Re: Vulnerability Report - 4 findings in GNU Wget 1.25.0

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------oPMYEvZwSZaHo15CqpZ54NqT
Content-Type: multipart/mixed; boundary="------------RXOZfADWvIKinU06MX0y66Wq";
 protected-headers="v1"
From: =?UTF-8?Q?Tim_R=C3=BChsen?= <[email protected]>
To: Tristan <[email protected]>
Cc: [email protected]
Message-ID: <[email protected]>
Subject: Re: Vulnerability Report - 4 findings in GNU Wget 1.25.0
References: <CAA1XrhOeUGDfVEM6xUm9m_BBLbVDyOo78F_=deu_eU655hzfCg@mail.gmail.com>
 <[email protected]>
 <CAA1XrhNfPRf1Vr_oq4FevTcH6DcwzEx9k-h_jktSYwmOm+BX0Q@mail.gmail.com>
In-Reply-To: <CAA1XrhNfPRf1Vr_oq4FevTcH6DcwzEx9k-h_jktSYwmOm+BX0Q@mail.gmail.com>

--------------RXOZfADWvIKinU06MX0y66Wq
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

SGkgVHJpc3Rhbg0KDQpNeSBiYWQsIHRoZSBjb21taXRzIHdlcmUgb25seSBwdXNoZWQgdG8g
aHR0cHM6Ly9naXRsYWIuY29tL2dudXdnZXQvd2dldC4NCk5vdyBwdXNoZWQgdGhlbSB0byBT
YXZhbm5haCBhcyB3ZWxsIChib3RoIHJlcG9zIGFyZSAvIHNob3VsZCBiZSBpbiBzeW5jKS4N
Cg0KQ29tbWl0cyBhcmUNCkF1dGhvcjogVGltIFLDvGhzZW4gPHRpbS5ydWVoc2VuQGdteC5k
ZT4NCkRhdGU6ICAgTW9uIEp1biAyOSAxOToxMzoxNSAyMDI2ICswMjAwDQoNCiAgICAgKiBz
cmMvY29udmVydC5jIChodG1sX3F1b3RlX3N0cmluZyk6IEZpeCBpbnRlZ2VyK2J1ZmZlciBv
dmVyZmxvdw0KDQogICAgIFJlcG9ydGVkLWJ5OiBUcmlzdGFuSW5TZWNAZ21haWwuY29tDQoN
CmNvbW1pdCA0M2QzYmE5MzM2YmM5NDkzN2U2ZmFlMjM2NWM2ZmZkMzBjMzRmZmNmDQpBdXRo
b3I6IFRpbSBSw7xoc2VuIDx0aW0ucnVlaHNlbkBnbXguZGU+DQpEYXRlOiAgIE1vbiBKdW4g
MjkgMTg6NTc6NTQgMjAyNiArMDIwMA0KDQogICAgICogc3JjL2h0dHAuYyAocGFyc2VfY29u
dGVudF9yYW5nZSk6IEZpeCBpbnRlZ2VyIG92ZXJmbG93DQoNCiAgICAgUmVwb3J0ZWQtYnk6
IFRyaXN0YW5JblNlY0BnbWFpbC5jb20NCg0KY29tbWl0IDM3YTQwZmNiNDUwMTUzZjY5NTM3
YzdjYmMyYTdhNGZiMGI2Zjc4MjYNCkF1dGhvcjogVGltIFLDvGhzZW4gPHRpbS5ydWVoc2Vu
