diff --git a/SOURCES/0060-curl-7.61.1-64K-sftp.patch b/SOURCES/0054-curl-7.61.1-64K-sftp.patch similarity index 100% rename from SOURCES/0060-curl-7.61.1-64K-sftp.patch rename to SOURCES/0054-curl-7.61.1-64K-sftp.patch diff --git a/SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch b/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch similarity index 98% rename from SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch rename to SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch index 3aef7dd..4aa552b 100644 --- a/SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch +++ b/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch @@ -103,7 +103,7 @@ index b3c0063b2cfb2..41e9e7a6914e0 100644 - char *filename; /* file we read from/write to */ bool running; /* state info, for cookie adding information */ - long numcookies; /* number of cookies in the "jar" */ -+ int numcookies; /* number of cookies in the "jar" */ ++ int numcookies; /* number of cookies in the "jar" */ bool newsession; /* new session, discard session cookies on load */ int lastct; /* last creation-time used in the jar */ }; diff --git a/SOURCES/0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch b/SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch similarity index 100% rename from SOURCES/0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch rename to SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch diff --git a/SOURCES/0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch b/SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch similarity index 100% rename from SOURCES/0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch rename to SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch diff --git a/SOURCES/0058-curl-7.61.1-CVE-2023-46218.patch b/SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch similarity index 100% rename from SOURCES/0058-curl-7.61.1-CVE-2023-46218.patch rename to SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch diff --git a/SOURCES/0059-curl-7.61.1-lowercase-headernames.patch b/SOURCES/0060-curl-7.61.1-lowercase-headernames.patch similarity index 100% rename from SOURCES/0059-curl-7.61.1-lowercase-headernames.patch rename to SOURCES/0060-curl-7.61.1-lowercase-headernames.patch diff --git a/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch b/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch new file mode 100644 index 0000000..8c03455 --- /dev/null +++ b/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch @@ -0,0 +1,80 @@ +From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Wed, 6 Mar 2024 09:36:08 +0100 +Subject: [PATCH] http2: push headers better cleanup + +- provide common cleanup method for push headers + +Closes #13054 +--- + lib/http2.c | 34 +++++++++++++++------------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +diff --git a/lib/http2.c b/lib/http2.c +index c63ecd38371ab4..96868728a53a1f 100644 +--- a/lib/http2.c ++++ b/lib/http2.c +@@ -271,6 +271,15 @@ static CURLcode http2_data_setup(struct Curl_cfilter *cf, + return http2_perform_getsock(conn, sock, numsocks); + } + ++static void free_push_headers(struct HTTP *http) ++{ ++ size_t i; ++ for(i = 0; ipush_headers_used; i++) ++ free(http->push_headers[i]); ++ Curl_safefree(http->push_headers); ++ http->push_headers_used = 0; ++} ++ + /* + * http2_stream_free() free HTTP2 stream related data + */ +@@ -306,11 +315,7 @@ static void http2_data_done(struct Curl_cfilter *cf, + http->header_recvbuf = NULL; /* clear the pointer */ + Curl_add_buffer_free(http->trailer_recvbuf); + http->trailer_recvbuf = NULL; /* clear the pointer */ +- for(; http->push_headers_used > 0; --http->push_headers_used) { +- free(http->push_headers[http->push_headers_used - 1]); +- } +- free(http->push_headers); +- http->push_headers = NULL; ++ free_push_headers(http); + } + } + +@@ -860,7 +861,6 @@ static int push_promise(struct Curl_cfilter *cf, + struct curl_pushheaders heads; + CURLMcode rc; + struct http_conn *httpc; +- size_t i; + /* clone the parent */ + struct Curl_easy *newhandle = duphandle(data); + if(!newhandle) { +@@ -904,11 +904,7 @@ static int push_promise(struct Curl_cfilter *cf, + Curl_set_in_callback(data, false); + + /* free the headers again */ +- for(i = 0; ipush_headers_used; i++) +- free(stream->push_headers[i]); +- free(stream->push_headers); +- stream->push_headers = NULL; +- stream->push_headers_used = 0; ++ free_push_headers(stream); + + if(rv) { + /* denied, kill off the new handle again */ +@@ -1426,10 +1422,10 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame, + stream->push_headers_alloc) { + char **headp; + stream->push_headers_alloc *= 2; +- headp = Curl_saferealloc(stream->push_headers, +- stream->push_headers_alloc * sizeof(char *)); ++ headp = realloc(stream->push_headers, ++ stream->push_headers_alloc * sizeof(char *)); + if(!headp) { +- stream->push_headers = NULL; ++ free_push_headers(stream); + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; + } + stream->push_headers = headp; diff --git a/SPECS/curl.spec b/SPECS/curl.spec index 3dd1a20..5111ddc 100644 --- a/SPECS/curl.spec +++ b/SPECS/curl.spec @@ -1,7 +1,7 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.61.1 -Release: 33%{?dist}.5 +Release: 34%{?dist}.2 License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz @@ -154,26 +154,29 @@ Patch52: 0052-curl-7.61.1-certs.patch # when keyboard-interactive auth fails, try password Patch53: 0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch -# fix cookie injection with none file (CVE-2023-38546) -Patch54: 0054-curl-7.61.1-CVE-2023-38546.patch +# cap SFTP packet size sent +Patch54: 0054-curl-7.61.1-64K-sftp.patch # unify the upload/method handling (CVE-2023-28322) Patch55: 0055-curl-7.61.1-CVE-2023-28322.patch +# fix cookie injection with none file (CVE-2023-38546) +Patch56: 0056-curl-7.61.1-CVE-2023-38546.patch + # consolidate nghttp2_session_mem_recv() call paths -Patch56: 0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch +Patch57: 0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch # when marked for closure and wanted to close == OK -Patch57: 0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch +Patch58: 0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch # lowercase the domain names before PSL checks (CVE-2023-46218) -Patch58: 0058-curl-7.61.1-CVE-2023-46218.patch +Patch59: 0059-curl-7.61.1-CVE-2023-46218.patch # lowercase headernames -Patch59: 0059-curl-7.61.1-lowercase-headernames.patch +Patch60: 0060-curl-7.61.1-lowercase-headernames.patch -# cap SFTP packet size sent -Patch60: 0060-curl-7.61.1-64K-sftp.patch +# provide common cleanup method for push headers (CVE-2024-2398) +Patch61: 0061-curl-7.61.1-CVE-2024-2398.patch # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -408,6 +411,7 @@ git apply %{PATCH52} %patch58 -p1 %patch59 -p1 %patch60 -p1 +%patch61 -p1 # make tests/*.py use Python 3 sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py @@ -570,22 +574,19 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog -* Wed Jan 24 2024 Jacek Migacz - 7.61.1-33.el8_9.5 -- cap SFTP packet size sent (RHEL-5485) +* Wed Aug 14 2024 Jacek Migacz - 7.61.1-34.el8_10.2 +- provide common cleanup method for push headers (CVE-2024-2398) -* Tue Dec 05 2023 Jacek Migacz - 7.61.1-33.el8_9.4 -- unify the upload/method handling (CVE-2023-28322) -- fix HTTP2 connection failure with HTTP2 framing layer (RHEL-15296) -- lowercase the domain names before PSL checks (CVE-2023-46218) +* Tue Jun 25 2024 Jacek Migacz - 7.61.1-34.el8_10.1 +- fix incorrect backport of bz2229800 (RHEL-44684) -* Thu Oct 12 2023 Jacek Migacz - 7.61.1-33.el8_9.3 +* Tue Sep 19 2023 Jacek Migacz - 7.61.1-34 +- when keyboard-interactive auth fails, try password (#2229800) +- cap SFTP packet size sent (RHEL-5311) +- unify the upload/method handling (CVE-2023-28322) - fix cookie injection with none file (CVE-2023-38546) - -* Mon Sep 25 2023 Jacek Migacz - 7.61.1-33.el8_9.2 -- fix 'incompatible pointer type' reported by OpenScanHub (#2240033) - -* Fri Sep 22 2023 Jacek Migacz - 7.61.1-33.el8_9.1 -- when keyboard-interactive auth fails, try password (#2240033) +- fix HTTP2 connection failure with HTTP2 framing layer (RHEL-5657) +- lowercase the domain names before PSL checks (CVE-2023-46218) * Tue Jul 25 2023 MSVSphere Packaging Team - 7.61.1-33 - Rebuilt for MSVSphere 8.8