Hi Vijay, We already have a patch for CVE-2023-27538:
https://git.openembedded.org/openembedded-core/commit/?h=dunfell&id=b2740d1ff74b2c55011b5d4230c7b06b5109376d Could you submit a v2 taking this into consideration? Thanks for helping with CVEs! Steve On Tue, Apr 25, 2023 at 10:18 PM Vijay Anusuri <[email protected]> wrote: > > From: Vijay Anusuri <[email protected]> > > Upstream-Status: Backport > [https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches?h=ubuntu/focal-security > & > https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684 > & > https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878 > & > https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c > & > https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1 > & > https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5 > & > https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb] > > Signed-off-by: Vijay Anusuri <[email protected]> > --- > .../curl/curl/CVE-2023-27533.patch | 59 +++++ > .../curl/curl/CVE-2023-27535-pre1.patch | 236 ++++++++++++++++++ > .../curl/curl/CVE-2023-27535.patch | 170 +++++++++++++ > .../curl/curl/CVE-2023-27536.patch | 55 ++++ > .../curl/curl/CVE-2023-27538.patch | 29 +++ > meta/recipes-support/curl/curl_7.69.1.bb | 5 + > 6 files changed, 554 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27533.patch > create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch > create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27535.patch > create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27536.patch > create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27538.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2023-27533.patch > b/meta/recipes-support/curl/curl/CVE-2023-27533.patch > new file mode 100644 > index 0000000000..64ba135056 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2023-27533.patch > @@ -0,0 +1,59 @@ > +Backport of: > + > +From 538b1e79a6e7b0bb829ab4cecc828d32105d0684 Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Mon, 6 Mar 2023 12:07:33 +0100 > +Subject: [PATCH] telnet: only accept option arguments in ascii > + > +To avoid embedded telnet negotiation commands etc. > + > +Reported-by: Harry Sintonen > +Closes #10728 > + > +Upstream-Status: Backport [import from ubuntu > https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches/CVE-2023-27533.patch?h=ubuntu/focal-security > +Upstream commit > https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684] > +CVE: CVE-2023-27533 > +Signed-off-by: Vijay Anusuri <[email protected]> > +--- > + lib/telnet.c | 15 +++++++++++++++ > + 1 file changed, 15 insertions(+) > + > +--- a/lib/telnet.c > ++++ b/lib/telnet.c > +@@ -815,6 +815,17 @@ static void printsub(struct Curl_easy *d > + } > + } > + > ++static bool str_is_nonascii(const char *str) > ++{ > ++ size_t len = strlen(str); > ++ while(len--) { > ++ if(*str & 0x80) > ++ return TRUE; > ++ str++; > ++ } > ++ return FALSE; > ++} > ++ > + static CURLcode check_telnet_options(struct connectdata *conn) > + { > + struct curl_slist *head; > +@@ -829,6 +840,8 @@ static CURLcode check_telnet_options(str > + /* Add the user name as an environment variable if it > + was given on the command line */ > + if(conn->bits.user_passwd) { > ++ if(str_is_nonascii(data->conn->user)) > ++ return CURLE_BAD_FUNCTION_ARGUMENT; > + msnprintf(option_arg, sizeof(option_arg), "USER,%s", conn->user); > + beg = curl_slist_append(tn->telnet_vars, option_arg); > + if(!beg) { > +@@ -844,6 +857,9 @@ static CURLcode check_telnet_options(str > + if(sscanf(head->data, "%127[^= ]%*[ =]%255s", > + option_keyword, option_arg) == 2) { > + > ++ if(str_is_nonascii(option_arg)) > ++ continue; > ++ > + /* Terminal type */ > + if(strcasecompare(option_keyword, "TTYPE")) { > + strncpy(tn->subopt_ttype, option_arg, 31); > diff --git a/meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch > b/meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch > new file mode 100644 > index 0000000000..034b72f7e6 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch > @@ -0,0 +1,236 @@ > +From ed5095ed94281989e103c72e032200b83be37878 Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Thu, 6 Oct 2022 00:49:10 +0200 > +Subject: [PATCH] strcase: add and use Curl_timestrcmp > + > +This is a strcmp() alternative function for comparing "secrets", > +designed to take the same time no matter the content to not leak > +match/non-match info to observers based on how fast it is. > + > +The time this function takes is only a function of the shortest input > +string. > + > +Reported-by: Trail of Bits > + > +Closes #9658 > + > +Upstream-Status: Backport from > [https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878 > & > https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c] > +Comment: to backport fix for CVE-2023-27535, add function Curl_timestrcmp. > +Signed-off-by: Vijay Anusuri <[email protected]> > +--- > + lib/netrc.c | 6 +++--- > + lib/strcase.c | 22 ++++++++++++++++++++++ > + lib/strcase.h | 1 + > + lib/url.c | 33 +++++++++++++-------------------- > + lib/vauth/digest_sspi.c | 4 ++-- > + lib/vtls/vtls.c | 21 ++++++++++++++++++++- > + 6 files changed, 61 insertions(+), 26 deletions(-) > + > +diff --git a/lib/netrc.c b/lib/netrc.c > +index 9323913..fe3fd1e 100644 > +--- a/lib/netrc.c > ++++ b/lib/netrc.c > +@@ -124,9 +124,9 @@ static int parsenetrc(const char *host, > + /* we are now parsing sub-keywords concerning "our" host */ > + if(state_login) { > + if(specific_login) { > +- state_our_login = strcasecompare(login, tok); > ++ state_our_login = !Curl_timestrcmp(login, tok); > + } > +- else if(!login || strcmp(login, tok)) { > ++ else if(!login || Curl_timestrcmp(login, tok)) { > + if(login_alloc) { > + free(login); > + login_alloc = FALSE; > +@@ -142,7 +142,7 @@ static int parsenetrc(const char *host, > + } > + else if(state_password) { > + if((state_our_login || !specific_login) > +- && (!password || strcmp(password, tok))) { > ++ && (!password || Curl_timestrcmp(password, tok))) { > + if(password_alloc) { > + free(password); > + password_alloc = FALSE; > +diff --git a/lib/strcase.c b/lib/strcase.c > +index 70bf21c..ec776b3 100644 > +--- a/lib/strcase.c > ++++ b/lib/strcase.c > +@@ -261,6 +261,28 @@ bool Curl_safecmp(char *a, char *b) > + return !a && !b; > + } > + > ++/* > ++ * Curl_timestrcmp() returns 0 if the two strings are identical. The time > this > ++ * function spends is a function of the shortest string, not of the > contents. > ++ */ > ++int Curl_timestrcmp(const char *a, const char *b) > ++{ > ++ int match = 0; > ++ int i = 0; > ++ > ++ if(a && b) { > ++ while(1) { > ++ match |= a[i]^b[i]; > ++ if(!a[i] || !b[i]) > ++ break; > ++ i++; > ++ } > ++ } > ++ else > ++ return a || b; > ++ return match; > ++} > ++ > + /* --- public functions --- */ > + > + int curl_strequal(const char *first, const char *second) > +diff --git