QGdteC5kZT4NCkRhdGU6ICAgTW9uIEp1biAyOSAxODozMjowMiAyMDI2ICswMjAwDQoNCiAg
ICAgKiBzcmMvbWV0YWxpbmsuYyAoY2xlYW5fbWV0YWxpbmtfc3RyaW5nKTogRml4IGJ1ZmZl
ciB1bmRlcmZsb3cNCg0KICAgICBSZXBvcnRlZC1ieTogVHJpc3RhbkluU2VjQGdtYWlsLmNv
bQ0KDQogPiBSZWdhcmRpbmcgQ1ZFIGFzc2lnbm1lbnQsIHdvdWxkIHlvdSBiZSBoYW5kbGlu
ZyB0aGF0PyBJIGNvbGxhYm9yYXRlIHdpdGgNCiA+IGEgQ05BIGFuZCBjb3VsZCByZXF1ZXN0
IDQgSURzIGlmIHlvdSdkIHByZWZlci4NCg0KV2UgYXJlIG5vdCBkb2luZyBhbnkgQ1ZFIGFz
c2lnbm1lbnRzIChtb3N0bHkgZHVlIHRvIGxhY2sgb2YgdGltZSkuIEl0IA0Kd291bGQgYmUg
Z3JlYXQgaWYgeW91IGNvdWxkIHJlcXVlc3QgdGhlIDQgSURzLg0KDQogPiBGb3IgIzMsIGNv
dWxkIHlvdSBzaGFyZSB0aGUgY28tZGlzY292ZXJlcidzIG5hbWUgc28gSSBjYW4gaW5jbHVk
ZSBwcm9wZXINCiA+IGNyZWRpdCBpbiB0aGUgQ1ZFIHJlY29yZD8NCg0KUGxlYXNlIGZpbmQg
dGhlIGRldGFpbHMgaW4gY29tbWl0IGMyNjQwZmU1MTcxYzU5Zjg3YzU4ZGM5ZmNiMTk1YjJk
MThiMDEwZWUNCg0KUmVnYXJkcywgVGltDQoNCk9uIDYvMzAvMjYgMDA6NTMsIFRyaXN0YW4g
d3JvdGU6DQo+IEhpIFRpbSwNCj4gDQo+IFRoYW5rIHlvdSBmb3IgdGhlIHF1aWNrIGZpeGVz
LiBVbmRlcnN0b29kIG9uICMzIC0tIGdsYWQgaXQncyBjb3ZlcmVkLg0KPiANCj4gSSBkb24n
dCBzZWUgdGhlIGNvbW1pdHMgZm9yICMxLCAjMiwgYW5kICM0IG9uIFNhdmFubmFoIG1hc3Rl
ciB5ZXQgLS0gDQo+IGNvdWxkIHlvdSBsZXQgbWUga25vdyB3aGVuIHRoZXkncmUgcHVzaGVk
PyBJJ2QgbGlrZSB0byB2ZXJpZnkgdGhlIGZpeGVzIA0KPiBhbmQgd291bGQgYXBwcmVjaWF0
ZSBhIFJlcG9ydGVkLWJ5IHRhZyBpbiB0aGUgY29tbWl0IG1lc3NhZ2VzLg0KPiANCj4gUmVn
YXJkaW5nIENWRSBhc3NpZ25tZW50LCB3b3VsZCB5b3UgYmUgaGFuZGxpbmcgdGhhdD8gSSBj
b2xsYWJvcmF0ZSB3aXRoIA0KPiBhIENOQSBhbmQgY291bGQgcmVxdWVzdCA0IElEcyBpZiB5
b3UnZCBwcmVmZXIuDQo+IA0KPiBGb3IgIzMsIGNvdWxkIHlvdSBzaGFyZSB0aGUgY28tZGlz
Y292ZXJlcidzIG5hbWUgc28gSSBjYW4gaW5jbHVkZSBwcm9wZXIgDQo+IGNyZWRpdCBpbiB0
aGUgQ1ZFIHJlY29yZD8NCj4gDQo+IEJlc3QgcmVnYXJkcywNCj4gVHJpc3Rhbg0KPiANCj4g
TGXCoGx1bi4gMjkganVpbiAyMDI2IMOgwqAyMDozMCwgVGltIFLDvGhzZW4gPHRpbS5ydWVo
