diff mbox series

[kirkstone] curl: Fix multiple CVEs

Message ID 20221104052619.107569-1-hprajapati@mvista.com
State Accepted, archived
Commit 2749916ff534aecfd2a7871268b1166e5bb5bca4
Headers show
Series [kirkstone] curl: Fix multiple CVEs | expand

Commit Message

Hitendra Prajapati Nov. 4, 2022, 5:26 a.m. UTC 
Backport fixes for:
 * CVE-2022-32221 - Upstream-Status: Backport from https://github.com/curl/curl/commit/a64e3e59938abd7d6
 * CVE-2022-42915 - Upstream-Status: Backport from https://github.com/curl/curl/commit/55e1875729f9d9fc7315ce
 * CVE-2022-42916 - Upstream-Status: Backport from https://github.com/curl/curl/commit/53bcf55b4538067e6

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 .../curl/curl/CVE-2022-32221.patch            |  29 ++++
 .../curl/curl/CVE-2022-42915.patch            |  55 +++++++
 .../curl/curl/CVE-2022-42916.patch            | 136 ++++++++++++++++++
 meta/recipes-support/curl/curl_7.82.0.bb      |   3 +
 4 files changed, 223 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2022-32221.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2022-42915.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2022-42916.patch

Comments

Hitendra Prajapati Nov. 17, 2022, 11:12 a.m. UTC | #1 
Hi Steve ,
Any update or issue with this patches ?? Why it is not picked or merged ?
Hitendra Prajapati Dec. 2, 2022, 4:22 a.m. UTC | #2 
Hi Steve/Team ,
Any update or issue with this patches ?? Why it is not picked or merged ?
Martin Jansa Dec. 2, 2022, 7:41 a.m. UTC | #3 
I see the same fixes with correct Author in .patch files (please don't
change the Author when you're just backporting a patch from someone else)
queued from someone else in kirkstone-nut branch:
https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/kirkstone-nut&id=518bea85c9496d77c70d703b818e442eda841554
https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/kirkstone-nut&id=e6796b426503477620e0e5c5c9da50352269a593
https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/kirkstone-nut&id=4754f33d7ec96f72351853463540c8b1a3f4bc0c
so they should be applied soon.

On Fri, Dec 2, 2022 at 5:23 AM Hitendra Prajapati <hpprajapati@mvista.com>
wrote:

> Hi Steve/Team ,
> Any update or issue with this patches ?? Why it is not picked or merged ?
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#174219):
> https://lists.openembedded.org/g/openembedded-core/message/174219
> Mute This Topic: https://lists.openembedded.org/mt/94800386/3617156
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> Martin.Jansa@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
Hitendra Prajapati Dec. 2, 2022, 8:47 a.m. UTC | #4 
Hi Martin/Team,

Yes, I missed that part.

It is my mistake. I'm extremely sorry for that.

I'll take care of it in next patches.

Regards,
Hitendra Prajapati

On Fri, 2 Dec 2022, 1:11 pm Martin Jansa, <Martin.Jansa@gmail.com> wrote:

> I see the same fixes with correct Author in .patch files (please don't
> change the Author when you're just backporting a patch from someone else)
> queued from someone else in kirkstone-nut branch:
>
> https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/kirkstone-nut&id=518bea85c9496d77c70d703b818e442eda841554
>
> https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/kirkstone-nut&id=e6796b426503477620e0e5c5c9da50352269a593
>
> https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/kirkstone-nut&id=4754f33d7ec96f72351853463540c8b1a3f4bc0c
> so they should be applied soon.
>
> On Fri, Dec 2, 2022 at 5:23 AM Hitendra Prajapati <hpprajapati@mvista.com>
> wrote:
>
>> Hi Steve/Team ,
>> Any update or issue with this patches ?? Why it is not picked or merged ?
>>
>>
>>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#174224):
> https://lists.openembedded.org/g/openembedded-core/message/174224
> Mute This Topic: https://lists.openembedded.org/mt/94800386/6955432
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> hprajapati@mvista.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2022-32221.patch b/meta/recipes-support/curl/curl/CVE-2022-32221.patch
new file mode 100644
index 0000000000..caf4bac2cb
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-32221.patch
@@ -0,0 +1,29 @@ 
+From 84bbc1b45962cee04758b41251a5aeb452b3ec54 Mon Sep 17 00:00:00 2001
+From: Hitendra Prajapati <hprajapati@mvista.com>
+Date: Fri, 4 Nov 2022 10:05:36 +0530
+Subject: [PATCH] CVE-2022-32221
+
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a64e3e59938abd7d6]
+CVE: CVE-2022-32221
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+
+setopt: when POST is set, reset the 'upload' field
+---
+ lib/setopt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 7aa6fdb..7f5999e 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -625,6 +625,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+     }
+     else
+       data->set.method = HTTPREQ_GET;
++      data->set.upload = FALSE;
+     break;
+ 
+   case CURLOPT_HTTPPOST:
+-- 
+2.25.1
+
diff --git a/meta/recipes-support/curl/curl/CVE-2022-42915.patch b/meta/recipes-support/curl/curl/CVE-2022-42915.patch
new file mode 100644
index 0000000000..8b71a4d61c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-42915.patch
@@ -0,0 +1,55 @@ 
+From b82afc7231a23a27a671f54712e0c8b2df6be144 Mon Sep 17 00:00:00 2001
+From: Hitendra Prajapati <hprajapati@mvista.com>
+Date: Fri, 4 Nov 2022 10:08:06 +0530
+Subject: [PATCH] CVE-2022-42915
+
+Upstream-Status: Backport [https://github.com/curl/curl/commit/55e1875729f9d9fc7315ce]
+CVE: CVE-2022-42915
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+
+http_proxy: restore the protocol pointer on error
+---
+ lib/http_proxy.c | 6 ++----
+ lib/url.c        | 9 ---------
+ 2 files changed, 2 insertions(+), 13 deletions(-)
+
+diff --git a/lib/http_proxy.c b/lib/http_proxy.c
+index 5d5ffc0..e902a2a 100644
+--- a/lib/http_proxy.c
++++ b/lib/http_proxy.c
+@@ -210,10 +210,8 @@ void Curl_connect_done(struct Curl_easy *data)
+     Curl_dyn_free(&s->rcvbuf);
+     Curl_dyn_free(&s->req);
+ 
+-    /* restore the protocol pointer, if not already done */
+-    if(s->prot_save)
+-      data->req.p.http = s->prot_save;
+-    s->prot_save = NULL;
++    /* restore the protocol pointer */
++    data->req.p.http = s->prot_save;
+     data->info.httpcode = 0; /* clear it as it might've been used for the
+                                 proxy */
+     data->req.ignorebody = FALSE;
+diff --git a/lib/url.c b/lib/url.c
+index c713e54..4ae6091 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -728,15 +728,6 @@ static void conn_shutdown(struct Curl_easy *data, struct connectdata *conn)
+   DEBUGASSERT(data);
+   infof(data, "Closing connection %ld", conn->connection_id);
+ 
+-#ifndef USE_HYPER
+-  if(conn->connect_state && conn->connect_state->prot_save) {
+-    /* If this was closed with a CONNECT in progress, cleanup this temporary
+-       struct arrangement */
+-    data->req.p.http = NULL;
+-    Curl_safefree(conn->connect_state->prot_save);
+-  }
+-#endif
+-
+   /* possible left-overs from the async name resolvers */
+   Curl_resolver_cancel(data);
+ 
+-- 
+2.25.1
+
diff --git a/meta/recipes-support/curl/curl/CVE-2022-42916.patch b/meta/recipes-support/curl/curl/CVE-2022-42916.patch
new file mode 100644
index 0000000000..402f31d727
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-42916.patch
@@ -0,0 +1,136 @@ 
+From 099afdea12483391d56d3bfb8e6e7510bdc957fa Mon Sep 17 00:00:00 2001
+From: Hitendra Prajapati <hprajapati@mvista.com>
+Date: Fri, 4 Nov 2022 10:10:49 +0530
+Subject: [PATCH] CVE-2022-42916
+
+Upstream-Status: Backport [https://github.com/curl/curl/commit/53bcf55b4538067e6]
