1 files changed, 90 insertions, 0 deletions

diff --git a/meta/recipes-support/curl/curl/CVE-2015-3153.patch b/meta/recipes-support/curl/curl/CVE-2015-3153.patch
new file mode 100644
index 0000000000..089020a842
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2015-3153.patch
@@ -0,0 +1,90 @@
+From 69a2e8d7ec581695a62527cb2252e7350f314ffa Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 23 Apr 2015 15:58:21 +0200
+Subject: [PATCH] CURLOPT_HEADEROPT: default to separate
+
+Make the HTTP headers separated by default for improved security and
+reduced risk for information leakage.
+
+Bug: http://curl.haxx.se/docs/adv_20150429.html
+Reported-by: Yehezkel Horowitz, Oren Souroujon
+---
+ docs/libcurl/opts/CURLOPT_HEADEROPT.3 | 12 ++++++------
+ lib/url.c                             |  1 +
+ tests/data/test1527                   |  2 +-
+ tests/data/test287                    |  2 +-
+ tests/libtest/lib1527.c               |  1 +
+ 5 files changed, 10 insertions(+), 8 deletions(-)
+
+Index: curl-7.37.1/docs/libcurl/opts/CURLOPT_HEADEROPT.3
+===================================================================
+--- curl-7.37.1.orig/docs/libcurl/opts/CURLOPT_HEADEROPT.3
++++ curl-7.37.1/docs/libcurl/opts/CURLOPT_HEADEROPT.3
+@@ -5,7 +5,7 @@
+ .\" *                            | (__| |_| |  _ <| |___
+ .\" *                             \___|\___/|_| \_\_____|
+ .\" *
+-.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
++.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
+ .\" *
+ .\" * This software is licensed as described in the file COPYING, which
+ .\" * you should have received as part of this distribution. The terms
+@@ -44,7 +44,7 @@ headers. When doing CONNECT, libcurl wil
+ headers only do the proxy and then \fICURLOPT_HTTPHEADER(3)\fP headers only to
+ the server.
+ .SH DEFAULT
+-CURLHEADER_UNIFIED
++CURLHEADER_SEPARATE (changed in 7.42.1, ased CURLHEADER_UNIFIED before then)
+ .SH PROTOCOLS
+ HTTP
+ .SH EXAMPLE
+Index: curl-7.37.1/tests/data/test1527
+===================================================================
+--- curl-7.37.1.orig/tests/data/test1527
++++ curl-7.37.1/tests/data/test1527
+@@ -45,7 +45,7 @@ http-proxy
+ lib1527
+ </tool>
+  <name>
+-Check same headers are generated without CURLOPT_PROXYHEADER
++Check same headers are generated with CURLOPT_HEADEROPT == CURLHEADER_UNIFIED
+  </name>
+  <command>
+  http://the.old.moo.1527:%HTTPPORT/1527 %HOSTIP:%PROXYPORT
+Index: curl-7.37.1/tests/data/test287
+===================================================================
+--- curl-7.37.1.orig/tests/data/test287
++++ curl-7.37.1/tests/data/test287
+@@ -28,7 +28,7 @@ http
+ HTTP proxy CONNECT with custom User-Agent header
+  </name>
+  <command>
+-http://test.remote.example.com.287:%HTTPPORT/path/287 -H "User-Agent: looser/2007" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel
++http://test.remote.example.com.287:%HTTPPORT/path/287 -H "User-Agent: looser/2015" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel --proxy-header "User-Agent: looser/2007"
+ </command>
+ </client>
+ 
+Index: curl-7.37.1/tests/libtest/lib1527.c
+===================================================================
+--- curl-7.37.1.orig/tests/libtest/lib1527.c
++++ curl-7.37.1/tests/libtest/lib1527.c
+@@ -83,6 +83,7 @@ int test(char *URL)
+   test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
+   test_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+   test_setopt(curl, CURLOPT_INFILESIZE, strlen(data));
++  test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED);
+ 
+   res = curl_easy_perform(curl);
+ 
+Index: curl-7.37.1/lib/url.c
+===================================================================
+--- curl-7.37.1.orig/lib/url.c
++++ curl-7.37.1/lib/url.c
+@@ -584,6 +584,7 @@ CURLcode Curl_init_userdefined(struct Us
+   set->ssl_enable_alpn = TRUE;
+ 
+   set->expect_100_timeout = 1000L; /* Wait for a second by default. */
++  set->sep_headers = TRUE; /* separated header lists by default */
+   return res;
+ }
+