a/lib/strcase.h b/lib/strcase.h > +index 8929a53..8077108 100644 > +--- a/lib/strcase.h > ++++ b/lib/strcase.h > +@@ -49,5 +49,6 @@ void Curl_strntoupper(char *dest, const char *src, size_t > n); > + void Curl_strntolower(char *dest, const char *src, size_t n); > + > + bool Curl_safecmp(char *a, char *b); > ++int Curl_timestrcmp(const char *first, const char *second); > + > + #endif /* HEADER_CURL_STRCASE_H */ > +diff --git a/lib/url.c b/lib/url.c > +index 9f14a7b..dfbde3b 100644 > +--- a/lib/url.c > ++++ b/lib/url.c > +@@ -886,19 +886,10 @@ socks_proxy_info_matches(const struct proxy_info* data, > + /* the user information is case-sensitive > + or at least it is not defined as case-insensitive > + see https://tools.ietf.org/html/rfc3986#section-3.2.1 */ > +- if((data->user == NULL) != (needle->user == NULL)) > +- return FALSE; > +- /* curl_strequal does a case insentive comparison, so do not use it here! > */ > +- if(data->user && > +- needle->user && > +- strcmp(data->user, needle->user) != 0) > +- return FALSE; > +- if((data->passwd == NULL) != (needle->passwd == NULL)) > +- return FALSE; > ++ > + /* curl_strequal does a case insentive comparison, so do not use it here! > */ > +- if(data->passwd && > +- needle->passwd && > +- strcmp(data->passwd, needle->passwd) != 0) > ++ if(Curl_timestrcmp(data->user, needle->user) || > ++ Curl_timestrcmp(data->passwd, needle->passwd)) > + return FALSE; > + return TRUE; > + } > +@@ -1257,10 +1248,10 @@ ConnectionExists(struct Curl_easy *data, > + if(!(needle->handler->flags & PROTOPT_CREDSPERREQUEST)) { > + /* This protocol requires credentials per connection, > + so verify that we're using the same name and password as well */ > +- if(strcmp(needle->user, check->user) || > +- strcmp(needle->passwd, check->passwd) || > +- !Curl_safecmp(needle->sasl_authzid, check->sasl_authzid) || > +- !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) { > ++ if(Curl_timestrcmp(needle->user, check->user) || > ++ Curl_timestrcmp(needle->passwd, check->passwd) || > ++ Curl_timestrcmp(needle->sasl_authzid, check->sasl_authzid) || > ++ Curl_timestrcmp(needle->oauth_bearer, check->oauth_bearer)) { > + /* one of them was different */ > + continue; > + } > +@@ -1326,8 +1317,8 @@ ConnectionExists(struct Curl_easy *data, > + possible. (Especially we must not reuse the same connection if > + partway through a handshake!) */ > + if(wantNTLMhttp) { > +- if(strcmp(needle->user, check->user) || > +- strcmp(needle->passwd, check->passwd)) { > ++ if(Curl_timestrcmp(needle->user, check->user) || > ++ Curl_timestrcmp(needle->passwd, check->passwd)) { > + > + /* we prefer a credential match, but this is at least a > connection > + that can be reused and "upgraded" to NTLM */ > +@@ -1348,8 +1339,10 @@ ConnectionExists(struct Curl_easy *data, > + if(!check->http_proxy.user || !check->http_proxy.passwd) > + continue; > + > +- if(strcmp(needle->http_proxy.user, check->http_proxy.user) || > +- strcmp(needle->http_proxy.passwd, check->http_proxy.passwd)) > ++ if(Curl_timestrcmp(needle->http_proxy.user, > ++ check->http_proxy.user) || > ++ Curl_timestrcmp(needle->http_proxy.passwd, > ++ check->http_proxy.passwd)) > + continue; > + } > + else if(check->proxy_ntlm_state != NTLMSTATE_NONE) { > +diff --git a/lib/vauth/digest_sspi.c b/lib/vauth/digest_sspi.c > +index a109056..3986386 100644 > +--- a/lib/vauth/digest_sspi.c > ++++ b/lib/vauth/digest_sspi.c > +@@ -450,8 +450,8 @@ CURLcode