From 2be450f83b4f46e07639392c13cfab8444d99790 Mon Sep 17 00:00:00 2001
From: Peridot Bot <rockyautomation@rockylinux.org>
Date: Wed, 10 Jul 2024 06:44:32 +0000
Subject: [PATCH] import curl-8.6.0-8.el10
---
SOURCES/0004-curl-8.6.0-CVE-2024-2398.patch | 89 +++++++++++++
SOURCES/0005-curl-8.6.0-CVE-2024-2004.patch | 133 ++++++++++++++++++++
SPECS/curl.spec | 21 +++-
3 files changed, 242 insertions(+), 1 deletion(-)
create mode 100644 SOURCES/0004-curl-8.6.0-CVE-2024-2398.patch
create mode 100644 SOURCES/0005-curl-8.6.0-CVE-2024-2004.patch
diff --git a/SOURCES/0004-curl-8.6.0-CVE-2024-2398.patch b/SOURCES/0004-curl-8.6.0-CVE-2024-2398.patch
new file mode 100644
index 0000000..eec7ae4
--- /dev/null
+++ b/SOURCES/0004-curl-8.6.0-CVE-2024-2398.patch
@@ -0,0 +1,89 @@
+From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 6 Mar 2024 09:36:08 +0100
+Subject: [PATCH] http2: push headers better cleanup
+
+- provide common cleanup method for push headers
+
+Closes #13054
+---
+ lib/http2.c | 34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/lib/http2.c b/lib/http2.c
+index c63ecd38371ab4..96868728a53a1f 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -271,6 +271,15 @@ static CURLcode http2_data_setup(struct Curl_cfilter *cf,
+ return CURLE_OK;
+ }
+
++static void free_push_headers(struct stream_ctx *stream)
++{
++ size_t i;
++ for(i = 0; i<stream->push_headers_used; i++)
++ free(stream->push_headers[i]);
++ Curl_safefree(stream->push_headers);
++ stream->push_headers_used = 0;
++}
++
+ static void http2_data_done(struct Curl_cfilter *cf,
+ struct Curl_easy *data, bool premature)
+ {
+@@ -324,15 +333,7 @@ static void http2_data_done(struct Curl_cfilter *cf,
+ Curl_bufq_free(&stream->recvbuf);
+ Curl_h1_req_parse_free(&stream->h1);
+ Curl_dynhds_free(&stream->resp_trailers);
+- if(stream->push_headers) {
+- /* if they weren't used and then freed before */
+- for(; stream->push_headers_used > 0; --stream->push_headers_used) {
+- free(stream->push_headers[stream->push_headers_used - 1]);
+- }
+- free(stream->push_headers);
+- stream->push_headers = NULL;
+- }
+-
++ free_push_headers(stream);
+ free(stream);
+ H2_STREAM_LCTX(data) = NULL;
+ }
+@@ -860,7 +861,6 @@ static int push_promise(struct Curl_cfilter *cf,
+ struct curl_pushheaders heads;
+ CURLMcode rc;
+ CURLcode result;
+- size_t i;
+ /* clone the parent */
+ struct Curl_easy *newhandle = h2_duphandle(cf, data);
+ if(!newhandle) {
+@@ -905,11 +905,7 @@ static int push_promise(struct Curl_cfilter *cf,
+ Curl_set_in_callback(data, false);
+
+ /* free the headers again */
+- for(i = 0; i<stream->push_headers_used; i++)
+- free(stream->push_headers[i]);
+- free(stream->push_headers);
+- stream->push_headers = NULL;
+- stream->push_headers_used = 0;
++ free_push_headers(stream);
+
+ if(rv) {
+ DEBUGASSERT((rv > CURL_PUSH_OK) && (rv <= CURL_PUSH_ERROROUT));
+@@ -1430,14 +1426,14 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
+ if(stream->push_headers_alloc > 1000) {
+ /* this is beyond crazy many headers, bail out */
+ failf(data_s, "Too many PUSH_PROMISE headers");
+- Curl_safefree(stream->push_headers);
++ free_push_headers(stream);
+ return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+ }
+ stream->push_headers_alloc *= 2;
+- headp = Curl_saferealloc(stream->push_headers,
+- stream->push_headers_alloc * sizeof(char *));
++ headp = realloc(stream->push_headers,
++ stream->push_headers_alloc * sizeof(char *));
+ if(!headp) {
+- stream->push_headers = NULL;
++ free_push_headers(stream);
+ return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+ }
+ stream->push_headers = headp;
diff --git a/SOURCES/0005-curl-8.6.0-CVE-2024-2004.patch b/SOURCES/0005-curl-8.6.0-CVE-2024-2004.patch
new file mode 100644
index 0000000..26ec21f
--- /dev/null
+++ b/SOURCES/0005-curl-8.6.0-CVE-2024-2004.patch
@@ -0,0 +1,133 @@
+From 17d302e56221f5040092db77d4f85086e8a20e0e Mon Sep 17 00:00:00 2001
+From: Daniel Gustafsson <daniel@yesql.se>
+Date: Tue, 27 Feb 2024 15:43:56 +0100
+Subject: [PATCH] setopt: Fix disabling all protocols
+
+When disabling all protocols without enabling any, the resulting
+set of allowed protocols remained the default set. Clearing the
+allowed set before inspecting the passed value from --proto make
+the set empty even in the errorpath of no protocols enabled.
