Skip to content

Commit b958bee

Browse files
mfrwmfrw
authored
curl: address CVE-2024-8096 (#10731)
Signed-off-by: Muhammad Falak R Wani <[email protected]>
1 parent 60d78f8 commit b958bee

File tree

6 files changed

+219
-15
lines changed

6 files changed

+219
-15
lines changed

‎SPECS/curl/CVE-2024-8096.patch‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
From aeb1a281cab13c7ba791cb104e556b20e713941f Mon Sep 17 00:00:00 2001
2+
From: Daniel Stenberg <[email protected]>
3+
Date: Tue, 20 Aug 2024 16:14:39 +0200
4+
Subject: [PATCH] gtls: fix OCSP stapling management
5+
6+
Reported-by: Hiroki Kurosawa
7+
Closes #14642
8+
---
9+
lib/vtls/gtls.c | 146 ++++++++++++++++++++++++------------------------
10+
1 file changed, 73 insertions(+), 73 deletions(-)
11+
12+
diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
13+
index 03d6fcc038aac3..c7589d9d39bc81 100644
14+
--- a/lib/vtls/gtls.c
15+
+++ b/lib/vtls/gtls.c
16+
@@ -850,6 +850,13 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
17+
init_flags |= GNUTLS_NO_TICKETS;
18+
#endif
19+
20+
+#if defined(GNUTLS_NO_STATUS_REQUEST)
21+
+ if(!config->verifystatus)
22+
+ /* Disable the "status_request" TLS extension, enabled by default since
23+
+ GnuTLS 3.8.0. */
24+
+ init_flags |= GNUTLS_NO_STATUS_REQUEST;
25+
+#endif
26+
+
27+
rc = gnutls_init(&gtls->session, init_flags);
28+
if(rc != GNUTLS_E_SUCCESS) {
29+
failf(data, "gnutls_init() failed: %d", rc);
30+
@@ -1321,104 +1328,97 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
31+
infof(data, " server certificate verification SKIPPED");
32+
33+
if(config->verifystatus) {
34+
- if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
35+
- gnutls_datum_t status_request;
36+
- gnutls_ocsp_resp_t ocsp_resp;
37+
+ gnutls_datum_t status_request;
38+
+ gnutls_ocsp_resp_t ocsp_resp;
39+
+ gnutls_ocsp_cert_status_t status;
40+
+ gnutls_x509_crl_reason_t reason;
41+
42+
- gnutls_ocsp_cert_status_t status;
43+
- gnutls_x509_crl_reason_t reason;
44+
+ rc = gnutls_ocsp_status_request_get(session, &status_request);
45+
46+
- rc = gnutls_ocsp_status_request_get(session, &status_request);
47+
+ if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
48+
+ failf(data, "No OCSP response received");
49+
+ return CURLE_SSL_INVALIDCERTSTATUS;
50+
+ }
51+
52+
- infof(data, " server certificate status verification FAILED");
53+
+ if(rc < 0) {
54+
+ failf(data, "Invalid OCSP response received");
55+
+ return CURLE_SSL_INVALIDCERTSTATUS;
56+
+ }
57+
58+
- if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
59+
- failf(data, "No OCSP response received");
60+
- return CURLE_SSL_INVALIDCERTSTATUS;
61+
- }
62+
+ gnutls_ocsp_resp_init(&ocsp_resp);
63+
64+
- if(rc < 0) {
65+
- failf(data, "Invalid OCSP response received");
66+
- return CURLE_SSL_INVALIDCERTSTATUS;
67+
- }
68+
+ rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
69+
+ if(rc < 0) {
70+
+ failf(data, "Invalid OCSP response received");
71+
+ return CURLE_SSL_INVALIDCERTSTATUS;
72+
+ }
73+
74+
- gnutls_ocsp_resp_init(&ocsp_resp);
75+
+ (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
76+
+ &status, NULL, NULL, NULL, &reason);
77+
78+
- rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
79+
- if(rc < 0) {
80+
- failf(data, "Invalid OCSP response received");
81+
- return CURLE_SSL_INVALIDCERTSTATUS;
82+
- }
83+
+ switch(status) {
84+