Curl_auth_create_digest_http_message(struct > Curl_easy *data, > + has changed then delete that context. */ > + if((userp && !digest->user) || (!userp && digest->user) || > + (passwdp && !digest->passwd) || (!passwdp && digest->passwd) || > +- (userp && digest->user && strcmp(userp, digest->user)) || > +- (passwdp && digest->passwd && strcmp(passwdp, digest->passwd))) { > ++ (userp && digest->user && Curl_timestrcmp(userp, digest->user)) || > ++ (passwdp && digest->passwd && Curl_timestrcmp(passwdp, > digest->passwd))) { > + if(digest->http_context) { > + s_pSecFn->DeleteSecurityContext(digest->http_context); > + Curl_safefree(digest->http_context); > +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c > +index e8cb70f..70a9391 100644 > +--- a/lib/vtls/vtls.c > ++++ b/lib/vtls/vtls.c > +@@ -98,9 +98,15 @@ Curl_ssl_config_matches(struct ssl_primary_config* data, > + Curl_safecmp(data->issuercert, needle->issuercert) && > + Curl_safecmp(data->clientcert, needle->clientcert) && > + Curl_safecmp(data->random_file, needle->random_file) && > +- Curl_safecmp(data->egdsocket, needle->egdsocket) && > ++ Curl_safecmp(data->egdsocket, needle->egdsocket) && > ++#ifdef USE_TLS_SRP > ++ !Curl_timestrcmp(data->username, needle->username) && > ++ !Curl_timestrcmp(data->password, needle->password) && > ++ (data->authtype == needle->authtype) && > ++#endif > + Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) && > + Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) && > ++ Curl_safe_strcasecompare(data->CRLfile, needle->CRLfile) && > + Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key)) > + return TRUE; > + > +@@ -117,6 +123,9 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config > *source, > + dest->verifyhost = source->verifyhost; > + dest->verifystatus = source->verifystatus; > + dest->sessionid = source->sessionid; > ++#ifdef USE_TLS_SRP > ++ dest->authtype = source->authtype; > ++#endif > + > + CLONE_STRING(CApath); > + CLONE_STRING(CAfile); > +@@ -127,6 +136,11 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config > *source, > + CLONE_STRING(cipher_list); > + CLONE_STRING(cipher_list13); > + CLONE_STRING(pinned_key); > ++ CLONE_STRING(CRLfile); > ++#ifdef USE_TLS_SRP > ++ CLONE_STRING(username); > ++ CLONE_STRING(password); > ++#endif > + > + return TRUE; > + } > +@@ -142,6 +156,11 @@ void Curl_free_primary_ssl_config(struct > ssl_primary_config* sslc) > + Curl_safefree(sslc->cipher_list); > + Curl_safefree(sslc->cipher_list13); > + Curl_safefree(sslc->pinned_key); > ++ Curl_safefree(sslc->CRLfile); > ++#ifdef USE_TLS_SRP > ++ Curl_safefree(sslc->username); > ++ Curl_safefree(sslc->password); > ++#endif > + } > + > + #ifdef USE_SSL > +-- > +2.25.1 > + > diff --git a/meta/recipes-support/curl/curl/CVE-2023-27535.patch > b/meta/recipes-support/curl/curl/CVE-2023-27535.patch > new file mode 100644 > index 0000000000..e38390a57c > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2023-27535.patch > @@ -0,0 +1,170 @@ > +From 8f4608468b890dce2dad9f91d5607ee7e9c1aba1 Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Thu, 9 Mar 2023 17:47:06 +0100 > +Subject: [PATCH] ftp: add more conditions for connection reuse > + > +Reported-by: Harry Sintonen > +Closes #10730 > + > +Upstream-Status: Backport [import from ubuntu > https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches/CVE-2023-27535.patch?h=ubuntu/focal-security > +Upstream commit > https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1] > +CVE: