Bug 807073 (CVE-2021-38165)

Summary:	<www-client/lynx-2.9.0_pre9: cleartext credential transmission (CVE-2021-38165)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	maintainer-needed
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.openwall.com/lists/oss-security/2021/08/07/1
Whiteboard:	B4 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	813252
Bug Blocks:

Description John Helmert III archtester

2021-08-07 23:54:28 UTC

CVE-2021-38165:

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

Fix is in 2.9.0dev.9.

Comment 1 Larry the Git Cow gentoo-dev

2021-08-29 22:22:19 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=602cfa4ff490b20c9aacb710d53855b9727b9f86

commit 602cfa4ff490b20c9aacb710d53855b9727b9f86
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2021-08-29 22:13:32 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2021-08-29 22:22:04 +0000

    www-client/lynx: add 2.9.0_pre9
    
    Also update patches, bump to EAPI=8, drop USE={unicode,ipv6}.
    
    Bug: https://bugs.gentoo.org/807073
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 www-client/lynx/Manifest                           |  1 +
 www-client/lynx/files/lynx-2.9.0_pre9-mint.patch   | 11 +++
 .../lynx/files/lynx-2.9.0_pre9-parallel.patch      | 69 +++++++++++++++
 www-client/lynx/lynx-2.9.0_pre9.ebuild             | 98 ++++++++++++++++++++++
 4 files changed, 179 insertions(+)

Comment 2 John Helmert III archtester

2021-08-29 22:26:35 UTC

Let's give it a little time to stew.

Note the ebuild maps pre ebuilds to upstream's dev releases:

case ${PV} in
    *_pre*) MY_P="${PN}${PV/_pre/dev.}" ;;
    *_rc*)  MY_P="${PN}${PV/_rc/pre.}" ;;
    *_p*|*) MY_P="${PN}${PV/_p/rel.}" ;;
esac