Skip to content

Commit b60d955

Browse files
[AutoPR- Security] Patch curl for CVE-2025-14017 [MEDIUM] (#15474)
Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com>
1 parent 6c17b96 commit b60d955

6 files changed

Lines changed: 136 additions & 15 deletions

File tree

SPECS/curl/CVE-2025-14017.patch

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
From 477745dc74450c96f10afdacdcfecac67b50f138 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Fri, 9 Jan 2026 03:55:08 +0000
4+
Subject: [PATCH] ldap: call ldap_init() before setting the options; set
5+
options on server; adjust CACERTFILE and REQUIRE_CERT; move init earlier and
6+
remove duplicate init; update error message; consistent with upstream patch
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: AI Backport of https://github.com/curl/curl/commit/39d1976b7f709a516e324333.patch
10+
---
11+
lib/ldap.c | 49 +++++++++++++++++++------------------------------
12+
1 file changed, 19 insertions(+), 30 deletions(-)
13+
14+
diff --git a/lib/ldap.c b/lib/ldap.c
15+
index 2cbdb9c..a1e60b0 100644
16+
--- a/lib/ldap.c
17+
+++ b/lib/ldap.c
18+
@@ -367,16 +367,29 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
19+
passwd = conn->passwd;
20+
}
21+
22+
+#ifdef USE_WIN32_LDAP
23+
+ if(ldap_ssl)
24+
+ server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1);
25+
+ else
26+
+#else
27+
+ server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port);
28+
+#endif
29+
+ if(!server) {
30+
+ failf(data, "LDAP: cannot setup connect to %s:%u",
31+
+ conn->host.dispname, conn->primary.remote_port);
32+
+ result = CURLE_COULDNT_CONNECT;
33+
+ goto quit;
34+
+ }
35+
+
36+
#ifdef LDAP_OPT_NETWORK_TIMEOUT
37+
- ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
38+
+ ldap_set_option(server, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
39+
#endif
40+
- ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
41+
+ ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
42+
43+
if(ldap_ssl) {
44+
#ifdef HAVE_LDAP_SSL
45+
#ifdef USE_WIN32_LDAP
46+
/* Win32 LDAP SDK does not support insecure mode without CA! */
47+
- server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1);
48+
ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
49+
#else
50+
int ldap_option;
51+
@@ -444,7 +457,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
52+
goto quit;
53+
}
54+
infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
55+
- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
56+
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
57+
if(rc != LDAP_SUCCESS) {
58+
failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
59+
ldap_err2string(rc));
60+
@@ -456,20 +469,13 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
61+
else
62+
ldap_option = LDAP_OPT_X_TLS_NEVER;
63+
64+
- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
65+
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
66+
if(rc != LDAP_SUCCESS) {
67+
failf(data, "LDAP local: ERROR setting cert verify mode: %s",
68+
ldap_err2string(rc));
69+
result = CURLE_SSL_CERTPROBLEM;
70+
goto quit;
71+
}
72+
- server = ldap_init(host, conn->primary.remote_port);
73+
- if(!server) {
74+
- failf(data, "LDAP local: Cannot connect to %s:%u",
75+
- conn->host.dispname, conn->primary.remote_port);
76+
- result = CURLE_COULDNT_CONNECT;
77+
- goto quit;
78+
- }
79+
ldap_option = LDAP_OPT_X_TLS_HARD;
80+
rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
81+
if(rc != LDAP_SUCCESS) {
82+
@@ -478,15 +484,6 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
83+
result = CURLE_SSL_CERTPROBLEM;
84+
goto quit;
85+
}
86+
-/*
87+
- rc = ldap_start_tls_s(server, NULL, NULL);
88+
- if(rc != LDAP_SUCCESS) {
89+
- failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
90+
- ldap_err2string(rc));
91+
- result = CURLE_SSL_CERTPROBLEM;
92+
- goto quit;
93+
- }
94+
-*/
95+
#else
96+
(void)ldap_option;
97+
(void)ldap_ca;
98+
@@ -505,15 +502,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
99+
result = CURLE_NOT_BUILT_IN;
100+
goto quit;
101+
}
102+
- else {
103+
- server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port);
104+
- if(!server) {
105+
- failf(data, "LDAP local: Cannot connect to %s:%u",
106+
- conn->host.dispname, conn->primary.remote_port);
107+
- result = CURLE_COULDNT_CONNECT;
108+
- goto quit;
109+
- }
110+
- }
111+
+
112+
#ifdef USE_WIN32_LDAP
113+
ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
114+
rc = ldap_win_bind(data, server, user, passwd);
115+
--
116+
2.45.4
117+

