diff --git a/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input/main.fmf b/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input/main.fmf new file mode 100644 index 0000000..d332e96 --- /dev/null +++ b/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input/main.fmf @@ -0,0 +1,26 @@ +summary: 'Test for: JIRA: RHEL-43559 (CVE-2024-38428 wget: Misinterpretation of input + may lead to improper behavior [rhel-8.10.z])' +description: 'CVE-2024-38428 wget: Misinterpretation of input may lead to improper + behavior [rhel-8.10.z]' +contact: Ondrej Mejzlik +test: ./runtest.sh +framework: beakerlib +duration: 5m +enabled: true +tag: + - NoRHEL7 + - Tier1 +tier: '1' +adjust: + - enabled: false + when: distro < rhel-8 + continue: false + - enabled: false + when: distro = rhel-alt-7 + continue: false +component: + - wget +recommend: + - wget +link: + - verifies: https://issues.redhat.com/browse/RHEL-43559 diff --git a/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input/runtest.sh b/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input/runtest.sh new file mode 100755 index 0000000..af14d3e --- /dev/null +++ b/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input/runtest.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/wget/Security/RHEL-43559-CVE-2024-38428-wget-Misinterpretation-of-input +# Description: Test for JIRA: RHEL-43559 (CVE-2024-38428 wget: Misinterpretation of input may lead to improper behavior [rhel-8.10.z]) +# Author: Ondrej Mejzlik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE=${PACKAGE:-wget} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE || rlDie "Package $PACKAGE not installed" + rlLog "Arch: $(arch), PC name: $(hostname), $(hostname -A) User: $(whoami)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" 0 "Going into tmp directory $TmpDir" + rlPhaseEnd + + rlGetTestState && { + rlPhaseStartTest + rlRun "wget 'a;bc@xyz' &> log" 4 "Run wget" + cat log + rlAssertNotGrep 'wget: unable to resolve host address ‘a;bc@xyz’' log + rlAssertGrep 'wget: unable to resolve host address ‘xyz’' log + rlPhaseEnd + } + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd