79299da8c4
Release notes: https://lists.gnu.org/archive/html/bug-wget/2024-11/msg00002.html Fixes the following vulnerabilities: - CVE-2024-38428: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. https://nvd.nist.gov/vuln/detail/CVE-2024-38428 - CVE-2024-10524: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. https://www.openwall.com/lists/oss-security/2024/11/18/6 Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 295b2c4f8ecaf0b6e03725a6c8412795e91888c8) [Peter: mark as security bump] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
76 lines
1.8 KiB
Makefile
76 lines
1.8 KiB
Makefile
################################################################################
|
|
#
|
|
# wget
|
|
#
|
|
################################################################################
|
|
|
|
WGET_VERSION = 1.25.0
|
|
WGET_SOURCE = wget-$(WGET_VERSION).tar.lz
|
|
WGET_SITE = $(BR2_GNU_MIRROR)/wget
|
|
WGET_DEPENDENCIES = host-pkgconf
|
|
WGET_LICENSE = GPL-3.0+
|
|
WGET_LICENSE_FILES = COPYING
|
|
WGET_CPE_ID_VENDOR = gnu
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBPSL),y)
|
|
WGET_CONF_OPTS += --with-libpsl
|
|
WGET_DEPENDENCIES += libpsl
|
|
else
|
|
WGET_CONF_OPTS += --without-libpsl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_GNUTLS),y)
|
|
WGET_CONF_OPTS += --with-ssl=gnutls
|
|
WGET_DEPENDENCIES += gnutls
|
|
else ifeq ($(BR2_PACKAGE_OPENSSL),y)
|
|
WGET_CONF_OPTS += --with-ssl=openssl
|
|
WGET_DEPENDENCIES += openssl
|
|
else
|
|
WGET_CONF_OPTS += --without-ssl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBICONV),y)
|
|
WGET_DEPENDENCIES += libiconv
|
|
endif
|
|
|
|
# BR2_ENABLE_LOCALE and BR2_PACKAGE_LIBICONV are mutually exclusive
|
|
ifeq ($(BR2_ENABLE_LOCALE)$(BR2_PACKAGE_LIBICONV)$(BR2_PACKAGE_LIBIDN2),yy)
|
|
WGET_CONF_OPTS += --enable-iri
|
|
WGET_DEPENDENCIES += libidn2
|
|
else
|
|
WGET_CONF_OPTS += --disable-iri
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_UTIL_LINUX_LIBUUID),y)
|
|
WGET_CONF_OPTS += --with-libuuid
|
|
WGET_DEPENDENCIES += util-linux
|
|
else
|
|
WGET_CONF_OPTS += --without-libuuid
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
WGET_CONF_OPTS += --with-zlib
|
|
WGET_DEPENDENCIES += zlib
|
|
else
|
|
WGET_CONF_OPTS += --without-zlib
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_C_ARES),y)
|
|
WGET_CONF_OPTS += --with-cares
|
|
WGET_DEPENDENCIES += c-ares
|
|
else
|
|
WGET_CONF_OPTS += --without-cares
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_PCRE2),y)
|
|
WGET_CONF_OPTS += --disable-pcre --enable-pcre2
|
|
WGET_DEPENDENCIES += pcre2
|
|
else ifeq ($(BR2_PACKAGE_PCRE),y)
|
|
WGET_CONF_OPTS += --enable-pcre --disable-pcre2
|
|
WGET_DEPENDENCIES += pcre
|
|
else
|
|
WGET_CONF_OPTS += --disable-pcre --disable-pcre2
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|