SPECS/curl/curl.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: An URL retrieval utility and library
22
Name: curl
33
Version: 8.11.1
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: curl
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -12,6 +12,7 @@ Patch0: CVE-2025-0665.patch
1212
Patch1: CVE-2025-0167.patch
1313
Patch2: CVE-2025-0725.patch
1414
Patch3: CVE-2025-10148.patch
15+
Patch4: CVE-2025-14017.patch
1516
BuildRequires: cmake
1617
BuildRequires: krb5-devel
1718
BuildRequires: libnghttp2-devel
@@ -102,6 +103,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
102103
%{_libdir}/libcurl.so.*
103104

104105
%changelog
106+
* Fri Jan 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.11.1-5
107+
- Patch for CVE-2025-14017
108+
105109
* Thu Sep 11 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.11.1-4
106110
- Patch for CVE-2025-10148
107111

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -199,9 +199,9 @@ krb5-1.21.3-3.azl3.aarch64.rpm
199199
krb5-devel-1.21.3-3.azl3.aarch64.rpm
200200
nghttp2-1.61.0-2.azl3.aarch64.rpm
201201
nghttp2-devel-1.61.0-2.azl3.aarch64.rpm
202-
curl-8.11.1-4.azl3.aarch64.rpm
203-
curl-devel-8.11.1-4.azl3.aarch64.rpm
204-
curl-libs-8.11.1-4.azl3.aarch64.rpm
202+
curl-8.11.1-5.azl3.aarch64.rpm
203+
curl-devel-8.11.1-5.azl3.aarch64.rpm
204+
curl-libs-8.11.1-5.azl3.aarch64.rpm
205205
createrepo_c-1.0.3-1.azl3.aarch64.rpm
206206
libxml2-2.11.5-8.azl3.aarch64.rpm
207207
libxml2-devel-2.11.5-8.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -199,9 +199,9 @@ krb5-1.21.3-3.azl3.x86_64.rpm
199199
krb5-devel-1.21.3-3.azl3.x86_64.rpm
200200
nghttp2-1.61.0-2.azl3.x86_64.rpm
201201
nghttp2-devel-1.61.0-2.azl3.x86_64.rpm
202-
curl-8.11.1-4.azl3.x86_64.rpm
203-
curl-devel-8.11.1-4.azl3.x86_64.rpm
204-
curl-libs-8.11.1-4.azl3.x86_64.rpm
202+
curl-8.11.1-5.azl3.x86_64.rpm
203+
curl-devel-8.11.1-5.azl3.x86_64.rpm
204+
curl-libs-8.11.1-5.azl3.x86_64.rpm
205205
createrepo_c-1.0.3-1.azl3.x86_64.rpm
206206
libxml2-2.11.5-8.azl3.x86_64.rpm
207207
libxml2-devel-2.11.5-8.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,10 @@ cracklib-lang-2.9.11-1.azl3.aarch64.rpm
6767
createrepo_c-1.0.3-1.azl3.aarch64.rpm
6868
createrepo_c-debuginfo-1.0.3-1.azl3.aarch64.rpm
6969
createrepo_c-devel-1.0.3-1.azl3.aarch64.rpm
70-
curl-8.11.1-4.azl3.aarch64.rpm
71-
curl-debuginfo-8.11.1-4.azl3.aarch64.rpm
72-
curl-devel-8.11.1-4.azl3.aarch64.rpm
73-
curl-libs-8.11.1-4.azl3.aarch64.rpm
70+
curl-8.11.1-5.azl3.aarch64.rpm
71+
curl-debuginfo-8.11.1-5.azl3.aarch64.rpm
72+
curl-devel-8.11.1-5.azl3.aarch64.rpm
73+
curl-libs-8.11.1-5.azl3.aarch64.rpm
7474
Cython-debuginfo-3.0.5-2.azl3.aarch64.rpm
7575
debugedit-5.0-2.azl3.aarch64.rpm
7676
debugedit-debuginfo-5.0-2.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,10 @@ createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
7272
createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
7373
cross-binutils-common-2.41-10.azl3.noarch.rpm
7474
cross-gcc-common-13.2.0-7.azl3.noarch.rpm
75-
curl-8.11.1-4.azl3.x86_64.rpm
76-
curl-debuginfo-8.11.1-4.azl3.x86_64.rpm
77-
curl-devel-8.11.1-4.azl3.x86_64.rpm
78-
curl-libs-8.11.1-4.azl3.x86_64.rpm
75+
curl-8.11.1-5.azl3.x86_64.rpm
76+
curl-debuginfo-8.11.1-5.azl3.x86_64.rpm
77+
curl-devel-8.11.1-5.azl3.x86_64.rpm
78+
curl-libs-8.11.1-5.azl3.x86_64.rpm
7979
Cython-debuginfo-3.0.5-2.azl3.x86_64.rpm
8080
debugedit-5.0-2.azl3.x86_64.rpm
8181
debugedit-debuginfo-5.0-2.azl3.x86_64.rpm

0 commit comments

Comments
 (0)