bugGNU Wget - Bugs: bug #62757, wget --secure-protocol=SSLv3 dumps...

 
 

bug #62757: wget --secure-protocol=SSLv3 dumps core when built with OpenSSL without SSLv3 support

Submitter:  Alan Coopersmith <alanc>
Submitted:  Wed 13 Jul 2022 12:59:26 AM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Open
Release:  trunk Operating System:  Others (Please Specify)
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 13 Jul 2022 12:59:26 AM UTC, original submission:  

When wget 1.21.2 is built to use OpenSSL, and OpenSSL was
built with the "no-ssl3 no-ssl3-method" options to disable
SSLv3 support, then wget core dumps when SSLv3 is requested:

% wget --secure-protocol=SSLv3 https://savannah.gnu.org/
--2022-07-12 17:32:01--  https://savannah.gnu.org/
OpenSSL: unimplemented 'secure-protocol' option value 2
Please report this issue to -email is unavailable-
Abort (core dumped)

This appears to be in ssl_init() in src/openssl.c - the
protocol versions unsupported by OpenSSL are #ifdef'ed
out of the switch statement altogether, falling down to
the default: case which prints an error and calls abort().

Since as bug 61416 notes, this option requests a minimum
version instead of an exact match, it would be better,
and seemingly more consistent with the gnutls version, if
the older protocol versions were always defined, and if
unsupported, the code instead fell through to the next
supported protocol release.

Alan Coopersmith <alanc>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #53428:  openssl.c added by alanc (37KiB - text/x-csrc - proposed patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by alanc (Submitted the item)
  •  

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-07-13 alanc Attached File- Added 0001-src-openssl.c-accept-secure-protocol-SSLv2-3-even-if.patch, #53429
    2022-07-13 alanc Attached File- Added openssl.c, #53428

    Back to the top

    Powered by Savane 3.14-3b9d.
    Corresponding source code