CVE-2023-27535 > +Signed-off-by: Vijay Anusuri <[email protected]> > +--- > + lib/ftp.c | 30 ++++++++++++++++++++++++++++-- > + lib/ftp.h | 5 +++++ > + lib/setopt.c | 2 +- > + lib/url.c | 16 +++++++++++++++- > + lib/urldata.h | 4 ++-- > + 5 files changed, 51 insertions(+), 6 deletions(-) > + > +diff --git a/lib/ftp.c b/lib/ftp.c > +index 31a34e8..7a82a74 100644 > +--- a/lib/ftp.c > ++++ b/lib/ftp.c > +@@ -4059,6 +4059,10 @@ static CURLcode ftp_disconnect(struct connectdata > *conn, bool dead_connection) > + } > + > + freedirs(ftpc); > ++ free(ftpc->account); > ++ ftpc->account = NULL; > ++ free(ftpc->alternative_to_user); > ++ ftpc->alternative_to_user = NULL; > + free(ftpc->prevpath); > + ftpc->prevpath = NULL; > + free(ftpc->server_os); > +@@ -4326,11 +4330,31 @@ static CURLcode ftp_setup_connection(struct > connectdata *conn) > + struct Curl_easy *data = conn->data; > + char *type; > + struct FTP *ftp; > ++ struct ftp_conn *ftpc = &conn->proto.ftpc; > + > +- conn->data->req.protop = ftp = calloc(sizeof(struct FTP), 1); > ++ ftp = calloc(sizeof(struct FTP), 1); > + if(NULL == ftp) > + return CURLE_OUT_OF_MEMORY; > + > ++ /* clone connection related data that is FTP specific */ > ++ if(data->set.str[STRING_FTP_ACCOUNT]) { > ++ ftpc->account = strdup(data->set.str[STRING_FTP_ACCOUNT]); > ++ if(!ftpc->account) { > ++ free(ftp); > ++ return CURLE_OUT_OF_MEMORY; > ++ } > ++ } > ++ if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]) { > ++ ftpc->alternative_to_user = > ++ strdup(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]); > ++ if(!ftpc->alternative_to_user) { > ++ Curl_safefree(ftpc->account); > ++ free(ftp); > ++ return CURLE_OUT_OF_MEMORY; > ++ } > ++ } > ++ conn->data->req.protop = ftp; > ++ > + ftp->path = &data->state.up.path[1]; /* don't include the initial slash */ > + > + /* FTP URLs support an extension like ";type=<typecode>" that > +@@ -4366,7 +4390,9 @@ static CURLcode ftp_setup_connection(struct > connectdata *conn) > + /* get some initial data into the ftp struct */ > + ftp->transfer = FTPTRANSFER_BODY; > + ftp->downloadsize = 0; > +- conn->proto.ftpc.known_filesize = -1; /* unknown size for now */ > ++ ftpc->known_filesize = -1; /* unknown size for now */ > ++ ftpc->use_ssl = data->set.use_ssl; > ++ ftpc->ccc = data->set.ftp_ccc; > + > + return CURLE_OK; > + } > +diff --git a/lib/ftp.h b/lib/ftp.h > +index 984347f..163dcb3 100644 > +--- a/lib/ftp.h > ++++ b/lib/ftp.h > +@@ -116,6 +116,8 @@ struct FTP { > + struct */ > + struct ftp_conn { > + struct pingpong pp; > ++ char *account; > ++ char *alternative_to_user; > + char *entrypath; /* the PWD reply when we logged on */ > + char **dirs; /* realloc()ed array for path components */ > + int dirdepth; /* number of entries used in the 'dirs' array */ > +@@ -141,6 +143,9 @@ struct ftp_conn { > + ftpstate state; /* always use ftp.c:state() to change state! */ > + ftpstate state_saved; /* transfer type saved to be reloaded after > + data connection is established */ > ++ unsigned char use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or > ++ IMAP or POP3 or others! (type: curl_usessl)*/ > ++ unsigned char ccc; /* ccc level for this connection */ > + curl_off_t retr_size_saved; /* Size of retrieved file saved */ > + char *server_os; /* The target server operating system. */ > + curl_off_t known_filesize; /* file size is different from -1, if wildcard > +diff --git a/lib/setopt.c