c2VuQGdteC5kZSANCj4gPG1haWx0bzp0aW0ucnVlaHNlbkBnbXguZGU+PiBhIMOpY3JpdMKg
Og0KPiANCj4gICAgIFRoYW5rIHlvdSB2ZXJ5IG11Y2ggZm9yIHRoZSByZXBvcnQocyksIFRy
aXN0YW4hDQo+IA0KPiAgICAgIzMgaGFzIGJlZW4gcmVwb3J0ZWQgcHJpdmF0ZWx5IGVhcmxp
ZXIgKGluY2x1ZGluZyBhIHBhdGNoKS4gVGhlIHBhdGNoDQo+ICAgICBoYXMgYmVlbiBtZXJn
ZWQgdG9kYXkuDQo+IA0KPiAgICAgIzEsICMyLCAjNCBoYXZlIGJlZW4gZml4ZWQgaW4gbWFz
dGVyIHRvZGF5IChwbGVhc2UgdGFrZSB0aGlzIGFzDQo+ICAgICBhY2tub3dsZWRnZW1lbnQg
Zm9yIHlvdXIgZmluZGluZ3MpLg0KPiANCj4gICAgIFJlZ2FyZHMsIFRpbQ0KPiANCj4gDQo+
ICAgICBPbiA2LzI3LzI2IDAwOjA2LCBUcmlzdGFuIHdyb3RlOg0KPiAgICAgID4gSGVsbG8s
DQo+ICAgICAgPg0KPiAgICAgID4gSSBhbSB3cml0aW5nIHRvIHJlcG9ydCA0IG1lbW9yeSBz
YWZldHkgdnVsbmVyYWJpbGl0aWVzIGluIEdOVSBXZ2V0DQo+ICAgICAgPiAxLjI1LjAsIGFs
bCBjb25maXJtZWQgcHJlc2VudCBhdCBtYXN0ZXIgSEVBRCBvbiBHTlUgU2F2YW5uYWgNCj4g
ICAgICgyMDI2LTA2LTIwKS4NCj4gICAgICA+IFRoZXNlIGNvdmVyIHRoZSBNZXRhbGluayBV
UkwgcGFyc2VyLCBIVFRQIENvbnRlbnQtUmFuZ2UgaGVhZGVyDQo+ICAgICBoYW5kbGluZywN
Cj4gICAgICA+IGljb252IGZpbGVuYW1lIGNvbnZlcnNpb24sIGFuZCBIVE1MIGxpbmsgY29u
dmVyc2lvbi4NCj4gICAgICA+DQo+ICAgICAgPiBTdW1tYXJ5IG9mIGZpbmRpbmdzOg0KPiAg
ICAgID4NCj4gICAgICA+IDEuIEhlYXAgYnVmZmVyIHVuZGVycmVhZCBpbiBjbGVhbl9tZXRh
bGlua19zdHJpbmcoKSAtLSBjcmFzaA0KPiAgICAgKENWU1MgNy41KQ0KPiAgICAgID4gMi4g
U2lnbmVkIGludGVnZXIgb3ZlcmZsb3cgaW4gcGFyc2VfY29udGVudF9yYW5nZSgpIC0tIFVC
L2Rlc3luYw0KPiAgICAgKENWU1MgNS4zKQ0KPiAgICAgID4gMy4gSGVhcCBidWZmZXIgb3Zl
cmZsb3cgaW4gY29udmVydF9mbmFtZSgpIGljb252IEUyQklHIGhhbmRsZXINCj4gICAgIChD
VlNTIDYuMSkNCj4gICAgICA+IDQuIEludGVnZXIgb3ZlcmZsb3cgaW4gaHRtbF9xdW90ZV9z
dHJpbmcoKSBzaXplIGNvdW50ZXIgKENWU1MgNS45KQ0KPiAgICAgID4NCj4gICAgICA+IEZp
bmRpbmdzICMxIGFuZCAjMiBhcmUgdHJpZ2dlcmVkIGJ5IGEgbWFsaWNpb3VzIHNlcnZlciB3
aXRob3V0IHVzZXINCj4gICAgICA+IGludGVyYWN0aW9uIGJleW9uZCBpbml0aWF0aW5nIHRo
