From c0670d776a50b1362090b97fd1bc1512409d28dc Mon Sep 17 00:00:00 2001 From: eabdullin Date: Wed, 28 Jan 2026 07:17:48 +0000 Subject: [PATCH] import UBI curl-7.76.1-35.el9_7.3 --- SOURCES/0041-curl-7.76.1-CVE-2025-9086.patch | 48 +++++++++++ ...-7.76.1-respect-system-crypto-policy.patch | 79 +++++++++++++++++++ ...ttp-fix-crash-in-rate-limited-upload.patch | 42 ++++++++++ SPECS/curl.spec | 29 ++++++- 4 files changed, 196 insertions(+), 2 deletions(-) create mode 100644 SOURCES/0041-curl-7.76.1-CVE-2025-9086.patch create mode 100644 SOURCES/0042-curl-7.76.1-respect-system-crypto-policy.patch create mode 100644 SOURCES/0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch diff --git a/SOURCES/0041-curl-7.76.1-CVE-2025-9086.patch b/SOURCES/0041-curl-7.76.1-CVE-2025-9086.patch new file mode 100644 index 0000000..a49f121 --- /dev/null +++ b/SOURCES/0041-curl-7.76.1-CVE-2025-9086.patch @@ -0,0 +1,48 @@ +From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 11 Aug 2025 20:23:05 +0200 +Subject: [PATCH] cookie: don't treat the leading slash as trailing + +If there is only a leading slash in the path, keep that. Also add an +assert to make sure the path is never blank. + +Reported-by: Google Big Sleep +Closes #18266 +--- + lib/cookie.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 914a4aca12ac..b72dd99bce9b 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -296,7 +296,7 @@ static char *sanitize_cookie_path(const char *cookie_path) + } + + /* convert /hoge/ to /hoge */ +- if(len && new_path[len - 1] == '/') { ++ if(len > 1 && new_path[len - 1] == '/') { + new_path[len - 1] = 0x0; + } + +@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data, + if(clist->spath && co->spath) { + if(clist->secure && !co->secure && !secure) { + size_t cllen; +- const char *sep; ++ const char *sep = NULL; + + /* + * A non-secure cookie may not overlay an existing secure cookie. +@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data, + * "/loginhelper" is ok. + */ + +- sep = strchr(clist->spath + 1, '/'); +- ++ DEBUGASSERT(clist->spath[0]); ++ if(clist->spath[0]) ++ sep = strchr(clist->spath + 1, '/'); + if(sep) + cllen = sep - clist->spath; + else diff --git a/SOURCES/0042-curl-7.76.1-respect-system-crypto-policy.patch b/SOURCES/0042-curl-7.76.1-respect-system-crypto-policy.patch new file mode 100644 index 0000000..441bc06 --- /dev/null +++ b/SOURCES/0042-curl-7.76.1-respect-system-crypto-policy.patch @@ -0,0 +1,79 @@ +From: Jacek Migacz +Date: Mon, 4 Nov 2025 10:00:00 +0100 +Subject: [PATCH] openssl: respect system crypto policy for TLS max version + +Implement a compromise between application control and system security +policy for TLS maximum version: + +- When user explicitly sets --tls-max: honor user choice (app control) +- When user accepts default: respect OpenSSL crypto-policy (system policy) + +This allows: + curl --tls-max 1.3 https://... # Uses TLS 1.3 (overrides policy) + curl https://... # Respects crypto-policy + +Previously, curl called SSL_CTX_set_max_proto_version(ctx, 0) even when +user didn't specify --tls-max, which overrides system crypto-policy and +enables all TLS versions up to the highest supported. + +This breaks FIPS/Common Criteria compliance systems where security +policies are mandatory: +- Package managers (dnf/yum) completely break on FIPS systems +- RHEL/Fedora cannot achieve government certifications +- System administrators cannot enforce TLS version restrictions + +The fix: only call SSL_CTX_set_max_proto_version() when user explicitly +requests a specific maximum version. Otherwise, let OpenSSL use its +configured default from crypto-policy. + +This mirrors the intended behavior of the minimum version logic, where +explicit user choice overrides defaults, but system configuration is +respected otherwise. + +Tested on RHEL 9.6+, RHEL 10, and Fedora Rawhide. + +Bug: https://github.com/curl/curl/issues/XXXXX +--- + lib/vtls/openssl.