b/lib/setopt.c > +index 4d96f6b..a91bb70 100644 > +--- a/lib/setopt.c > ++++ b/lib/setopt.c > +@@ -2126,7 +2126,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, > CURLoption option, va_list param) > + arg = va_arg(param, long); > + if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST)) > + return CURLE_BAD_FUNCTION_ARGUMENT; > +- data->set.use_ssl = (curl_usessl)arg; > ++ data->set.use_ssl = (unsigned char)arg; > + break; > + > + case CURLOPT_SSL_OPTIONS: > +diff --git a/lib/url.c b/lib/url.c > +index dfbde3b..f84375c 100644 > +--- a/lib/url.c > ++++ b/lib/url.c > +@@ -1257,10 +1257,24 @@ ConnectionExists(struct Curl_easy *data, > + } > + } > + > +- if(get_protocol_family(needle->handler->protocol) & PROTO_FAMILY_SSH) > { > ++#ifdef USE_SSH > ++ else if(get_protocol_family(needle->handler->protocol) & > PROTO_FAMILY_SSH) { > + if(!ssh_config_matches(needle, check)) > + continue; > + } > ++#endif > ++#ifndef CURL_DISABLE_FTP > ++ else if(get_protocol_family(needle->handler->protocol) & > PROTO_FAMILY_FTP) { > ++ /* Also match ACCOUNT, ALTERNATIVE-TO-USER, USE_SSL and CCC options > */ > ++ if(Curl_timestrcmp(needle->proto.ftpc.account, > ++ check->proto.ftpc.account) || > ++ Curl_timestrcmp(needle->proto.ftpc.alternative_to_user, > ++ check->proto.ftpc.alternative_to_user) || > ++ (needle->proto.ftpc.use_ssl != check->proto.ftpc.use_ssl) || > ++ (needle->proto.ftpc.ccc != check->proto.ftpc.ccc)) > ++ continue; > ++ } > ++#endif > + > + if(!needle->bits.httpproxy || (needle->handler->flags&PROTOPT_SSL) || > + needle->bits.tunnel_proxy) { > +diff --git a/lib/urldata.h b/lib/urldata.h > +index 168f874..51b793b 100644 > +--- a/lib/urldata.h > ++++ b/lib/urldata.h > +@@ -1730,8 +1730,6 @@ struct UserDefined { > + void *ssh_keyfunc_userp; /* custom pointer to callback */ > + enum CURL_NETRC_OPTION > + use_netrc; /* defined in include/curl.h */ > +- curl_usessl use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or > +- IMAP or POP3 or others! */ > + long new_file_perms; /* Permissions to use when creating remote files > */ > + long new_directory_perms; /* Permissions to use when creating remote dirs > */ > + long ssh_auth_types; /* allowed SSH auth types */ > +@@ -1851,6 +1849,8 @@ struct UserDefined { > + BIT(http09_allowed); /* allow HTTP/0.9 responses */ > + BIT(mail_rcpt_allowfails); /* allow RCPT TO command to fail for some > + recipients */ > ++ unsigned char use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or > ++ IMAP or POP3 or others! (type: curl_usessl)*/ > + }; > + > + struct Names { > +-- > +2.25.1 > + > diff --git a/meta/recipes-support/curl/curl/CVE-2023-27536.patch > b/meta/recipes-support/curl/curl/CVE-2023-27536.patch > new file mode 100644 > index 0000000000..b04a77de25 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2023-27536.patch > @@ -0,0 +1,55 @@ > +From cb49e67303dbafbab1cebf4086e3ec15b7d56ee5 Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Fri, 10 Mar 2023 09:22:43 +0100 > +Subject: [PATCH] url: only reuse connections with same GSS delegation > + > +Reported-by: Harry Sintonen > +Closes #10731 > + > +Upstream-Status: Backport > [https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5] > +CVE: CVE-2023-27536 > +Signed-off-by: Vijay Anusuri <[email protected]> > +--- > + lib/url.c | 6 ++++++ > + lib/urldata.h | 1 + > + 2 files changed, 7 insertions(+) > + > +diff --git a/lib/url.c b/lib/url.c > +index f84375c..87f4eb0 100644 > +--- a/lib/url.c > ++++ b/lib/url.c > +@@ -1257,6 +1257,11 @@ ConnectionExists(struct Curl_easy *data, > + } > + } > + > ++ /* GSS delegation differences do not actually affect every connection > ++ and auth method, but this check takes precaution before efficiency > */ > ++ if(needle->gssapi_delegation != check->gssapi_delegation) > ++ continue; > ++ > + #ifdef USE_SSH > + else if(get_protocol_family(needle->handler->protocol) & > PROTO_FAMILY_SSH) { > + if(!ssh_config_matches(needle, check)) > +@@ -1708,6 +1713,7 @@ static struct connectdata *allocate_conn(struct > Curl_easy *data) > + conn->fclosesocket = data->set.fclosesocket; > + conn->closesocket_client = data->set.closesocket_client; > + conn->lastused = Curl_now(); /* used now */ > ++ conn->gssapi_delegation = data->set.gssapi_delegation; > + > + return conn; > + error: > +diff --git a/lib/urldata.h b/lib/urldata.h > +index 51b793b..b8a611b 100644 > +--- a/lib/urldata.h > ++++ b/lib/urldata.h > +@@ -1118,6 +1118,7 @@ struct connectdata { > + handle */ > + BIT(sock_accepted); /* TRUE if the SECONDARYSOCKET was created with > + accept() */ > ++ long gssapi_delegation; /* inherited from set.gssapi_delegation */ > + }; > + > + /* The end of connectdata. */ > +-- > +2.25.1 > + > diff --git a/meta/recipes-support/curl/curl/CVE-2023-27538.patch > b/meta/recipes-support/curl/curl/CVE-2023-27538.patch > new file mode 100644 > index 0000000000..5cd11ef88b > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2023-27538.patch > @@ -0,0 +1,29 @@ > +Backport of: > + > +From af369db4d3833272b8ed443f7fcc2e757a0872eb Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Fri, 10 Mar 2023 08:22:51 +0100 > +Subject: [PATCH] url: fix the SSH connection reuse check > + > +Reported-by: Harry Sintonen > +Closes #10735 > + > +Upstream-Status: Backport [import from ubuntu > https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches/CVE-2023-27538.patch?h=ubuntu/focal-security > +Upstream commit > https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb] > +CVE: CVE-2023-27538 > +Signed-off-by: Vijay Anusuri <[email protected]> > +--- > + lib/url.c | 2 +- > + 1 file changed, 1 insertion(+), 1 deletion(-) > + > +--- a/lib/url.c > ++++ b/lib/url.c > +@@ -1233,7 +1233,7 @@ ConnectionExists(struct Curl_easy *data, > + } > + } > + > +- if(get_protocol_family(needle->handler->protocol) == > PROTO_FAMILY_SSH) { > ++ if(get_protocol_family(needle->handler->protocol) & PROTO_FAMILY_SSH) > { > + if(!ssh_config_matches(needle, check)) > + continue; > + } > diff --git a/meta/recipes-support/curl/curl_7.69.1.bb > b/meta/recipes-support/curl/curl_7.69.1.bb > index a7f4f5748f..2e3bcb2c6e 100644 > --- a/meta/recipes-support/curl/curl_7.69.1.bb > +++ b/meta/recipes-support/curl/curl_7.69.1.bb > @@ -44,6 +44,11 @@ SRC_URI = > "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \ > file://CVE-2022-43552.patch \ > file://CVE-2023-23916.patch \ > file://CVE-2023-27534.patch \ > + file://CVE-2023-27533.patch \ > + file://CVE-2023-27538.patch \ > + file://CVE-2023-27535-pre1.patch \ > + file://CVE-2023-27535.patch \ > + file://CVE-2023-27536.patch \ > " > > SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42" > -- > 2.25.1 > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#180447): https://lists.openembedded.org/g/openembedded-core/message/180447 Mute This Topic: https://lists.openembedded.org/mt/98510578/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
