{"action":"created","issue":{"url":"https://api.github.com/repos/warmcat/libwebsockets/issues/237","labels_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/237/labels{/name}","comments_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/237/comments","events_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/237/events","html_url":"https://github.com/warmcat/libwebsockets/issues/237","id":55738657,"number":237,"title":"Security issue with gethostbyname","user":{"login":"JoakimSoderberg","id":1446626,"avatar_url":"https://avatars.githubusercontent.com/u/1446626?v=3","gravatar_id":"","url":"https://api.github.com/users/JoakimSoderberg","html_url":"https://github.com/JoakimSoderberg","followers_url":"https://api.github.com/users/JoakimSoderberg/followers","following_url":"https://api.github.com/users/JoakimSoderberg/following{/other_user}","gists_url":"https://api.github.com/users/JoakimSoderberg/gists{/gist_id}","starred_url":"https://api.github.com/users/JoakimSoderberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JoakimSoderberg/subscriptions","organizations_url":"https://api.github.com/users/JoakimSoderberg/orgs","repos_url":"https://api.github.com/users/JoakimSoderberg/repos","events_url":"https://api.github.com/users/JoakimSoderberg/events{/privacy}","received_events_url":"https://api.github.com/users/JoakimSoderberg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-28T10:28:55Z","updated_at":"2015-01-28T13:21:52Z","closed_at":null,"body":"All use of gethostbyname should be replaced with getaddrinfo.\r\n\r\nMore information on security issue: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235\r\n\r\nUses in code:\r\nhttps://github.com/warmcat/libwebsockets/blob/6a779771f408856221243122de80e15d1b6f9a8e/lib/libwebsockets.c#L379\r\n\r\nhttps://github.com/warmcat/libwebsockets/blob/23bb7fc8d43117bc2974fd20c792ca6c9819e147/lib/lws-plat-win.c#L255\r\n\r\nhttps://github.com/warmcat/libwebsockets/blob/6a779771f408856221243122de80e15d1b6f9a8e/lib/libwebsockets.c#L379\r\n\r\ngethostbyname Deprecated:\r\nhttp://beej.us/guide/bgnet/output/html/singlepage/bgnet.html#gethostbynameman\r\n\r\n\"PLEASE NOTE: these two functions are superseded by getaddrinfo() and getnameinfo()! In particular, gethostbyname() doesn't work well with IPv6.\"\r\n\r\nhttp://www.kutukupret.com/2009/09/28/gethostbyname-vs-getaddrinfo/"},"comment":{"url":"https://api.github.com/repos/warmcat/libwebsockets/issues/comments/71833478","html_url":"https://github.com/warmcat/libwebsockets/issues/237#issuecomment-71833478","issue_url":"https://api.github.com/repos/warmcat/libwebsockets/issues/237","id":71833478,"user":{"login":"warmcat","id":1497695,"avatar_url":"https://avatars.githubusercontent.com/u/1497695?v=3","gravatar_id":"","url":"https://api.github.com/users/warmcat","html_url":"https://github.com/warmcat","followers_url":"https://api.github.com/users/warmcat/followers","following_url":"https://api.github.com/users/warmcat/following{/other_user}","gists_url":"https://api.github.com/users/warmcat/gists{/gist_id}","starred_url":"https://api.github.com/users/warmcat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/warmcat/subscriptions","organizations_url":"https://api.github.com/users/warmcat/orgs","repos_url":"https://api.github.com/users/warmcat/repos","events_url":"https://api.github.com/users/warmcat/events{/privacy}","received_events_url":"https://api.github.com/users/warmcat/received_events","type":"User","site_admin":false},"created_at":"2015-01-28T13:21:52Z","updated_at":"2015-01-28T13:21:52Z","body":"I pushed improvements to libwebsockets_get_peer_addresses and client-handshake that modernize away gethostbyname and checked it on ipv6 and ipv4-only.\r\n\r\nAs I said I left the Windows one, I can't test any changes and it's not affected by the CVE, although getting rid of it won't hurt if someone wants to do so.\r\n\r\nThe CI builds are super slow this time of day but enough passed after 15m it can't be that bad."}}