From d635f9fca0dcf0aad8fcb3c3fb8bea04fe292746 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 21 Dec 2022 23:21:11 +0100 Subject: [PATCH] curl: backport 7.87.0 security fixes https://curl.se/docs/CVE-2022-43551.html https://curl.se/docs/CVE-2022-43552.html Fixes: CVE-2022-43551, CVE-2022-43552 --- .../networking/curl/CVE-2022-43551.patch | 32 ++++++++ .../networking/curl/CVE-2022-43552.patch | 78 +++++++++++++++++++ pkgs/tools/networking/curl/default.nix | 2 + 3 files changed, 112 insertions(+) create mode 100644 pkgs/tools/networking/curl/CVE-2022-43551.patch create mode 100644 pkgs/tools/networking/curl/CVE-2022-43552.patch diff --git a/pkgs/tools/networking/curl/CVE-2022-43551.patch b/pkgs/tools/networking/curl/CVE-2022-43551.patch new file mode 100644 index 000000000000..96e72a448e58 --- /dev/null +++ b/pkgs/tools/networking/curl/CVE-2022-43551.patch @@ -0,0 +1,32 @@ +From 3e2bbdf2c8651036fb2be0889f9098c7bb02870d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 19 Dec 2022 08:36:55 +0100 +Subject: [PATCH] http: use the IDN decoded name in HSTS checks + +Otherwise it stores the info HSTS into the persistent cache for the IDN +name which will not match when the HSTS status is later checked for +using the decoded name. + +Reported-by: Hiroki Kurosawa + +Closes #10111 +--- + lib/http.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/http.c b/lib/http.c +index f57859e8b..45bb25a2f 100644 +--- a/lib/http.c ++++ b/lib/http.c +@@ -3724,7 +3724,7 @@ CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn, + #endif + )) { + CURLcode check = +- Curl_hsts_parse(data->hsts, data->state.up.hostname, ++ Curl_hsts_parse(data->hsts, conn->host.name, + headp + strlen("Strict-Transport-Security:")); + if(check) + infof(data, "Illegal STS header skipped"); +-- +2.38.1 + diff --git a/pkgs/tools/networking/curl/CVE-2022-43552.patch b/pkgs/tools/networking/curl/CVE-2022-43552.patch new file mode 100644 index 000000000000..7984e2935deb --- /dev/null +++ b/pkgs/tools/networking/curl/CVE-2022-43552.patch @@ -0,0 +1,78 @@ +From e1e59a35f8322d750f8977d30cc39f0b2fd8dc74 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 19 Dec 2022 08:38:37 +0100 +Subject: [PATCH] smb/telnet: do not free the protocol struct in *_done() + +It is managed by the generic layer. + +Reported-by: Trail of Bits + +Closes #10112 +--- + lib/smb.c | 14 ++------------ + lib/telnet.c | 3 --- + 2 files changed, 2 insertions(+), 15 deletions(-) + +diff --git a/lib/smb.c b/lib/smb.c +index a62e85814..dbab485c5 100644 +--- a/lib/smb.c ++++ b/lib/smb.c +@@ -62,8 +62,6 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done); + static CURLcode smb_connection_state(struct Curl_easy *data, bool *done); + static CURLcode smb_do(struct Curl_easy *data, bool *done); + static CURLcode smb_request_state(struct Curl_easy *data, bool *done); +-static CURLcode smb_done(struct Curl_easy *data, CURLcode status, +- bool premature); + static CURLcode smb_disconnect(struct Curl_easy *data, + struct connectdata *conn, bool dead); + static int smb_getsock(struct Curl_easy *data, struct connectdata *conn, +@@ -78,7 +76,7 @@ const struct Curl_handler Curl_handler_smb = { + "SMB", /* scheme */ + smb_setup_connection, /* setup_connection */ + smb_do, /* do_it */ +- smb_done, /* done */ ++ ZERO_NULL, /* done */ + ZERO_NULL, /* do_more */ + smb_connect, /* connect_it */ + smb_connection_state, /* connecting */ +@@ -105,7 +103,7 @@ const struct Curl_handler Curl_handler_smbs = { + "SMBS", /* scheme */ + smb_setup_connection, /* setup_connection */ + smb_do, /* do_it */ +- smb_done, /* done */ ++ ZERO_NULL, /* done */ + ZERO_NULL, /* do_more */ + smb_connect, /* connect_it */ + smb_connection_state, /* connecting */ +@@ -941,14 +939,6 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done) + return CURLE_OK; + } + +-static CURLcode smb_done(struct Curl_easy *data, CURLcode status, +- bool premature) +-{ +- (void) premature; +- Curl_safefree(data->req.p.smb); +- return status; +-} +- + static CURLcode smb_disconnect(struct Curl_easy *data, + struct connectdata *conn, bool dead) + { +diff --git a/lib/telnet.c b/lib/telnet.c +index 923c7f82b..48cd0d743 100644 +--- a/lib/telnet.c ++++ b/lib/telnet.c +@@ -1248,9 +1248,6 @@ static CURLcode telnet_done(struct Curl_easy *data, + + curl_slist_free_all(tn->telnet_vars); + tn->telnet_vars = NULL; +- +- Curl_safefree(data->req.p.telnet); +- + return CURLE_OK; + } + +-- +2.38.1 + diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix index 6d5f28e7a82f..3c596ff1f9d2 100644 --- a/pkgs/tools/networking/curl/default.nix +++ b/pkgs/tools/networking/curl/default.nix @@ -59,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: { patches = [ ./7.79.1-darwin-no-systemconfiguration.patch + ./CVE-2022-43551.patch + ./CVE-2022-43552.patch ]; outputs = [ "bin" "dev" "out" "man" "devdoc" ];