From 073c6af03e765c930e01da56c78f2770bdfb52a6 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 15 Feb 2026 15:17:16 +0100 Subject: [PATCH] package/busybox: patch CVE-2025-60876 This commit fixes the following vulenerability: - CVE-2025-60876: BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20). For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-60876 - https://lists.busybox.net/pipermail/busybox/2025-November/091840.html - https://sources.debian.org/data/main/b/busybox/1%3A1.37.0-10/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain --- ...trol-characters-or-spaces-in-the-URL.patch | 42 +++++++++++++++++++ package/busybox/busybox.mk | 3 ++ 2 files changed, 45 insertions(+) create mode 100644 package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch diff --git a/package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch b/package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch new file mode 100644 index 0000000000..d0a31ed821 --- /dev/null +++ b/package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch @@ -0,0 +1,42 @@ +From: Radoslav Kolev +Date: Fri, 21 Nov 2025 11:21:18 +0200 +Subject: wget: don't allow control characters or spaces in the URL +Forwarded: yes, https://lists.busybox.net/pipermail/busybox/2025-November/091840.html +Bug-Debian: https://bugs.debian.org/1120795 + +Fixes CVE-2025-60876 malicious URL can be used to inject +HTTP headers in the request. + +Signed-off-by: Radoslav Kolev +Reviewed-by: Emmanuel Deloget +Upstream: https://sources.debian.org/data/main/b/busybox/1%3A1.37.0-10/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch +Upstream: https://lists.busybox.net/pipermail/busybox/2025-November/091840.html +CVE: CVE-2025-60876 +Signed-off-by: Thomas Perale +--- + networking/wget.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/networking/wget.c b/networking/wget.c +index ec3767793..fa555427b 100644 +--- a/networking/wget.c ++++ b/networking/wget.c +@@ -536,6 +536,15 @@ static void parse_url(const char *src_url, struct host_info *h) + { + char *url, *p, *sp; + ++ /* Fix for CVE-2025-60876 - don't allow control characters or spaces in the URL */ ++ /* otherwise a malicious URL can be used to inject HTTP headers in the request */ ++ const unsigned char *u = (void *) src_url; ++ while (*u) { ++ if (*u <= ' ') ++ bb_simple_error_msg_and_die("Unencoded control character found in the URL!"); ++ u++; ++ } ++ + free(h->allocated); + h->allocated = url = xstrdup(src_url); + +-- +2.47.3 + diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk index 7ae9c1d41e..a33548c355 100644 --- a/package/busybox/busybox.mk +++ b/package/busybox/busybox.mk @@ -19,6 +19,9 @@ BUSYBOX_IGNORE_CVES += CVE-2022-28391 # 0013-testsuite-tar-tests-fix-test-after-cve-2025-46394.patch BUSYBOX_IGNORE_CVES += CVE-2025-46394 +# 0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch +BUSYBOX_IGNORE_CVES += CVE-2025-60876 + BUSYBOX_CFLAGS = \ $(TARGET_CFLAGS)