import UBI curl-8.12.1-2.el10_1.2
This commit is contained in:
parent
b097e92d3b
commit
b8410f26bc
48
0001-curl-8.12.1-CVE-2025-9086.patch
Normal file
48
0001-curl-8.12.1-CVE-2025-9086.patch
Normal file
@ -0,0 +1,48 @@
|
||||
From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Stenberg <daniel@haxx.se>
|
||||
Date: Mon, 11 Aug 2025 20:23:05 +0200
|
||||
Subject: [PATCH] cookie: don't treat the leading slash as trailing
|
||||
|
||||
If there is only a leading slash in the path, keep that. Also add an
|
||||
assert to make sure the path is never blank.
|
||||
|
||||
Reported-by: Google Big Sleep
|
||||
Closes #18266
|
||||
---
|
||||
lib/cookie.c | 11 ++++++-----
|
||||
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/lib/cookie.c b/lib/cookie.c
|
||||
index 914a4aca12ac..b72dd99bce9b 100644
|
||||
--- a/lib/cookie.c
|
||||
+++ b/lib/cookie.c
|
||||
@@ -296,7 +296,7 @@ static char *sanitize_cookie_path(const char *cookie_path)
|
||||
}
|
||||
|
||||
/* convert /hoge/ to /hoge */
|
||||
- if(len && new_path[len - 1] == '/') {
|
||||
+ if(len > 1 && new_path[len - 1] == '/') {
|
||||
new_path[len - 1] = 0x0;
|
||||
}
|
||||
|
||||
@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data,
|
||||
clist->spath && co->spath && /* both have paths */
|
||||
clist->secure && !co->secure && !secure) {
|
||||
size_t cllen;
|
||||
- const char *sep;
|
||||
+ const char *sep = NULL;
|
||||
|
||||
/*
|
||||
* A non-secure cookie may not overlay an existing secure cookie.
|
||||
@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data,
|
||||
* "/loginhelper" is ok.
|
||||
*/
|
||||
|
||||
- sep = strchr(clist->spath + 1, '/');
|
||||
-
|
||||
+ DEBUGASSERT(clist->spath[0]);
|
||||
+ if(clist->spath[0])
|
||||
+ sep = strchr(clist->spath + 1, '/');
|
||||
if(sep)
|
||||
cllen = sep - clist->spath;
|
||||
else
|
||||
77
0002-curl-8.12.1-respect-system-crypto-policy.patch
Normal file
77
0002-curl-8.12.1-respect-system-crypto-policy.patch
Normal file
@ -0,0 +1,77 @@
|
||||
From: Jacek Migacz <jmigacz@redhat.com>
|
||||
Date: Mon, 4 Nov 2025 10:00:00 +0100
|
||||
Subject: openssl: respect system crypto policy for TLS max version
|
||||
|
||||
Implement a compromise between application control and system security
|
||||
policy for TLS maximum version:
|
||||
|
||||
- When user explicitly sets --tls-max: honor user choice (app control)
|
||||
- When user accepts default: respect OpenSSL crypto-policy (system policy)
|
||||
|
||||
This allows:
|
||||
curl --tls-max 1.3 https://... # Uses TLS 1.3 (overrides policy)
|
||||
curl https://... # Respects crypto-policy
|
||||
|
||||
Previously, curl called SSL_CTX_set_max_proto_version(ctx, 0) even when
|
||||
user didn't specify --tls-max, which overrides system crypto-policy and
|
||||
enables all TLS versions up to the highest supported.
|
||||
|
||||
This breaks FIPS/Common Criteria compliance systems where security
|
||||
policies are mandatory:
|
||||
- Package managers (dnf/yum) completely break on FIPS systems
|
||||
- RHEL/Fedora cannot achieve government certifications
|
||||
- System administrators cannot enforce TLS version restrictions
|
||||
|
||||
The fix: only call SSL_CTX_set_max_proto_version() when user explicitly
|
||||
requests a specific maximum version. Otherwise, let OpenSSL use its
|
||||
configured default from crypto-policy.
|
||||
|
||||
This mirrors the intended behavior of the minimum version logic, where
|
||||
explicit user choice overrides defaults, but system configuration is
|
||||
respected otherwise.
