diff --git a/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch b/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch index 2fbfd42..44bf37a 100644 --- a/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch +++ b/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch @@ -153,7 +153,7 @@ index 7ebe61321419f..1cecb649cb623 100644 if(rc == SSH_OK) { sshc->authed = TRUE; infof(data, "completed keyboard interactive authentication\n"); -+ state(conn, SSH_AUTH_DONE); ++ state(data, SSH_AUTH_DONE); + } + else { + MOVE_TO_PASSWD_AUTH; diff --git a/SOURCES/0060-curl-7.61.1-64K-sftp.patch b/SOURCES/0054-curl-7.61.1-64K-sftp.patch similarity index 100% rename from SOURCES/0060-curl-7.61.1-64K-sftp.patch rename to SOURCES/0054-curl-7.61.1-64K-sftp.patch diff --git a/SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch b/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch similarity index 98% rename from SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch rename to SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch index 3aef7dd..4aa552b 100644 --- a/SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch +++ b/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch @@ -103,7 +103,7 @@ index b3c0063b2cfb2..41e9e7a6914e0 100644 - char *filename; /* file we read from/write to */ bool running; /* state info, for cookie adding information */ - long numcookies; /* number of cookies in the "jar" */ -+ int numcookies; /* number of cookies in the "jar" */ ++ int numcookies; /* number of cookies in the "jar" */ bool newsession; /* new session, discard session cookies on load */ int lastct; /* last creation-time used in the jar */ }; diff --git a/SOURCES/0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch b/SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch similarity index 100% rename from SOURCES/0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch rename to SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch diff --git a/SOURCES/0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch b/SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch similarity index 100% rename from SOURCES/0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch rename to SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch diff --git a/SOURCES/0058-curl-7.61.1-CVE-2023-46218.patch b/SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch similarity index 100% rename from SOURCES/0058-curl-7.61.1-CVE-2023-46218.patch rename to SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch diff --git a/SOURCES/0059-curl-7.61.1-lowercase-headernames.patch b/SOURCES/0060-curl-7.61.1-lowercase-headernames.patch similarity index 100% rename from SOURCES/0059-curl-7.61.1-lowercase-headernames.patch rename to SOURCES/0060-curl-7.61.1-lowercase-headernames.patch diff --git a/SPECS/curl.spec b/SPECS/curl.spec index 692d063..294d1f3 100644 --- a/SPECS/curl.spec +++ b/SPECS/curl.spec @@ -1,7 +1,7 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.61.1 -Release: 33%{?dist}.5 +Release: 34%{?dist} License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz @@ -154,26 +154,26 @@ Patch52: 0052-curl-7.61.1-certs.patch # when keyboard-interactive auth fails, try password Patch53: 0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch -# fix cookie injection with none file (CVE-2023-38546) -Patch54: 0054-curl-7.61.1-CVE-2023-38546.patch +# cap SFTP packet size sent +Patch54: 0054-curl-7.61.1-64K-sftp.patch # unify the upload/method handling (CVE-2023-28322) Patch55: 0055-curl-7.61.1-CVE-2023-28322.patch +# fix cookie injection with none file (CVE-2023-38546) +Patch56: 0056-curl-7.61.1-CVE-2023-38546.patch + # consolidate nghttp2_session_mem_recv() call paths -Patch56: 0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch +Patch57: 0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch # when marked for closure and wanted to close == OK -Patch57: 0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch +Patch58: 0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch # lowercase the domain names before PSL checks (CVE-2023-46218) -Patch58: 0058-curl-7.61.1-CVE-2023-46218.patch +Patch59: 0059-curl-7.61.1-CVE-2023-46218.patch # lowercase headernames -Patch59: 0059-curl-7.61.1-lowercase-headernames.patch - -# cap SFTP packet size sent -Patch60: 0060-curl-7.61.1-64K-sftp.patch +Patch60: 0060-curl-7.61.1-lowercase-headernames.patch # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -570,22 +570,13 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog -* Wed Jan 24 2024 Jacek Migacz - 7.61.1-33.el8_9.5 -- cap SFTP packet size sent (RHEL-5485) - -* Tue Dec 05 2023 Jacek Migacz - 7.61.1-33.el8_9.4 +* Tue Sep 19 2023 Jacek Migacz - 7.61.1-34 +- when keyboard-interactive auth fails, try password (#2229800) +- cap SFTP packet size sent (RHEL-5311) - unify the upload/method handling (CVE-2023-28322) -- fix HTTP2 connection failure with HTTP2 framing layer (RHEL-15296) -- lowercase the domain names before PSL checks (CVE-2023-46218) - -* Thu Oct 12 2023 Jacek Migacz - 7.61.1-33.el8_9.3 - fix cookie injection with none file (CVE-2023-38546) - -* Mon Sep 25 2023 Jacek Migacz - 7.61.1-33.el8_9.2 -- fix 'incompatible pointer type' reported by OpenScanHub (#2240033) - -* Fri Sep 22 2023 Jacek Migacz - 7.61.1-33.el8_9.1 -- when keyboard-interactive auth fails, try password (#2240033) +- fix HTTP2 connection failure with HTTP2 framing layer (RHEL-5657) +- lowercase the domain names before PSL checks (CVE-2023-46218) * Tue Jun 27 2023 Jacek Migacz - 7.61.1-33 - fix host name wildcard checking (CVE-2023-28321)