Bug 7016

Summary: wget: investigate if wget is affected by "Poodle" (CVE-2014-3566)
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: connectivityAssignee: Sona Sarmadi <sona.sarmadi>
Status: VERIFIED FIXED QA Contact: Lucian Musat <georgex.l.musat>
Severity: normal    
Priority: Medium+ CC: bogdanx.a.voiculescu, meta.mr.watcher, meta.watcher, sgw
Version: 1.8   
Target Milestone: 1.8 M2   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Don't know

Description Sona Sarmadi 2014-12-03 07:03:20 UTC 
Investigate if wget needs to be patched for SSLV3 vulnerability?
See:
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1276641.html

We need also investigate if we need to update documentation.
Comment 1 Sona Sarmadi 2015-01-05 20:09:51 UTC 
Wget *explicitely* asks for SSLv2 and SSLv3 in the default configuration when compiled with OpenSSL. There is a pacth avaiable "do not use SSLv3 except explicitely requested": 
http://lists.gnu.org/archive/html/bug-wget/2014-10/txtFVqLh6aCiB.txt

Reference:
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00074.html

I will test this pacth and send it to OE-core soon.
Comment 2 Sona Sarmadi 2015-01-05 21:29:08 UTC 
This patch seems to be already present in v1.16:

commit 6fc11e46ec736c0497b810a13b13430b7f15464b
Author: Tim Ruehsen <tim.ruehsen@gmx.de>
Date:   Thu Oct 16 20:44:56 2014 +0200

    do not use SSLv3 except explicitely requested
Comment 3 Sona Sarmadi 2015-01-05 21:31:44 UTC 
This patch seems to be already present in 1.16.
Comment 4 Lucian Musat 2015-03-18 12:12:33 UTC 
Verified as per third and fourth comment. Wget v1.16 has the SSLv3 patch.