Skip to content

Commit ea3e039

Browse files
[AUTO-CHERRYPICK] Patch curl for CVE-2024-9681 [Medium] - branch main (#12664)
Co-authored-by: bhagyapathak <bhagyapathak@users.noreply.github.com>
1 parent 5de4b48 commit ea3e039

6 files changed

Lines changed: 83 additions & 15 deletions

File tree

SPECS/curl/CVE-2024-9681.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
diff --git a/lib/hsts.c b/lib/hsts.c
2+
index a5e7676..69841a2 100644
3+
--- a/lib/hsts.c
4+
+++ b/lib/hsts.c
5+
@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
6+
struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
7+
bool subdomain)
8+
{
9+
+ struct stsentry *bestsub = NULL;
10+
if(h) {
11+
char buffer[MAX_HSTS_HOSTLEN + 1];
12+
time_t now = time(NULL);
13+
size_t hlen = strlen(hostname);
14+
struct Curl_llist_element *e;
15+
struct Curl_llist_element *n;
16+
+ size_t blen = 0;
17+
18+
if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
19+
return NULL;
20+
@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
21+
if(ntail < hlen) {
22+
size_t offs = hlen - ntail;
23+
if((hostname[offs-1] == '.') &&
24+
- strncasecompare(&hostname[offs], sts->host, ntail))
25+
- return sts;
26+
+ strncasecompare(&hostname[offs], sts->host, ntail) &&
27+
+ (ntail > blen)) {
28+
+ /* save the tail match with the longest tail */
29+
+ bestsub = sts;
30+
+ blen = ntail;
31+
+ }
32+
}
33+
}
34+
if(strcasecompare(hostname, sts->host))
35+
return sts;
36+
}
37+
}
38+
- return NULL; /* no match */
39+
+ return bestsub; /* no match */
40+
}
41+
42+
/*
43+
@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line)
44+
e = Curl_hsts(h, p, subdomain);
45+
if(!e)
46+
result = hsts_create(h, p, subdomain, expires);
47+
- else {
48+
+ else if(strcasecompare(p, e->host)){
49+
/* the same host name, use the largest expire time */
50+
if(expires > e->expires)
51+
e->expires = expires;
52+
diff --git a/tests/data/test1660 b/tests/data/test1660
53+
index f86126d..4b6f961 100644
54+
--- a/tests/data/test1660
55+
+++ b/tests/data/test1660
56+
@@ -52,7 +52,7 @@ this.example [this.example]: 1548400797
57+
Input 12: error 43
58+
Input 13: error 43
59+
Input 14: error 43
60+
-3.example.com [example.com]: 1569905261 includeSubDomains
61+
+3.example.com [3.example.com]: 1569905261 includeSubDomains
62+
3.example.com [example.com]: 1569905261 includeSubDomains
63+
foo.example.com [example.com]: 1569905261 includeSubDomains
64+
'foo.xample.com' is not HSTS

SPECS/curl/curl.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: An URL retrieval utility and library
22
Name: curl
33
Version: 8.8.0
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: curl
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -11,6 +11,7 @@ Source0: https://curl.haxx.se/download/%{name}-%{version}.tar.gz
1111
Patch0: CVE-2024-6197.patch
1212
Patch1: CVE-2024-8096.patch
1313
Patch2: CVE-2024-11053.patch
14+
Patch3: CVE-2024-9681.patch
1415
BuildRequires: krb5-devel
1516
BuildRequires: libssh2-devel
1617
BuildRequires: nghttp2-devel
@@ -88,6 +89,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
8889
%{_libdir}/libcurl.so.*
8990

9091
%changelog
92+
* Wed Feb 26 2025 Bhagyashri Pathak <bhapathak@microsoft.com> - 8.8.0-5
93+
- Patch CVE-2024-9681
94+
9195
* Wed Feb 12 2025 Mitch Zhu <mitchzhu@microsoft.com> - 8.8.0-4
9296
- Patch CVE-2024-11053
9397

