Package: release.debian.org
Control: affects -1 + src:curl
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: pu
Tags: bookworm
Severity: normal
[ Reason ]
This update fixes 7 CVEs in curl that were published upstream after the
last bookworm point release. All are upstream-derived patches; each one
needed adaptation against 7.88.1 because the affected code paths have
moved or been refactored in the years since. The unmodified upstream
patches were imported first and then a follow-up commit per CVE
backports them onto 7.88.1; the commit history reflects this with one
commit per CVE so each fix is reviewable in isolation.
CVEs fixed:
- CVE-2025-10148 ws: get a new mask for each new outgoing frame
- CVE-2025-14524 curl_sasl: if redirected, require permission to use bearer
- CVE-2025-14819 openssl: toggling CURLSSLOPT_NO_PARTIALCHAIN makes a
different CA cache
- CVE-2026-3783 http: only send bearer if auth is allowed
- CVE-2026-3784 proxy-auth: additional tests / proxy info match
- CVE-2026-5773 protocol: disable connection reuse for SMB(S)
- CVE-2026-7168 setopt: clear proxy auth properties when switching
A further set of CVEs (CVE-2025-13034, CVE-2026-3805, CVE-2026-1965,
CVE-2026-4873, CVE-2026-5545, CVE-2026-6253, CVE-2026-6276,
CVE-2026-6429) were considered but deliberately not backported to
bookworm; see the [Risks] section.
[ Impact ]
Without this update, bookworm users are exposed to the seven listed
CVEs in curl: a websocket masking weakness (mask reused across frames),
two bearer/credentials handling bugs on redirect, a TLS cache-key
collision when CURLSSLOPT_NO_PARTIALCHAIN toggles, a proxy-auth
identity mix-up across socks proxies, an SMB connection-reuse flaw,
and a digest proxy-auth replay across CURLOPT_PROXY changes.
[ Tests ]
The full upstream curl test suite is run as part of the package build.
With the updated patches, all three crypto-backend test passes (one per
backend variant the package builds) report 100% pass:
TESTDONE: 1403 tests out of 1403 reported OK: 100%
TESTDONE: 1401 tests out of 1401 reported OK: 100%
TESTDONE: 1397 tests out of 1397 reported OK: 100%
The added CVE patches do not include the upstream regression tests
themselves; see [Changes] / [Risks] for why.
[ Risks ]
The seven backported patches are upstream-authored, security-focused,
and all the modified files are well covered by curl's own test suite
(which still passes 100%). The adaptations to 7.88.1 are documented
per-patch with two Backported-by trailers (the trixie chain plus a
bookworm-specific one) and fall into a few categories:
- line-number / context refresh only (CVE-2025-14524, CVE-2026-3783,
CVE-2026-5773)
- apply the same logic in a slightly different surrounding shape
because upstream refactored helper functions or renamed structs
(CVE-2025-10148: bookworm's ws_packethead() vs upstream's
ws_enc_add_frame(); CVE-2025-14819: cached_x509_store_* /
multi_ssl_backend_data vs ossl_cached_x509_store_* /
ossl_x509_share, plus a (struct Curl_easy *)data cast in place
of CURL_UNCONST which does not exist here; CVE-2026-7168:
setproxy() added before Curl_vsetopt() since bookworm's setopt
is one big switch rather than a sub-switch, and the no-op
Curl_auth_digest_cleanup(x) macro added under
CURL_DISABLE_CRYPTO_AUTH which is the pre-split spelling)
- upstream switched to a newer alias (CVE-2026-3784:
strcasecompare() retained instead of upstream's curl_strequal())
- upstream's regression tests dropped because the necessary test
infrastructure does not exist in bookworm: CVE-2026-3783 needs
tests/data/test486 (which trixie's test2006 was copy-derived
from) -- bookworm has no test486; CVE-2026-3784 needs the
tests/http/ pytest framework which arrived in upstream after
7.88.1; CVE-2026-7168 needs the modern libtest harness
(test.h / CURLcode test(char *URL)) the trixie adaptation
rewrote against. In every case the security property is the
library code change itself, not the test.
CVEs deliberately skipped:
- CVE-2025-13034: not relevant to this branch (the affected gnutls
QUIC path in lib/vquic/vquic-tls.c does not exist in 7.88.1).
- CVE-2026-3805: SMB request struct fix; the bookworm SMB code
path differs enough that backporting is not worth the regression
risk for SMB users on stable.
- CVE-2026-1965, CVE-2026-4873, CVE-2026-5545: all three refactor
8.14.1's per-aspect url_match_* helper structure in lib/url.c.
None of those helpers exist in 7.88.1 -- it has one monolithic
ConnectionExists() function. Backporting would require writing
the equivalent of ~80 lines of Negotiate-aware /
starttls-aware / negotiate-state-aware matching logic inline
against a security-sensitive code path that gets exercised for
every reused connection. Considered too aggressive for a stable
point release.
- CVE-202
