summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/curl/curl/CVE-2021-22946.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-support/curl/curl/CVE-2021-22946.patch')
-rw-r--r--meta/recipes-support/curl/curl/CVE-2021-22946.patch328
1 files changed, 328 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2021-22946.patch b/meta/recipes-support/curl/curl/CVE-2021-22946.patch
new file mode 100644
index 0000000000..98032d8b78
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2021-22946.patch
@@ -0,0 +1,328 @@
1Backport of:
2
3From 96d71feb27e533a8b337512841a537952916262c Mon Sep 17 00:00:00 2001
4From: Patrick Monnerat <patrick@monnerat.net>
5Date: Wed, 8 Sep 2021 11:56:22 +0200
6Subject: [PATCH] ftp,imap,pop3: do not ignore --ssl-reqd
7
8In imap and pop3, check if TLS is required even when capabilities
9request has failed.
10
11In ftp, ignore preauthentication (230 status of server greeting) if TLS
12is required.
13
14Bug: https://curl.se/docs/CVE-2021-22946.html
15Upstream-Status: backport from 7.68.0-1ubuntu2.7
16Signed-off-by: Mike Crowe <mac@mcrowe.com>
17CVE: CVE-2021-22946
18---
19 lib/ftp.c | 9 ++++---
20 lib/imap.c | 24 ++++++++----------
21 lib/pop3.c | 33 +++++++++++-------------
22 tests/data/Makefile.inc | 2 ++
23 tests/data/test984 | 56 +++++++++++++++++++++++++++++++++++++++++
24 tests/data/test985 | 54 +++++++++++++++++++++++++++++++++++++++
25 tests/data/test986 | 53 ++++++++++++++++++++++++++++++++++++++
26 7 files changed, 195 insertions(+), 36 deletions(-)
27 create mode 100644 tests/data/test984
28 create mode 100644 tests/data/test985
29 create mode 100644 tests/data/test986
30
31diff --git a/lib/ftp.c b/lib/ftp.c
32index 677527f..91b43d8 100644
33--- a/lib/ftp.c
34+++ b/lib/ftp.c
35@@ -2606,9 +2606,12 @@ static CURLcode ftp_statemach_act(struct connectdata *conn)
36 /* we have now received a full FTP server response */
37 switch(ftpc->state) {
38 case FTP_WAIT220:
39- if(ftpcode == 230)
40- /* 230 User logged in - already! */
41- return ftp_state_user_resp(conn, ftpcode, ftpc->state);
42+ if(ftpcode == 230) {
43+ /* 230 User logged in - already! Take as 220 if TLS required. */
44+ if(data->set.use_ssl <= CURLUSESSL_TRY ||
45+ conn->bits.ftp_use_control_ssl)
46+ return ftp_state_user_resp(conn, ftpcode, ftpc->state);
47+ }
48 else if(ftpcode != 220) {
49 failf(data, "Got a %03d ftp-server response when 220 was expected",
50 ftpcode);
51diff --git a/lib/imap.c b/lib/imap.c
52index 66172bd..9880ce1 100644
53--- a/lib/imap.c
54+++ b/lib/imap.c
55@@ -917,22 +917,18 @@ static CURLcode imap_state_capability_resp(struct connectdata *conn,
56 line += wordlen;
57 }
58 }
59- else if(imapcode == IMAP_RESP_OK) {
60- if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
61- /* We don't have a SSL/TLS connection yet, but SSL is requested */
62- if(imapc->tls_supported)
63- /* Switch to TLS connection now */
64- result = imap_perform_starttls(conn);
65- else if(data->set.use_ssl == CURLUSESSL_TRY)
66- /* Fallback and carry on with authentication */
67- result = imap_perform_authentication(conn);
68- else {
69- failf(data, "STARTTLS not supported.");
70- result = CURLE_USE_SSL_FAILED;
71- }
72+ else if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
73+ /* PREAUTH is not compatible with STARTTLS. */
74+ if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) {
75+ /* Switch to TLS connection now */
76+ result = imap_perform_starttls(conn);
77 }
78- else
79+ else if(data->set.use_ssl <= CURLUSESSL_TRY)
80 result = imap_perform_authentication(conn);
81+ else {
82+ failf(data, "STARTTLS not available.");
83+ result = CURLE_USE_SSL_FAILED;
84+ }
85 }
86 else
87 result = imap_perform_authentication(conn);
88diff --git a/lib/pop3.c b/lib/pop3.c
89index 57c1373..145b2b4 100644
90--- a/lib/pop3.c
91+++ b/lib/pop3.c
92@@ -721,28 +721,23 @@ static CURLcode pop3_state_capa_resp(struct connectdata *conn, int pop3code,
93 }
94 }
95 }
96- else if(pop3code == '+') {
97- if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
98- /* We don't have a SSL/TLS connection yet, but SSL is requested */
99- if(pop3c->tls_supported)
100- /* Switch to TLS connection now */
101- result = pop3_perform_starttls(conn);
102- else if(data->set.use_ssl == CURLUSESSL_TRY)
103- /* Fallback and carry on with authentication */
104- result = pop3_perform_authentication(conn);
105- else {
106- failf(data, "STLS not supported.");
107- result = CURLE_USE_SSL_FAILED;
108- }
109- }
110- else
111- result = pop3_perform_authentication(conn);
112- }
113 else {
114 /* Clear text is supported when CAPA isn't recognised */
115- pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
116+ if(pop3code != '+')
117+ pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
118
119- result = pop3_perform_authentication(conn);