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,9 @@ libssh2-1.9.0-4.cm2.aarch64.rpm
190190
libssh2-devel-1.9.0-4.cm2.aarch64.rpm
191191
krb5-1.19.4-3.cm2.aarch64.rpm
192192
nghttp2-1.57.0-2.cm2.aarch64.rpm
193-
curl-8.8.0-4.cm2.aarch64.rpm
194-
curl-devel-8.8.0-4.cm2.aarch64.rpm
195-
curl-libs-8.8.0-4.cm2.aarch64.rpm
193+
curl-8.8.0-5.cm2.aarch64.rpm
194+
curl-devel-8.8.0-5.cm2.aarch64.rpm
195+
curl-libs-8.8.0-5.cm2.aarch64.rpm
196196
createrepo_c-0.17.5-1.cm2.aarch64.rpm
197197
libxml2-2.10.4-6.cm2.aarch64.rpm
198198
libxml2-devel-2.10.4-6.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,9 @@ libssh2-1.9.0-4.cm2.x86_64.rpm
190190
libssh2-devel-1.9.0-4.cm2.x86_64.rpm
191191
krb5-1.19.4-3.cm2.x86_64.rpm
192192
nghttp2-1.57.0-2.cm2.x86_64.rpm
193-
curl-8.8.0-4.cm2.x86_64.rpm
194-
curl-devel-8.8.0-4.cm2.x86_64.rpm
195-
curl-libs-8.8.0-4.cm2.x86_64.rpm
193+
curl-8.8.0-5.cm2.x86_64.rpm
194+
curl-devel-8.8.0-5.cm2.x86_64.rpm
195+
curl-libs-8.8.0-5.cm2.x86_64.rpm
196196
createrepo_c-0.17.5-1.cm2.x86_64.rpm
197197
libxml2-2.10.4-6.cm2.x86_64.rpm
198198
libxml2-devel-2.10.4-6.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,10 @@ cracklib-lang-2.9.7-5.cm2.aarch64.rpm
4646
createrepo_c-0.17.5-1.cm2.aarch64.rpm
4747
createrepo_c-debuginfo-0.17.5-1.cm2.aarch64.rpm
4848
createrepo_c-devel-0.17.5-1.cm2.aarch64.rpm
49-
curl-8.8.0-4.cm2.aarch64.rpm
50-
curl-debuginfo-8.8.0-4.cm2.aarch64.rpm
51-
curl-devel-8.8.0-4.cm2.aarch64.rpm
52-
curl-libs-8.8.0-4.cm2.aarch64.rpm
49+
curl-8.8.0-5.cm2.aarch64.rpm
50+
curl-debuginfo-8.8.0-5.cm2.aarch64.rpm
51+
curl-devel-8.8.0-5.cm2.aarch64.rpm
52+
curl-libs-8.8.0-5.cm2.aarch64.rpm
5353
Cython-debuginfo-0.29.33-2.cm2.aarch64.rpm
5454
debugedit-5.0-2.cm2.aarch64.rpm
5555
debugedit-debuginfo-5.0-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
4949
createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
5050
cross-binutils-common-2.37-13.cm2.noarch.rpm
5151
cross-gcc-common-11.2.0-8.cm2.noarch.rpm
52-
curl-8.8.0-4.cm2.x86_64.rpm
53-
curl-debuginfo-8.8.0-4.cm2.x86_64.rpm
54-
curl-devel-8.8.0-4.cm2.x86_64.rpm
55-
curl-libs-8.8.0-4.cm2.x86_64.rpm
52+
curl-8.8.0-5.cm2.x86_64.rpm
53+
curl-debuginfo-8.8.0-5.cm2.x86_64.rpm
54+
curl-devel-8.8.0-5.cm2.x86_64.rpm
55+
curl-libs-8.8.0-5.cm2.x86_64.rpm
5656
Cython-debuginfo-0.29.33-2.cm2.x86_64.rpm
5757
debugedit-5.0-2.cm2.x86_64.rpm
5858
debugedit-debuginfo-5.0-2.cm2.x86_64.rpm

0 commit comments

Comments
 (0)