|
||||
|
||||
Tested on RHEL 9.6+, RHEL 10, and Fedora Rawhide.
|
||||
---
|
||||
lib/vtls/openssl.c | 26 +++++++++++++++-----------
|
||||
1 file changed, 15 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
|
||||
index 1234567890..abcdef1234 100644
|
||||
--- a/lib/vtls/openssl.c
|
||||
+++ b/lib/vtls/openssl.c
|
||||
@@ -2939,19 +2939,22 @@ ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
|
||||
ossl_ssl_version_max = TLS1_3_VERSION;
|
||||
break;
|
||||
#endif
|
||||
- case CURL_SSLVERSION_MAX_NONE: /* none selected */
|
||||
- case CURL_SSLVERSION_MAX_DEFAULT: /* max selected */
|
||||
- default:
|
||||
- /* SSL_CTX_set_max_proto_version states that:
|
||||
- setting the maximum to 0 will enable
|
||||
- protocol versions up to the highest version
|
||||
- supported by the library */
|
||||
- ossl_ssl_version_max = 0;
|
||||
- break;
|
||||
}
|
||||
|
||||
- if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) {
|
||||
- return CURLE_SSL_CONNECT_ERROR;
|
||||
+ /* Only set max version if user explicitly requested a specific version
|
||||
+ via --tls-max option. This honors user intent when specified.
|
||||
+
|
||||
+ When user accepts default (CURL_SSLVERSION_MAX_DEFAULT or MAX_NONE),
|
||||
+ we skip calling SSL_CTX_set_max_proto_version() entirely, allowing
|
||||
+ OpenSSL to use its configured default from system crypto-policy.
|
||||
+
|
||||
+ This is a deliberate compromise: explicit user choice overrides system
|
||||
+ policy, but system policy is respected when user doesn't specify. */
|
||||
+ if(curl_ssl_version_max != CURL_SSLVERSION_MAX_NONE &&
|
||||
+ curl_ssl_version_max != CURL_SSLVERSION_MAX_DEFAULT) {
|
||||
+ if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) {
|
||||
+ return CURLE_SSL_CONNECT_ERROR;
|
||||
+ }
|
||||
}
|
||||
|
||||
return CURLE_OK;
|
||||
--
|
||||
2.45.2
|
||||
15
curl.spec
15
curl.spec
@ -1,7 +1,7 @@
|
||||
Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
|
||||
Name: curl
|
||||
Version: 8.12.1
|
||||
Release: 2%{?dist}
|
||||
Release: 2%{?dist}.2
|
||||
License: curl
|
||||
Source0: https://curl.se/download/%{name}-%{version}.tar.xz
|
||||
Source1: https://curl.se/download/%{name}-%{version}.tar.xz.asc
|
||||
@ -10,6 +10,12 @@ Source1: https://curl.se/download/%{name}-%{version}.tar.xz.asc
|
||||
# which points to the GPG key as of April 7th 2016 of https://daniel.haxx.se/mykey.asc
|
||||
Source2: mykey.asc
|
||||
|
||||
# cookie: don't treat the leading slash as trailing (CVE-2025-9086)
|
||||
Patch001: 0001-curl-8.12.1-CVE-2025-9086.patch
|
||||
|
||||
# openssl: respect system crypto policy for TLS max version
|
||||
Patch002: 0002-curl-8.12.1-respect-system-crypto-policy.patch
|
||||
|
||||
# patch making libcurl multilib ready
|
||||
Patch101: 0101-curl-7.32.0-multilib.patch
|
||||
|
||||
@ -395,6 +401,13 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
||||
%{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
|
||||
|
||||
%changelog
|
||||
* Thu Nov 27 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-2.el10_1.2
|
||||
- openssl: respect system crypto policy for TLS max version (RHEL-128923)
|
||||
|
||||
* Wed Oct 22 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-2.el10_1.1
|
||||
- cookie: don't treat the leading slash as trailing (CVE-2025-9086)
|
||||
Resolves: RHEL-122689
|
||||
|
||||
* Tue Apr 15 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-2
|
||||
- revert using tls-ca-bundle.pem instead of ca-bundle.crt (RHEL-56966)
|
||||
(temporary revert to workaround another issue RHEL-85608)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user