diff --git a/0001-curl-8.12.1-CVE-2025-9086.patch b/0001-curl-8.12.1-CVE-2025-9086.patch new file mode 100644 index 0000000..2d046a2 --- /dev/null +++ b/0001-curl-8.12.1-CVE-2025-9086.patch @@ -0,0 +1,48 @@ +From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 11 Aug 2025 20:23:05 +0200 +Subject: [PATCH] cookie: don't treat the leading slash as trailing + +If there is only a leading slash in the path, keep that. Also add an +assert to make sure the path is never blank. + +Reported-by: Google Big Sleep +Closes #18266 +--- + lib/cookie.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 914a4aca12ac..b72dd99bce9b 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -296,7 +296,7 @@ static char *sanitize_cookie_path(const char *cookie_path) + } + + /* convert /hoge/ to /hoge */ +- if(len && new_path[len - 1] == '/') { ++ if(len > 1 && new_path[len - 1] == '/') { + new_path[len - 1] = 0x0; + } + +@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data, + clist->spath && co->spath && /* both have paths */ + clist->secure && !co->secure && !secure) { + size_t cllen; +- const char *sep; ++ const char *sep = NULL; + + /* + * A non-secure cookie may not overlay an existing secure cookie. +@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data, + * "/loginhelper" is ok. + */ + +- sep = strchr(clist->spath + 1, '/'); +- ++ DEBUGASSERT(clist->spath[0]); ++ if(clist->spath[0]) ++ sep = strchr(clist->spath + 1, '/'); + if(sep) + cllen = sep - clist->spath; + else diff --git a/0002-curl-8.12.1-respect-system-crypto-policy.patch b/0002-curl-8.12.1-respect-system-crypto-policy.patch new file mode 100644 index 0000000..70cfed8 --- /dev/null +++ b/0002-curl-8.12.1-respect-system-crypto-policy.patch @@ -0,0 +1,77 @@ +From: Jacek Migacz +Date: Mon, 4 Nov 2025 10:00:00 +0100 +Subject: openssl: respect system crypto policy for TLS max version + +Implement a compromise between application control and system security +policy for TLS maximum version: + +- When user explicitly sets --tls-max: honor user choice (app control) +- When user accepts default: respect OpenSSL crypto-policy (system policy) + +This allows: + curl --tls-max 1.3 https://... # Uses TLS 1.3 (overrides policy) + curl https://... # Respects crypto-policy + +Previously, curl called SSL_CTX_set_max_proto_version(ctx, 0) even when +user didn't specify --tls-max, which overrides system crypto-policy and +enables all TLS versions up to the highest supported. + +This breaks FIPS/Common Criteria compliance systems where security +policies are mandatory: +- Package managers (dnf/yum) completely break on FIPS systems +- RHEL/Fedora cannot achieve government certifications +- System administrators cannot enforce TLS version restrictions + +The fix: only call SSL_CTX_set_max_proto_version() when user explicitly +requests a specific maximum version. Otherwise, let OpenSSL use its +configured default from crypto-policy. + +This mirrors the intended behavior of the minimum version logic, where +explicit user choice overrides defaults, but system configuration is +respected otherwise. + +Tested on RHEL 9.6+, RHEL 10, and Fedora Rawhide. +--- + lib/vtls/openssl.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 1234567890..abcdef1234 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -2939,19 +2939,22 @@ ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx) + ossl_ssl_version_max = TLS1_3_VERSION; + break; + #endif +- case CURL_SSLVERSION_MAX_NONE: /* none selected */ +- case CURL_SSLVERSION_MAX_DEFAULT: /* max selected */ +- default: +- /* SSL_CTX_set_max_proto_version states that: +- setting the maximum to 0 will enable +- protocol versions up to the highest version +- supported by the library */ +- ossl_ssl_version_max = 0; +- break; + } + +- if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) { +- return CURLE_SSL_CONNECT_ERROR; ++ /* Only set max version if user explicitly requested a specific version ++ via --tls-max option. This honors user intent when specified. ++ ++ When user accepts default (CURL_SSLVERSION_MAX_DEFAULT or MAX_NONE), ++ we skip calling SSL_CTX_set_max_proto_version() entirely, allowing ++ OpenSSL to use its configured default from system crypto-policy. ++ ++ This is a deliberate compromise: explicit user choice overrides system ++ policy, but system policy is respected when user doesn't specify. */ ++ if(curl_ssl_version_max != CURL_SSLVERSION_MAX_NONE && ++ curl_ssl_version_max != CURL_SSLVERSION_MAX_DEFAULT) { ++ if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) { ++ return CURLE_SSL_CONNECT_ERROR; ++ } + } + + return CURLE_OK; +-- +2.45.2 diff --git a/curl.spec b/curl.spec index 14dd417..8dd0b85 100644 --- a/curl.spec +++ b/curl.spec @@ -1,7 +1,7 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 8.12.1 -Release: 2%{?dist} +Release: 2%{?dist}.2 License: curl Source0: https://curl.se/download/%{name}-%{version}.tar.xz Source1: https://curl.se/download/%{name}-%{version}.tar.xz.asc @@ -10,6 +10,12 @@ Source1: https://curl.se/download/%{name}-%{version}.tar.xz.asc # which points to the GPG key as of April 7th 2016 of https://daniel.haxx.se/mykey.asc Source2: mykey.asc +# cookie: don't treat the leading slash as trailing (CVE-2025-9086) +Patch001: 0001-curl-8.12.1-CVE-2025-9086.patch + +# openssl: respect system crypto policy for TLS max version +Patch002: 0002-curl-8.12.1-respect-system-crypto-policy.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -395,6 +401,13 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog +* Thu Nov 27 2025 Jacek Migacz - 8.12.1-2.el10_1.2 +- openssl: respect system crypto policy for TLS max version (RHEL-128923) + +* Wed Oct 22 2025 Jacek Migacz - 8.12.1-2.el10_1.1 +- cookie: don't treat the leading slash as trailing (CVE-2025-9086) + Resolves: RHEL-122689 + * Tue Apr 15 2025 Jacek Migacz - 8.12.1-2 - revert using tls-ca-bundle.pem instead of ca-bundle.crt (RHEL-56966) (temporary revert to workaround another issue RHEL-85608)