mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/busybox: patch CVE-2025-60876

Browse Source 
This commit fixes the following vulenerability:

- CVE-2025-60876:
    BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0
    control bytes in the HTTP request-target (path/query), allowing the
    request line to be split and attacker-controlled headers to be
    injected. To preserve the HTTP/1.1 request-line shape METHOD SP
    request-target SP HTTP/1.1, a raw space (0x20) in the request-target
    must also be rejected (clients should use %20).

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-60876
    - https://lists.busybox.net/pipermail/busybox/2025-November/091840.html
    - https://sources.debian.org/data/main/b/busybox/1%3A1.37.0-10/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Thomas Perale
2026-02-15 15:17:16 +01:00
committed by Julien Olivain
parent 0a24ac1307
commit 073c6af03e
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch Normal file
View File

@@ -0,0 +1,42 @@
From: Radoslav Kolev <radoslav.kolev@suse.com>
Date: Fri, 21 Nov 2025 11:21:18 +0200
Subject: wget: don't allow control characters or spaces in the URL
Forwarded: yes, https://lists.busybox.net/pipermail/busybox/2025-November/091840.html
Bug-Debian: https://bugs.debian.org/1120795
Fixes CVE-2025-60876 malicious URL can be used to inject
HTTP headers in the request.
Signed-off-by: Radoslav Kolev <radoslav.kolev@suse.com>
Reviewed-by: Emmanuel Deloget <logout@free.fr>
Upstream: https://sources.debian.org/data/main/b/busybox/1%3A1.37.0-10/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch
Upstream: https://lists.busybox.net/pipermail/busybox/2025-November/091840.html
CVE: CVE-2025-60876
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
networking/wget.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/networking/wget.c b/networking/wget.c
index ec3767793..fa555427b 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -536,6 +536,15 @@ static void parse_url(const char *src_url, struct host_info *h)
{
char *url, *p, *sp;
+ /* Fix for CVE-2025-60876 - don't allow control characters or spaces in the URL */
+ /* otherwise a malicious URL can be used to inject HTTP headers in the request */
+ const unsigned char *u = (void *) src_url;
+ while (*u) {
+ if (*u <= ' ')
+ bb_simple_error_msg_and_die("Unencoded control character found in the URL!");
+ u++;
+ }
+
free(h->allocated);
h->allocated = url = xstrdup(src_url);
--
2.47.3

3
package/busybox/busybox.mk
View File

@@ -19,6 +19,9 @@ BUSYBOX_IGNORE_CVES += CVE-2022-28391
# 0013-testsuite-tar-tests-fix-test-after-cve-2025-46394.patch
BUSYBOX_IGNORE_CVES += CVE-2025-46394
# 0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch
BUSYBOX_IGNORE_CVES += CVE-2025-60876
BUSYBOX_CFLAGS = \
$(TARGET_CFLAGS)