russell@unturf.com 6784cdf1cf feat: add 39 outreach docs (batches 6-8)

Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
  strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
  zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
  wekan (3)

Mix of CWE-407 and CWE-312.

2026-04-14 17:06:28 -04:00

2.5 KiB

Raw Permalink Blame History

Wine — CWE-312 Disclosure Brief (wine-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One credential-logging defect in Wine's HTTP authentication layer. cache_basic_authorization() in dlls/wininet/http.c logs the raw username:password string verbatim via TRACE(), exposing HTTP Basic credentials to any process or log collector capturing Wine debug output.

The Defect

wine-0002 (PATCHED — HIGH): dlls/wininet/http.c:790

// cache_basic_authorization — fires on every HTTP Basic auth:
TRACE("caching authorization for %s:%s = %s\n",
      debugstr_w(host), debugstr_w(realm),
      debugstr_an(auth_data, auth_data_len));  // <-- logs username:password

auth_data is constructed at lines 1103-1105 as username:password in plain UTF-8, then passed directly to this function. Any user or process capturing Wine debug output with WINEDEBUG=+wininet receives full HTTP Basic credentials for every site the user authenticates against.

Impact

Wine handles HTTP Basic authentication for IE-compatibility components, Steam login flows, and many Win32 applications. WINEDEBUG=+wininet is commonly enabled for debugging network issues. Log files, syslog forwarders, crash reporters, and remote debugging sessions all capture these credentials. The exposure window extends as long as logs are retained.

The Fix

Replace debugstr_an(auth_data, auth_data_len) with a redacted placeholder. Host and realm remain visible for tracing; credentials are suppressed:

// Before
TRACE("caching authorization for %s:%s = %s\n",
      debugstr_w(host), debugstr_w(realm),
      debugstr_an(auth_data, auth_data_len));

// After
// CWE-312 fix: redact credential data from TRACE output.
TRACE("caching authorization for %s:%s = <redacted, len=%u>\n",
      debugstr_w(host), debugstr_w(realm), auth_data_len);

Patch

Fix available: defects/wine-0002/patch/wine-0002-basic-auth-credential-trace-leak.patch

Single-line change in dlls/wininet/http.c. Replaces the credential format specifier with a redacted length-only placeholder.

What We Ask

A patch is ready for review.

Confirm receipt and assign a reference on Wine Bugzilla or GitLab (wine/wine).
Assess severity — every HTTP Basic auth operation logs plaintext credentials at TRACE level.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the Wine team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Permalink Blame History