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 1234567890..abcdef1234 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -2354,19 +2354,22 @@ set_ssl_version_min_max(SSL_CTX *ctx, struct connectdata *conn) + ossl_ssl_version_max = TLS1_3_VERSION; + break; + #endif +- case CURL_SSLVERSION_MAX_NONE: /* none selected */ +- case CURL_SSLVERSION_MAX_DEFAULT: /* max selected */ +- default: +- /* SSL_CTX_set_max_proto_version states that: +- setting the maximum to 0 will enable +- protocol versions up to the highest version +- supported by the library */ +- ossl_ssl_version_max = 0; +- break; + } + +- if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) { +- return CURLE_SSL_CONNECT_ERROR; ++ /* Only set max version if user explicitly requested a specific version ++ via --tls-max option. This honors user intent when specified. ++ ++ When user accepts default (CURL_SSLVERSION_MAX_DEFAULT or MAX_NONE), ++ we skip calling SSL_CTX_set_max_proto_version() entirely, allowing ++ OpenSSL to use its configured default from system crypto-policy. ++ ++ This is a deliberate compromise: explicit user choice overrides system ++ policy, but system policy is respected when user doesn't specify. */ ++ if(curl_ssl_version_max != CURL_SSLVERSION_MAX_NONE && ++ curl_ssl_version_max != CURL_SSLVERSION_MAX_DEFAULT) { ++ if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) { ++ return CURLE_SSL_CONNECT_ERROR; ++ } + } + + return CURLE_OK; +-- +2.45.2 diff --git a/SOURCES/0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch b/SOURCES/0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch new file mode 100644 index 0000000..df32d62 --- /dev/null +++ b/SOURCES/0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch @@ -0,0 +1,42 @@ +From ca8893468f3ca1bcd04a61691878e09b5824180c Mon Sep 17 00:00:00 2001 +From: Jay Satiro +Date: Tue, 29 Jun 2021 11:43:35 -0400 +Subject: [PATCH] http: fix crash in rate-limited upload + +- Don't set the size of the piece of data to send to the rate limit if + that limit is larger than the buffer size that will hold the piece. + +Prior to this change if CURLOPT_MAX_SEND_SPEED_LARGE +(curl tool: --limit-rate) was set then it was possible that a temporary +buffer used for uploading could be written to out of bounds. A likely +scenario for this would be a non-trivial amount of post data combined +with a rate limit larger than CURLOPT_UPLOAD_BUFFERSIZE (default 64k). + +The bug was introduced in 24e469f which is in releases since 7.76.0. + +perl -e "print '0' x 200000" > tmp +curl --limit-rate 128k -d @tmp httpbin.org/post + +Reported-by: Richard Marion + +Fixes https://github.com/curl/curl/issues/7308 +Closes https://github.com/curl/curl/pull/7315 +--- + lib/http.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/http.c b/lib/http.c +index 6d5d8fb3b2..ac0301bc41 100644 +--- a/lib/http.c ++++ b/lib/http.c +@@ -1177,6 +1177,7 @@ static size_t readmoredata(char *buffer, + data->req.forbidchunk = (http->sending == HTTPSEND_REQUEST)?TRUE:FALSE; + + if(data->set.max_send_speed && ++ (data->set.max_send_speed < (curl_off_t)fullsize) && + (data->set.max_send_speed < http->postsize)) + /* speed limit */ + fullsize = (size_t)data->set.max_send_speed; +-- +2.51.0 + diff --git a/SPECS/curl.spec b/SPECS/curl.spec index f833bc0..b2c9837 100644 --- a/SPECS/curl.spec +++ b/SPECS/curl.spec @@ -1,7 +1,7 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.76.1 -Release: 34%{?dist} +Release: 35%{?dist}.3 License: MIT Source: https://curl.se/download/%{name}-%{version}.tar.xz @@ -122,6 +122,15 @@ Patch39: 0039-curl-7.76.1-pause-on-http.patch # noproxy: support proxies specified using cidr notation Patch40: 0040-curl-7.76.1-noproxy-support-using-cidr.patch +# cookie: don't treat the leading slash as trailing (CVE-2025-9086) +Patch041: 0041-curl-7.76.1-CVE-2025-9086.patch + +# openssl: respect system crypto policy for TLS max version +Patch042: 0042-curl-7.76.1-respect-system-crypto-policy.patch + +# http: fix crash in rate-limited upload +Patch043: 0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -336,6 +345,9 @@ be installed. %patch -P 38 -p1 %patch -P 39 -p1 %patch -P 40 -p1 +%patch -P 41 -p1 +%patch -P 42 -p1 +%patch -P 43 -p1 # Fedora patches %patch -P 101 -p1 @@ -561,7 +573,20 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog -* Mon Jul 23 2025 Jacek Migacz - 7.76.1-34 +* Tue Dec 02 2025 Jacek Migacz - 7.76.1-35.el9_7.3 +- http: fix crash in rate-limited upload (RHEL-129493) + +* Fri Nov 28 2025 Jacek Migacz - 7.76.1-35.el9_7.2 +- openssl: respect system crypto policy for TLS max version (RHEL-128921) + +* Tue Nov 18 2025 Jacek Migacz - 7.76.1-35.el9_7.1 +- rebuild for rhel-9.7.0 z-stream (RHEL-121659) + +* Thu Oct 23 2025 Jacek Migacz - 7.76.1-35 +- cookie: don't treat the leading slash as trailing (CVE-2025-9086) + Resolves: RHEL-121659 + +* Wed Jul 23 2025 Jacek Migacz - 7.76.1-34 - revert several disabled tests related to openssl/valgrind (RHEL-99465) * Thu May 15 2025 Jacek Migacz - 7.76.1-33