120+ if(!data->set.use_ssl || conn->ssl[FIRSTSOCKET].use)
121+ result = pop3_perform_authentication(conn);
122+ else if(pop3code == '+' && pop3c->tls_supported)
123+ /* Switch to TLS connection now */
124+ result = pop3_perform_starttls(conn);
125+ else if(data->set.use_ssl <= CURLUSESSL_TRY)
126+ /* Fallback and carry on with authentication */
127+ result = pop3_perform_authentication(conn);
128+ else {
129+ failf(data, "STLS not supported.");
130+ result = CURLE_USE_SSL_FAILED;
131+ }
132 }
133
134 return result;
135diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
136index f9535a6..0fa6799 100644
137--- a/tests/data/Makefile.inc
138+++ b/tests/data/Makefile.inc
139@@ -112,6 +112,8 @@ test945 test946 test947 test948 test949 test950 test951 test952 test953 \
140 test954 test955 test956 test957 test958 test959 test960 test961 test962 \
141 test963 test964 test965 test966 test967 test968 test969 \
142 \
143+test984 test985 test986 \
144+\
145 test1000 test1001 test1002 test1003 test1004 test1005 test1006 test1007 \
146 test1008 test1009 test1010 test1011 test1012 test1013 test1014 test1015 \
147 test1016 test1017 test1018 test1019 test1020 test1021 test1022 test1023 \
148diff --git a/tests/data/test984 b/tests/data/test984
149new file mode 100644
150index 0000000..e573f23
151--- /dev/null
152+++ b/tests/data/test984
153@@ -0,0 +1,56 @@
154+<testcase>
155+<info>
156+<keywords>
157+IMAP
158+STARTTLS
159+</keywords>
160+</info>
161+
162+#
163+# Server-side
164+<reply>
165+<servercmd>
166+REPLY CAPABILITY A001 BAD Not implemented
167+</servercmd>
168+</reply>
169+
170+#
171+# Client-side
172+<client>
173+<features>
174+SSL
175+</features>
176+<server>
177+imap
178+</server>
179+ <name>
180+IMAP require STARTTLS with failing capabilities
181+ </name>
182+ <command>
183+imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T log/upload%TESTNUMBER -u user:secret --ssl-reqd
184+</command>
185+<file name="log/upload%TESTNUMBER">
186+Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
187+From: Fred Foobar <foobar@example.COM>
188+Subject: afternoon meeting
189+To: joe@example.com
190+Message-Id: <B27397-0100000@example.COM>
191+MIME-Version: 1.0
192+Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
193+
194+Hello Joe, do you think we can meet at 3:30 tomorrow?
195+</file>
196+</client>
197+
198+#
199+# Verify data after the test has been "shot"
200+<verify>
201+# 64 is CURLE_USE_SSL_FAILED
202+<errorcode>
203+64
204+</errorcode>
205+<protocol>
206+A001 CAPABILITY
207+</protocol>
208+</verify>
209+</testcase>
210diff --git a/tests/data/test985 b/tests/data/test985
211new file mode 100644
212index 0000000..d0db4aa
213--- /dev/null
214+++ b/tests/data/test985
215@@ -0,0 +1,54 @@
216+<testcase>
217+<info>
218+<keywords>
219+POP3
220+STARTTLS
221+</keywords>
222+</info>
223+
224+#
225+# Server-side
226+<reply>
227+<servercmd>
228+REPLY CAPA -ERR Not implemented
229+</servercmd>
230+<data nocheck="yes">
231+From: me@somewhere
232+To: fake@nowhere
233+
234+body
235+
236+--
237+ yours sincerely
238+</data>
239+</reply>
240+
241+#
242+# Client-side
243+<client>
244+<features>
245+SSL
246+</features>
247+<server>
248+pop3
249+</server>
250+ <name>
251+POP3 require STARTTLS with failing capabilities
252+ </name>
253+ <command>
254+pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --ssl-reqd
255+ </command>
256+</client>
257+
258+#
259+# Verify data after the test has been "shot"
260+<verify>
261+# 64 is CURLE_USE_SSL_FAILED
262+<errorcode>
263+64
264+</errorcode>
265+<protocol>
266+CAPA
267+</protocol>
268+</verify>
269+</testcase>
270diff --git a/tests/data/test986 b/tests/data/test986
271new file mode 100644
272index 0000000..a709437
273--- /dev/null
274+++ b/tests/data/test986
275@@ -0,0 +1,53 @@
276+<testcase>
277+<info>
278+<keywords>
279+FTP
280+STARTTLS
281+</keywords>
282+</info>
283+
284+#
285+# Server-side
286+<reply>
287+<servercmd>
288+REPLY welcome 230 Welcome
289+REPLY AUTH 500 unknown command
290+</servercmd>
291+</reply>
292+
293+# Client-side
294+<client>
295+<features>
296+SSL
297+</features>
298+<server>
299+ftp
300+</server>
301+ <name>
302+FTP require STARTTLS while preauthenticated
303+ </name>
304+<file name="log/test%TESTNUMBER.txt">
305+data
306+ to
307+ see
308+that FTPS
309+works
310+ so does it?
311+</file>
312+ <command>
313+--ssl-reqd --ftp-ssl-control ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T log/test%TESTNUMBER.txt -u user:secret
314+</command>
315+</client>
316+
317+# Verify data after the test has been "shot"
318+<verify>
319+# 64 is CURLE_USE_SSL_FAILED
320+<errorcode>
321+64
322+</errorcode>
323+<protocol>
324+AUTH SSL
325+AUTH TLS
326+</protocol>
327+</verify>
328+</testcase>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-08 14:15:44 +0000