summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-support/curl/curl/CVE-2022-22576.patch148
-rw-r--r--meta/recipes-support/curl/curl/CVE-2022-27775.patch39
-rw-r--r--meta/recipes-support/curl/curl/CVE-2022-27776.patch114
-rw-r--r--meta/recipes-support/curl/curl_7.69.1.bb3
4 files changed, 304 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2022-22576.patch b/meta/recipes-support/curl/curl/CVE-2022-22576.patch
new file mode 100644
index 0000000000..13479e7f0e
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-22576.patch
@@ -0,0 +1,148 @@
1From 852aa5ad351ea53e5f01d2f44b5b4370c2bf5425 Mon Sep 17 00:00:00 2001
2From: Patrick Monnerat <patrick@monnerat.net>
3Date: Mon, 25 Apr 2022 11:44:05 +0200
4Subject: [PATCH] url: check sasl additional parameters for connection reuse.
5
6Also move static function safecmp() as non-static Curl_safecmp() since
7its purpose is needed at several places.
8
9Bug: https://curl.se/docs/CVE-2022-22576.html
10
11CVE-2022-22576
12
13Closes #8746
14---
15 lib/strcase.c | 10 ++++++++++
16 lib/strcase.h | 2 ++
17 lib/url.c | 13 ++++++++++++-
18 lib/urldata.h | 1 +
19 lib/vtls/vtls.c | 21 ++++++---------------
20 5 files changed, 31 insertions(+), 16 deletions(-)
21
22CVE: CVE-2022-22576
23Upstream-Status: Backport [https://github.com/curl/curl/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425.patch]
24Comment: Refreshed patch
25Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
26
27diff --git a/lib/strcase.c b/lib/strcase.c
28index dd46ca1ba0e5..692a3f14aee7 100644
29--- a/lib/strcase.c
30+++ b/lib/strcase.c
31@@ -251,6 +251,16 @@
32 } while(*src++ && --n);
33 }
34
35+/* Compare case-sensitive NUL-terminated strings, taking care of possible
36+ * null pointers. Return true if arguments match.
37+ */
38+bool Curl_safecmp(char *a, char *b)
39+{
40+ if(a && b)
41+ return !strcmp(a, b);
42+ return !a && !b;
43+}
44+
45 /* --- public functions --- */
46
47 int curl_strequal(const char *first, const char *second)
48diff --git a/lib/strcase.h b/lib/strcase.h
49index b234d3815220..2635f5117e99 100644
50--- a/lib/strcase.h
51+++ b/lib/strcase.h
52@@ -48,4 +48,6 @@
53 void Curl_strntoupper(char *dest, const char *src, size_t n);
54 void Curl_strntolower(char *dest, const char *src, size_t n);
55
56+bool Curl_safecmp(char *a, char *b);
57+
58 #endif /* HEADER_CURL_STRCASE_H */
59diff --git a/lib/url.c b/lib/url.c
60index 9a988b4d58d8..e1647b133854 100644
61--- a/lib/url.c
62+++ b/lib/url.c
63@@ -730,6 +730,7 @@
64 Curl_safefree(conn->allocptr.host);
65 Curl_safefree(conn->allocptr.cookiehost);
66 Curl_safefree(conn->allocptr.rtsp_transport);
67+ Curl_safefree(conn->oauth_bearer);
68 Curl_safefree(conn->trailer);
69 Curl_safefree(conn->host.rawalloc); /* host name buffer */
70 Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
71@@ -1251,7 +1252,9 @@
72 /* This protocol requires credentials per connection,
73 so verify that we're using the same name and password as well */
74 if(strcmp(needle->user, check->user) ||
75- strcmp(needle->passwd, check->passwd)) {
76+ strcmp(needle->passwd, check->passwd) ||
77+ !Curl_safecmp(needle->sasl_authzid, check->sasl_authzid) ||
78+ !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) {
79 /* one of them was different */
80 continue;
81 }
82@@ -3392,6 +3395,14 @@
83 result = CURLE_OUT_OF_MEMORY;
84 goto out;
85 }
86+ }
87+
88+ if(data->set.str[STRING_BEARER]) {
89+ conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
90+ if(!conn->oauth_bearer) {
91+ result = CURLE_OUT_OF_MEMORY;
92+ goto out;
93+ }
94 }
95
96 #ifdef USE_UNIX_SOCKETS
97diff --git a/lib/urldata.h b/lib/urldata.h
98index 07eb19b87034..1d89b8d7fa68 100644
99--- a/lib/urldata.h
100+++ b/lib/urldata.h
101@@ -949,6 +949,8 @@
102
103 char *sasl_authzid; /* authorisation identity string, allocated */
104
105+ char *oauth_bearer; /* OAUTH2 bearer, allocated */
106+
107 int httpversion; /* the HTTP version*10 reported by the server */
108 int rtspversion; /* the RTSP version*10 reported by the server */
109
110diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
111index 03b85ba065e5..a40ac06f684f 100644
112--- a/lib/vtls/vtls.c
113+++ b/lib/vtls/vtls.c
