Bug 7016 - wget: investigate if wget is affected by "Poodle" (CVE-2014-3566)
Summary: wget: investigate if wget is affected by "Poodle" (CVE-2014-3566)
Status: VERIFIED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: connectivity (show other bugs)
Version: 1.8
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 1.8 M2
Assignee: Sona Sarmadi
QA Contact: Lucian Musat
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2014-12-03 07:03 UTC by Sona Sarmadi
Modified: 2015-03-18 12:12 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sona Sarmadi 2014-12-03 07:03:20 UTC 
Investigate if wget needs to be patched for SSLV3 vulnerability?
See:
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1276641.html

We need also investigate if we need to update documentation.
Comment 1 Sona Sarmadi 2015-01-05 20:09:51 UTC 
Wget *explicitely* asks for SSLv2 and SSLv3 in the default configuration when compiled with OpenSSL. There is a pacth avaiable "do not use SSLv3 except explicitely requested": 
http://lists.gnu.org/archive/html/bug-wget/2014-10/txtFVqLh6aCiB.txt

Reference:
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00074.html

I will test this pacth and send it to OE-core soon.
Comment 2 Sona Sarmadi 2015-01-05 21:29:08 UTC 
This patch seems to be already present in v1.16:

commit 6fc11e46ec736c0497b810a13b13430b7f15464b
Author: Tim Ruehsen <tim.ruehsen@gmx.de>
Date:   Thu Oct 16 20:44:56 2014 +0200

    do not use SSLv3 except explicitely requested
Comment 3 Sona Sarmadi 2015-01-05 21:31:44 UTC 
This patch seems to be already present in 1.16.
Comment 4 Lucian Musat 2015-03-18 12:12:33 UTC 
Verified as per third and fourth comment. Wget v1.16 has the SSLv3 patch.