Lowercase the domain names before PSL checks

Resolves: RHEL-17600

0036-curl-7.76.1-CVE-2023-46218.patch

@@ -0,0 +1,48 @@
+From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 23 Nov 2023 08:15:47 +0100
+Subject: [PATCH] cookie: lowercase the domain names before PSL checks
+
+Reported-by: Harry Sintonen
+
+Closes #12387
+---
+ lib/cookie.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 568cf537ad1b1f..9095cea3e97f22 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1027,15 +1027,23 @@ Curl_cookie_add(struct Curl_easy *data,
+    * dereference it.
+    */
+   if(data && (domain && co->domain && !isip(co->domain))) {
+-    const psl_ctx_t *psl = Curl_psl_use(data);
+-    int acceptable;
+-
+-    if(psl) {
+-      acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
+-      Curl_psl_release(data);
++    bool acceptable = FALSE;
++    char lcase[256];
++    char lcookie[256];
++    size_t dlen = strlen(domain);
++    size_t clen = strlen(co->domain);
++    if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
++      const psl_ctx_t *psl = Curl_psl_use(data);
++      if(psl) {
++        /* the PSL check requires lowercase domain name and pattern */
++        Curl_strntolower(lcase, domain, dlen + 1);
++        Curl_strntolower(lcookie, co->domain, clen + 1);
++        acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
++        Curl_psl_release(data);
++      }
++      else
++        acceptable = !bad_domain(domain);
+     }
+-    else
+-      acceptable = !bad_domain(domain);
+ 
+     if(!acceptable) {
+       infof(data, "cookie '%s' dropped, domain '%s' must not "

curl.spec

@@ -107,6 +107,9 @@ Patch34:  0034-curl-7.76.1-CVE-2023-38546.patch
 # cap SFTP packet size sent (RHEL-14697)
 Patch35:  0035-curl-7.76.1-64K-sftp.patch
 
+# lowercase the domain names before PSL checks (CVE-2023-46218)
+Patch36:  0036-curl-7.76.1-CVE-2023-46218.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -316,6 +319,7 @@ be installed.
 %patch33 -p1
 %patch34 -p1
 %patch35 -p1
+%patch36 -p1
 
 # Fedora patches
 %patch101 -p1
@@ -545,6 +549,7 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 - return error if hostname too long for remote resolve (CVE-2023-38545)
 - fix cookie injection with none file (CVE-2023-38546)
 - cap SFTP packet size sent (RHEL-14697)
+- lowercase the domain names before PSL checks (CVE-2023-46218)
 
 * Tue Sep 12 2023 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-27
 - when keyboard-interactive auth fails, try password (#2229800)