From ab5d8f297635412559e778e0e01b8763a664731e Mon Sep 17 00:00:00 2001 From: Samuel Dionne-Riel Date: Thu, 30 Apr 2026 15:54:27 -0400 Subject: [PATCH] busybox: Handle CVE-2025-60876 curl --silent -L \ 'https://lists.busybox.net/pipermail/busybox/2025-November.txt.gz' \ | gunzip \ | grep -B7 -A32 'Message-ID: <20251121092118.3562853-2-radoslav.kolev@suse.com>' \ > pkgs/os-specific/linux/busybox/CVE-2025-60876.patch --- .../linux/busybox/CVE-2025-60876.patch | 40 +++++++++++++++++++ pkgs/os-specific/linux/busybox/default.nix | 4 ++ 2 files changed, 44 insertions(+) create mode 100644 pkgs/os-specific/linux/busybox/CVE-2025-60876.patch diff --git a/pkgs/os-specific/linux/busybox/CVE-2025-60876.patch b/pkgs/os-specific/linux/busybox/CVE-2025-60876.patch new file mode 100644 index 000000000000..5fb197672f6d --- /dev/null +++ b/pkgs/os-specific/linux/busybox/CVE-2025-60876.patch @@ -0,0 +1,40 @@ +From radoslav.kolev at suse.com Fri Nov 21 09:21:18 2025 +From: radoslav.kolev at suse.com (Radoslav Kolev) +Date: Fri, 21 Nov 2025 11:21:18 +0200 +Subject: [PATCH v2 1/1] wget: don't allow control characters or spaces in the + URL +In-Reply-To: <20251121092118.3562853-1-radoslav.kolev@suse.com> +References: <20251121092118.3562853-1-radoslav.kolev@suse.com> +Message-ID: <20251121092118.3562853-2-radoslav.kolev@suse.com> + +Fixes CVE-2025-60876 malicious URL can be used to inject +HTTP headers in the request. + +Signed-off-by: Radoslav Kolev +Reviewed-by: Emmanuel Deloget +--- + networking/wget.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/networking/wget.c b/networking/wget.c +index ec3767793..fa555427b 100644 +--- a/networking/wget.c ++++ b/networking/wget.c +@@ -536,6 +536,15 @@ static void parse_url(const char *src_url, struct host_info *h) + { + char *url, *p, *sp; + ++ /* Fix for CVE-2025-60876 - don't allow control characters or spaces in the URL */ ++ /* otherwise a malicious URL can be used to inject HTTP headers in the request */ ++ const unsigned char *u = (void *) src_url; ++ while (*u) { ++ if (*u <= ' ') ++ bb_simple_error_msg_and_die("Unencoded control character found in the URL!"); ++ u++; ++ } ++ + free(h->allocated); + h->allocated = url = xstrdup(src_url); + +-- +2.51.1 diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix index 4155f345bc7e..25d43a0516fd 100644 --- a/pkgs/os-specific/linux/busybox/default.nix +++ b/pkgs/os-specific/linux/busybox/default.nix @@ -92,6 +92,10 @@ stdenv.mkDerivation rec { }) # https://lists.busybox.net/pipermail/busybox/2026-March/092010.html ./build-system-buffer-overflow.patch + + # [PATCH v2 1/1] wget: don't allow control characters or spaces in the URL + # https://lists.busybox.net/pipermail/busybox/2025-November/091840.html + ./CVE-2025-60876.patch ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;