114@@ -82,15 +82,6 @@
115 else \
116 dest->var = NULL;
117
118-static bool safecmp(char *a, char *b)
119-{
120- if(a && b)
121- return !strcmp(a, b);
122- else if(!a && !b)
123- return TRUE; /* match */
124- return FALSE; /* no match */
125-}
126-
127
128 bool
129 Curl_ssl_config_matches(struct ssl_primary_config* data,
130@@ -101,12 +101,12 @@
131 (data->verifypeer == needle->verifypeer) &&
132 (data->verifyhost == needle->verifyhost) &&
133 (data->verifystatus == needle->verifystatus) &&
134- safecmp(data->CApath, needle->CApath) &&
135- safecmp(data->CAfile, needle->CAfile) &&
136- safecmp(data->issuercert, needle->issuercert) &&
137- safecmp(data->clientcert, needle->clientcert) &&
138- safecmp(data->random_file, needle->random_file) &&
139- safecmp(data->egdsocket, needle->egdsocket) &&
140+ Curl_safecmp(data->CApath, needle->CApath) &&
141+ Curl_safecmp(data->CAfile, needle->CAfile) &&
142+ Curl_safecmp(data->issuercert, needle->issuercert) &&
143+ Curl_safecmp(data->clientcert, needle->clientcert) &&
144+ Curl_safecmp(data->random_file, needle->random_file) &&
145+ Curl_safecmp(data->egdsocket, needle->egdsocket) &&
146 Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
147 Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
148 Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key))
diff --git a/meta/recipes-support/curl/curl/CVE-2022-27775.patch b/meta/recipes-support/curl/curl/CVE-2022-27775.patch
new file mode 100644
index 0000000000..b3fe7b4494
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-27775.patch
@@ -0,0 +1,39 @@
1From 058f98dc3fe595f21dc26a5b9b1699e519ba5705 Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Mon, 25 Apr 2022 11:48:00 +0200
4Subject: [PATCH] conncache: include the zone id in the "bundle" hashkey
5
6Make connections to two separate IPv6 zone ids create separate
7connections.
8
9Reported-by: Harry Sintonen
10Bug: https://curl.se/docs/CVE-2022-27775.html
11Closes #8747
12---
13 lib/conncache.c | 8 ++++++--
14 1 file changed, 6 insertions(+), 2 deletions(-)
15
16CVE: CVE-2022-27775
17Upstream-Status: Backport [https://github.com/curl/curl/commit/058f98dc3fe595f21dc26a5b9b1699e519ba5705.patch]
18Comment: Refreshed patch
19Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
20
21diff --git a/lib/conncache.c b/lib/conncache.c
22index ec669b971dc3..8948b53fa500 100644
23--- a/lib/conncache.c
24+++ b/lib/conncache.c
25@@ -156,8 +156,12 @@
26 /* report back which name we used */
27 *hostp = hostname;
28
29- /* put the number first so that the hostname gets cut off if too long */
30- msnprintf(buf, len, "%ld%s", port, hostname);
31+ /* put the numbers first so that the hostname gets cut off if too long */
32+#ifdef ENABLE_IPV6
33+ msnprintf(buf, len, "%u/%ld/%s", conn->scope_id, port, hostname);
34+#else
35+ msnprintf(buf, len, "%ld/%s", port, hostname);
36+#endif
37 }
38
39 /* Returns number of connections currently held in the connection cache.
diff --git a/meta/recipes-support/curl/curl/CVE-2022-27776.patch b/meta/recipes-support/curl/curl/CVE-2022-27776.patch
new file mode 100644
index 0000000000..1a13df2d95
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-27776.patch
@@ -0,0 +1,114 @@
1From 6e659993952aa5f90f48864be84a1bbb047fc258 Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Mon, 25 Apr 2022 13:05:40 +0200
4Subject: [PATCH] http: avoid auth/cookie on redirects same host diff port
5
6CVE-2022-27776
7
8Reported-by: Harry Sintonen
9Bug: https://curl.se/docs/CVE-2022-27776.html
10Closes #8749
11---
12 lib/http.c | 34 ++++++++++++++++++++++------------
13 lib/urldata.h | 16 +++++++++-------
14 2 files changed, 31 insertions(+), 19 deletions(-)
15
16CVE: CVE-2022-27776
17Upstream-Status: Backport [https://github.com/curl/curl/commit/6e659993952aa5f90f48864be84a1bbb047fc258.patch]
18Comment: Refreshed patch
19Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
20
21diff --git a/lib/http.c b/lib/http.c
22index ce79fc4e31c8..f0476f3b9272 100644
23--- a/lib/http.c
24+++ b/lib/http.c
25@@ -731,6 +731,21 @@
26 return CURLE_OK;
27 }
28
29+/*
30+ * allow_auth_to_host() tells if autentication, cookies or other "sensitive
31+ * data" can (still) be sent to this host.