+
+Co-authored-by: Dan Fandrich <dan@telarity.com>
+Reported-by: Dan Fandrich <dan@telarity.com>
+Reviewed-by: Daniel Stenberg <daniel@haxx.se>
+Closes: #13004
+---
+ lib/setopt.c | 16 ++++++++--------
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test1474 | 42 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 51 insertions(+), 9 deletions(-)
+ create mode 100644 tests/data/test1474
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 6a4990cce6731b..ce1321fc80be9d 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -155,6 +155,12 @@ static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp)
+
+ static CURLcode protocol2num(const char *str, curl_prot_t *val)
+ {
++ /*
++ * We are asked to cherry-pick protocols, so play it safe and disallow all
++ * protocols to start with, and re-add the wanted ones back in.
++ */
++ *val = 0;
++
+ if(!str)
+ return CURLE_BAD_FUNCTION_ARGUMENT;
+
+@@ -163,8 +169,6 @@ static CURLcode protocol2num(const char *str, curl_prot_t *val)
+ return CURLE_OK;
+ }
+
+- *val = 0;
+-
+ do {
+ const char *token = str;
+ size_t tlen;
+@@ -2654,22 +2658,18 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+ break;
+
+ case CURLOPT_PROTOCOLS_STR: {
+- curl_prot_t prot;
+ argptr = va_arg(param, char *);
+- result = protocol2num(argptr, &prot);
++ result = protocol2num(argptr, &data->set.allowed_protocols);
+ if(result)
+ return result;
+- data->set.allowed_protocols = prot;
+ break;
+ }
+
+ case CURLOPT_REDIR_PROTOCOLS_STR: {
+- curl_prot_t prot;
+ argptr = va_arg(param, char *);
+- result = protocol2num(argptr, &prot);
++ result = protocol2num(argptr, &data->set.redir_protocols);
+ if(result)
+ return result;
+- data->set.redir_protocols = prot;
+ break;
+ }
+
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index c20f90d945cc90..b80ffb618e55b9 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -187,7 +187,7 @@ test1439 test1440 test1441 test1442 test1443 test1444 test1445 test1446 \
+ test1447 test1448 test1449 test1450 test1451 test1452 test1453 test1454 \
+ test1455 test1456 test1457 test1458 test1459 test1460 test1461 test1462 \
+ test1463 test1464 test1465 test1466 test1467 test1468 test1469 test1470 \
+-test1471 test1472 test1473 test1475 test1476 test1477 test1478 \
++test1471 test1472 test1473 test1474 test1475 test1476 test1477 test1478 \
+ \
+ test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
+ test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
+diff --git a/tests/data/test1474 b/tests/data/test1474
+new file mode 100644
+index 00000000000000..c66fa2810483f2
+--- /dev/null
++++ b/tests/data/test1474
+@@ -0,0 +1,42 @@
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++--proto
++</keywords>
++</info>
++
++#
++# Server-side
++<reply>
++<data>
++</data>
++</reply>
++
++#
++# Client-side
++<client>
++<server>
++none
++</server>
++<features>
++http
++</features>
++<name>
++--proto -all disables all protocols
++</name>
++<command>
++--proto -all http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER
++</command>
++</client>
++
++#
++# Verify data after the test has been "shot"
++<verify>
++# 1 - Protocol "http" disabled
++<errorcode>
++1
++</errorcode>
++</verify>
++</testcase>
diff --git a/SPECS/curl.spec b/SPECS/curl.spec
index 0f47032..e621183 100644
--- a/SPECS/curl.spec
+++ b/SPECS/curl.spec
@@ -1,7 +1,7 @@
Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
Name: curl
Version: 8.6.0
-Release: 7%{?dist}
+Release: 8%{?dist}
License: curl
Source0: https://curl.se/download/%{name}-%{version}.tar.xz
Source1: https://curl.se/download/%{name}-%{version}.tar.xz.asc
@@ -21,6 +21,13 @@ Patch002: 0002-curl-8.6.0-ignore-response-body-to-HEAD.patch
# it breaks pycurl tests suite
Patch003: 0003-curl-8.6.0-vtls-revert-receive-max-buffer-add-test-case.patch
+# http2: push headers better cleanup (CVE-2024-2398)
+# provide common cleanup method for push headers
+Patch004: 0004-curl-8.6.0-CVE-2024-2398.patch
+
+# setopt: Fix disabling all protocols (CVE-2024-2004)
+Patch005: 0005-curl-8.6.0-CVE-2024-2004.patch
+
# patch making libcurl multilib ready
Patch101: 0101-curl-7.32.0-multilib.patch
@@ -158,6 +165,8 @@ uploading, HTTP form based upload, proxies, cookies, user+password
authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer
resume, proxy tunneling and a busload of other useful tricks.
+%bcond openssl_engine %[!(0%{?rhel} >= 10)]
+
%package -n libcurl
Summary: A library for getting files from web servers
Requires: libnghttp2%{?_isa} >= %{libnghttp2_version}
@@ -238,6 +247,11 @@ sed -e 's|^35$|35,52|' -i tests/data/test323
autoreconf -fiv
%build
+
+%if %{without openssl_engine}
+export CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE"
+%endif
+
mkdir build-{full,minimal}
export common_configure_opts=" \
--cache-file=../config.cache \
@@ -411,6 +425,11 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/mk-ca-bundle.1*
%{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
%changelog
+* Tue Jul 9 2024 Jacek Migacz <jmigacz@redhat.com> - 8.6.0-8
+- disable OpenSSL Engine API support (RHEL-30436)
+- setopt: Fix disabling all protocols (CVE-2024-2004)
+- http2: push headers better cleanup (CVE-2024-2398)
+
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 8.6.0-7
- Bump release for June 2024 mass rebuild
--
GitLab