+CVE: CVE-2022-42916
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+
+url: use IDN decoded names for HSTS checks
+---
+ lib/url.c | 91 ++++++++++++++++++++++++++++---------------------------
+ 1 file changed, 47 insertions(+), 44 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 4ae6091..4707fe6 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -2003,10 +2003,56 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
+     if(!strcasecompare("file", data->state.up.scheme))
+       return CURLE_OUT_OF_MEMORY;
+   }
++  hostname = data->state.up.hostname;
++
++  if(hostname && hostname[0] == '[') {
++    /* This looks like an IPv6 address literal. See if there is an address
++       scope. */
++    size_t hlen;
++    conn->bits.ipv6_ip = TRUE;
++    /* cut off the brackets! */
++    hostname++;
++    hlen = strlen(hostname);
++    hostname[hlen - 1] = 0;
++
++    zonefrom_url(uh, data, conn);
++  }
++
++  /* make sure the connect struct gets its own copy of the host name */
++  conn->host.rawalloc = strdup(hostname ? hostname : "");
++  if(!conn->host.rawalloc)
++    return CURLE_OUT_OF_MEMORY;
++  conn->host.name = conn->host.rawalloc;
++
++  /*************************************************************
++   * IDN-convert the hostnames
++   *************************************************************/
++  result = Curl_idnconvert_hostname(data, &conn->host);
++  if(result)
++    return result;
++  if(conn->bits.conn_to_host) {
++    result = Curl_idnconvert_hostname(data, &conn->conn_to_host);
++    if(result)
++      return result;
++  }
++#ifndef CURL_DISABLE_PROXY
++  if(conn->bits.httpproxy) {
++    result = Curl_idnconvert_hostname(data, &conn->http_proxy.host);
++    if(result)
++      return result;
++  }
++  if(conn->bits.socksproxy) {
++    result = Curl_idnconvert_hostname(data, &conn->socks_proxy.host);
++    if(result)
++      return result;
++  }
++#endif
+ 
+ #ifndef CURL_DISABLE_HSTS
++  /* HSTS upgrade */
+   if(data->hsts && strcasecompare("http", data->state.up.scheme)) {
+-    if(Curl_hsts(data->hsts, data->state.up.hostname, TRUE)) {
++    /* This MUST use the IDN decoded name */
++    if(Curl_hsts(data->hsts, conn->host.name, TRUE)) {
+       char *url;
+       Curl_safefree(data->state.up.scheme);
+       uc = curl_url_set(uh, CURLUPART_SCHEME, "https", 0);
+@@ -2111,26 +2157,6 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
+ 
+   (void)curl_url_get(uh, CURLUPART_QUERY, &data->state.up.query, 0);
+ 
+-  hostname = data->state.up.hostname;
+-  if(hostname && hostname[0] == '[') {
+-    /* This looks like an IPv6 address literal. See if there is an address
+-       scope. */
+-    size_t hlen;
+-    conn->bits.ipv6_ip = TRUE;
+-    /* cut off the brackets! */
+-    hostname++;
+-    hlen = strlen(hostname);
+-    hostname[hlen - 1] = 0;
+-
+-    zonefrom_url(uh, data, conn);
+-  }
+-
+-  /* make sure the connect struct gets its own copy of the host name */
+-  conn->host.rawalloc = strdup(hostname ? hostname : "");
+-  if(!conn->host.rawalloc)
+-    return CURLE_OUT_OF_MEMORY;
+-  conn->host.name = conn->host.rawalloc;
+-
+ #ifdef ENABLE_IPV6
+   if(data->set.scope_id)
+     /* Override any scope that was set above.  */
+@@ -3705,29 +3731,6 @@ static CURLcode create_conn(struct Curl_easy *data,
+   if(result)
+     goto out;
+ 
+-  /*************************************************************
+-   * IDN-convert the hostnames
+-   *************************************************************/
+-  result = Curl_idnconvert_hostname(data, &conn->host);
+-  if(result)
+-    goto out;
+-  if(conn->bits.conn_to_host) {
+-    result = Curl_idnconvert_hostname(data, &conn->conn_to_host);
+-    if(result)
+-      goto out;
+-  }
+-#ifndef CURL_DISABLE_PROXY
+-  if(conn->bits.httpproxy) {
+-    result = Curl_idnconvert_hostname(data, &conn->http_proxy.host);
+-    if(result)
+-      goto out;
+-  }
+-  if(conn->bits.socksproxy) {
+-    result = Curl_idnconvert_hostname(data, &conn->socks_proxy.host);
+-    if(result)
+-      goto out;
+-  }
+-#endif
+ 
+   /*************************************************************
+    * Check whether the host and the "connect to host" are equal.
+-- 
+2.25.1
+
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index 5368c91f5c..8270003f62 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -29,6 +29,9 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2022-32207.patch \
            file://CVE-2022-32208.patch \
            file://CVE-2022-35252.patch \
+           file://CVE-2022-32221.patch \
+           file://CVE-2022-42915.patch \
+           file://CVE-2022-42916.patch \
            "
 SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"