Required:  None
Patch Included:  None

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sun 08 Jun 2014 02:30:17 PM UTC, comment #1:


Thanks for the report. Could you kindly check against the latest git HEAD?

We've updated the way Wget does cookie domain matching by using an external library for the same.

Darshit Shah <darnir>
Project Administrator
Fri 21 Mar 2014 06:11:16 AM UTC, original submission:

wget allows to match any number of wildcards in the certificate and will thus match http://www.google.com aganst ..com or even ..*. While RFC2818 is not specific about this topic RFC6125 says quit clearly, that a wildcard match should only be done against the left-most label (section 6.4.3) and that's how the browsers behave.
It also says, that no wildcard matching should be done against IDNA labels, e.g. labels starting with "xn--".




(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)



    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-06-08 darnir StatusNone => Confirmed

    Back to the top

    Powered by Savane 3.3