32+ */
33+static bool allow_auth_to_host(struct Curl_easy *data)
34+{
35+ struct connectdata *conn = data->conn;
36+ return (!data->state.this_is_a_follow ||
37+ data->set.allow_auth_to_other_hosts ||
38+ (data->state.first_host &&
39+ strcasecompare(data->state.first_host, conn->host.name) &&
40+ (data->state.first_remote_port == conn->remote_port) &&
41+ (data->state.first_remote_protocol == conn->handler->protocol)));
42+}
43+
44 /**
45 * Curl_http_output_auth() setups the authentication headers for the
46 * host/proxy and the correct authentication
47@@ -799,15 +799,12 @@
48 with it */
49 authproxy->done = TRUE;
50
51- /* To prevent the user+password to get sent to other than the original
52- host due to a location-follow, we do some weirdo checks here */
53- if(!data->state.this_is_a_follow ||
54- conn->bits.netrc ||
55- !data->state.first_host ||
56- data->set.allow_auth_to_other_hosts ||
57- strcasecompare(data->state.first_host, conn->host.name)) {
58+ /* To prevent the user+password to get sent to other than the original host
59+ due to a location-follow */
60+ if(allow_auth_to_host(data)
61+ || conn->bits.netrc
62+ )
63 result = output_auth_headers(conn, authhost, request, path, FALSE);
64- }
65 else
66 authhost->done = TRUE;
67
68@@ -1879,10 +1891,7 @@
69 checkprefix("Cookie:", compare)) &&
70 /* be careful of sending this potentially sensitive header to
71 other hosts */
72- (data->state.this_is_a_follow &&
73- data->state.first_host &&
74- !data->set.allow_auth_to_other_hosts &&
75- !strcasecompare(data->state.first_host, conn->host.name)))
76+ !allow_auth_to_host(data))
77 ;
78 else {
79 result = Curl_add_bufferf(&req_buffer, "%s\r\n", compare);
80@@ -2065,6 +2074,7 @@
81 return CURLE_OUT_OF_MEMORY;
82
83 data->state.first_remote_port = conn->remote_port;
84+ data->state.first_remote_protocol = conn->handler->protocol;
85 }
86
87 if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
88diff --git a/lib/urldata.h b/lib/urldata.h
89index 1d89b8d7fa68..ef2174d9e727 100644
90--- a/lib/urldata.h
91+++ b/lib/urldata.h
92@@ -1342,13 +1342,15 @@
93 char *ulbuf; /* allocated upload buffer or NULL */
94 curl_off_t current_speed; /* the ProgressShow() function sets this,
95 bytes / second */
96- char *first_host; /* host name of the first (not followed) request.
97- if set, this should be the host name that we will
98- sent authorization to, no else. Used to make Location:
99- following not keep sending user+password... This is
100- strdup() data.
101- */
102- int first_remote_port; /* remote port of the first (not followed) request */
103+
104+ /* host name, port number and protocol of the first (not followed) request.
105+ if set, this should be the host name that we will sent authorization to,
106+ no else. Used to make Location: following not keep sending user+password.
107+ This is strdup()ed data. */
108+ char *first_host;
109+ int first_remote_port;
110+ unsigned int first_remote_protocol;
111+
112 struct curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
113 long sessionage; /* number of the most recent session */
114 unsigned int tempcount; /* number of entries in use in tempwrite, 0 - 3 */
diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support/curl/curl_7.69.1.bb
index bc1b993e9e..e850376ff8 100644
--- a/meta/recipes-support/curl/curl_7.69.1.bb
+++ b/meta/recipes-support/curl/curl_7.69.1.bb
@@ -25,6 +25,9 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \
25 file://CVE-2021-22946-pre1.patch \ 25 file://CVE-2021-22946-pre1.patch \
26 file://CVE-2021-22946.patch \ 26 file://CVE-2021-22946.patch \
27 file://CVE-2021-22947.patch \ 27 file://CVE-2021-22947.patch \
28 file://CVE-2022-27776.patch \
29 file://CVE-2022-27775.patch \
30 file://CVE-2022-22576.patch \
28" 31"
29 32
30SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42" 33SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-24 22:23:40 +0000