|
Bugzilla – Full Text Bug Listing |
| Summary: | zypper proxy problem: Could not resolve host | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE 12.1 | Reporter: | Giuseppe Roberti <g.roberti> |
| Component: | libzypp | Assignee: | E-mail List <zypp-maintainers> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Critical | ||
| Priority: | P5 - None | CC: | mukul |
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | maint:released:sle11-sp2:47764 | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Deadline: | 2012-04-26 | ||
|
Description
Giuseppe Roberti
2012-01-11 12:51:25 UTC
Does the situation change, if special chars in proxy username and passwd are properly encoded in /etc/sysconfig/proxy? E.g '@'=>'%40' (http://www.blooberry.com/indexdot/html/topics/urlencoding.htm) 1.) From the security point of view, /etc/sysconfig/proxy should not contain proxy 'username:password' embedded in the URL, as the file is world-readable. The YaST proxy module e.g. would move 'username:password' to ~root/curlrc (read only for root). 2.) However, if 'username:password' are embedded in the proxy URL in /etc/sysconfig/proxy (http://user:pass@host:port), any special chars occurring in username:password (e.g. a '@') must be %-escaped. According to the log it looks like the not escaped '\@' in your proxy-username causes the error ('\@' escape does not work here, needs to be '%40'). Preferred solution would be of course using the yast proxy module to define the proxy settings. 3.) But there is also a bug in libzypps way of handling a correctly escaped 'username:password' in a /etc/sysconfig/proxy URL. libzypp will pass the embeded credentials to libcurl, and at the same time try to pass matching credentials found in ~/.curlrc too. This might confuse curl. This is fixed in libzyp-10.3.6. Embedded credentials will be preferred, .curlrc will be considered only if URL has no credentials embedded. *** Bug 731909 has been marked as a duplicate of this bug. *** The SWAMPID for this issue is 46449. This issue was rated as low. Please submit fixed packages until 2012-04-26. Also create a patchinfo file using this link: https://swamp.suse.de/webswamp/wf/46449 openSUSE-RU-2012:0696-1: An update that has 6 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 679322,710269,716972,719690,740764,749418 CVE References: Sources used: openSUSE 11.4 (src): libqdialogsolver1-1.3.0-11.2, libsatsolver-0.16.3-28.1, libzypp-8.13.5-15.1, libzypp-bindings-0.5.9-9.1, libzypp-testsuite-tools-4.2.11-9.1, zypper-1.5.9-12.1 Update released for: libzypp, libzypp-debuginfo, libzypp-debugsource, libzypp-devel, zypper, zypper-debuginfo, zypper-debugsource, zypper-log Products: SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SDK 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64) |