ZSBkb3dubG9hZC4gRmluZGluZyAjMyByZXF1aXJlcw0KPiAgICAgID4gLS1yZW1vdGUtZW5j
b2Rpbmcgb3IgSVJJIG1vZGUuIEZpbmRpbmcgIzQgcmVxdWlyZXMgcmVjdXJzaXZlIGRvd25s
b2FkDQo+ICAgICAgPiB3aXRoIC0tY29udmVydC1saW5rcyBhbmQgYSB2ZXJ5IGxhcmdlIEhU
TUwgYXR0cmlidXRlLg0KPiAgICAgID4NCj4gICAgICA+IEFsbCA0IGhhdmUgYmVlbiBsYWIt
dmVyaWZpZWQgd2l0aCBBZGRyZXNzU2FuaXRpemVyIGFuZC9vcg0KPiAgICAgID4gVW5kZWZp
bmVkQmVoYXZpb3JTYW5pdGl6ZXIuIEluZGl2aWR1YWwgZGV0YWlscyBhcmUgYXR0YWNoZWQu
DQo+ICAgICAgPg0KPiAgICAgID4gSSB3b3VsZCBhcHByZWNpYXRlIGFuIGFja25vd2xlZGdt
ZW50IG9mIHJlY2VpcHQgYW5kIENWRQ0KPiAgICAgYXNzaWdubWVudCBmb3INCj4gICAgICA+
IGVhY2ggY29uZmlybWVkIGZpbmRpbmcuDQo+ICAgICAgPg0KPiAgICAgID4gVGhhbmsgeW91
IGFuZCBwbGVhc2UgbGV0IG1lIGtub3cgaWYgeW91IG5lZWQgYW55dGhpbmcgZWxzZS4NCj4g
ICAgICA+DQo+ICAgICAgPiBSZWdhcmRzLA0KPiAgICAgID4gVHJpc3Rhbg0KPiANCg0K

--------------RXOZfADWvIKinU06MX0y66Wq--

--------------oPMYEvZwSZaHo15CqpZ54NqT
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEHLJ9vJhhSy1YQWRtCDAttqJnBCgFAmpDaj4FAwAAAAAACgkQCDAttqJnBCgR
QQ//Tt4r0jCvzywsuoXZFST0MCO1tHLEQR5V/MZDwkNwzni03ooKUcTJOY11BjgCQzIpKIH0JJZz
876wArGDOjr0KBgWL990fCDB+rkKzH3F95hMje4i9AT2X7wzazSHFZmFdd2/OQmlCbCDonyQ8TRm
lbdRPKlelA/v2bf7Rf8olzZ4P7PtDLj6QfojhIQOehimxVPHXmMOX77vZHgXIpewE/KHeynfOx+y
AqRigmzXtAROGuPZz/YvqgASySPZshi2M6STipuHNAjDJRe3O2ETQ/u4KT70qBegwIhO+oOusCqA
gk954e/Zl5svxQc69hEmeXCbzyZaayfecfKGKCQvzLXI/BKJGDZ8JRfZnEVEKV3PLqMsiiqFVxOe
8eXx+Ud0ZZj/zScg4YgdEKavg4WxLfP7ENcQ4mr5ueBfucXGo4Xj0CJP7mqXHo2i5pfA7p7tRAoB
I7HItkwNc9STdJfNwVeSYDOP8KwCUFRS+aagHzTFvCwpwoee4P8DEodPpidfHY+5EU8CtWvgIk5Q
KWIVSiSqkUaDjjWjX+cEFd/quVkSDhvVl0IcpHzI3IGlT3UBDRdnsbIkaH7gkTe3XNBEVcMctQMz
WJ++9AAvfXi/wLEDHx3MBnUUbQ/n0un8jJZGHinS96eecjsalLhjYWH1GXeURlfJDZstQwmeHw11
Q8A=
=ixw/
-----END PGP SIGNATURE-----

--------------oPMYEvZwSZaHo15CqpZ54NqT--