+ case GNUTLS_OCSP_CERT_GOOD:
85+
+ break;
86+
87+
- (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
88+
- &status, NULL, NULL, NULL, &reason);
89+
+ case GNUTLS_OCSP_CERT_REVOKED: {
90+
+ const char *crl_reason;
91+
92+
- switch(status) {
93+
- case GNUTLS_OCSP_CERT_GOOD:
94+
+ switch(reason) {
95+
+ default:
96+
+ case GNUTLS_X509_CRLREASON_UNSPECIFIED:
97+
+ crl_reason = "unspecified reason";
98+
break;
99+
100+
- case GNUTLS_OCSP_CERT_REVOKED: {
101+
- const char *crl_reason;
102+
-
103+
- switch(reason) {
104+
- default:
105+
- case GNUTLS_X509_CRLREASON_UNSPECIFIED:
106+
- crl_reason = "unspecified reason";
107+
- break;
108+
-
109+
- case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
110+
- crl_reason = "private key compromised";
111+
- break;
112+
-
113+
- case GNUTLS_X509_CRLREASON_CACOMPROMISE:
114+
- crl_reason = "CA compromised";
115+
- break;
116+
-
117+
- case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
118+
- crl_reason = "affiliation has changed";
119+
- break;
120+
+ case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
121+
+ crl_reason = "private key compromised";
122+
+ break;
123+
124+
- case GNUTLS_X509_CRLREASON_SUPERSEDED:
125+
- crl_reason = "certificate superseded";
126+
- break;
127+
+ case GNUTLS_X509_CRLREASON_CACOMPROMISE:
128+
+ crl_reason = "CA compromised";
129+
+ break;
130+
131+
- case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
132+
- crl_reason = "operation has ceased";
133+
- break;
134+
+ case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
135+
+ crl_reason = "affiliation has changed";
136+
+ break;
137+
138+
- case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
139+
- crl_reason = "certificate is on hold";
140+
- break;
141+
+ case GNUTLS_X509_CRLREASON_SUPERSEDED:
142+
+ crl_reason = "certificate superseded";
143+
+ break;
144+
145+
- case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
146+
- crl_reason = "will be removed from delta CRL";
147+
- break;
148+
+ case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
149+
+ crl_reason = "operation has ceased";
150+
+ break;
151+
152+
- case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
153+
- crl_reason = "privilege withdrawn";
154+
- break;
155+
+ case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
156+
+ crl_reason = "certificate is on hold";
157+
+ break;
158+
159+
- case GNUTLS_X509_CRLREASON_AACOMPROMISE:
160+
- crl_reason = "AA compromised";
161+
- break;
162+
- }
163+
+ case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
164+
+ crl_reason = "will be removed from delta CRL";
165+
+ break;
166+
167+
- failf(data, "Server certificate was revoked: %s", crl_reason);
168+
+ case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
169+
+ crl_reason = "privilege withdrawn";
170+
break;
171+
- }
172+
173+
- default:
174+
- case GNUTLS_OCSP_CERT_UNKNOWN:
175+
- failf(data, "Server certificate status is unknown");
176+
+ case GNUTLS_X509_CRLREASON_AACOMPROMISE:
177+
+ crl_reason = "AA compromised";
178+
break;
179+
}
180+
181+
- gnutls_ocsp_resp_deinit(ocsp_resp);
182+
+ failf(data, "Server certificate was revoked: %s", crl_reason);
183+
+ break;
184+
+ }
185+
186+
- return CURLE_SSL_INVALIDCERTSTATUS;
187+
+ default:
188+
+ case GNUTLS_OCSP_CERT_UNKNOWN:
189+
+ failf(data, "Server certificate status is unknown");
190+
+ break;
191+
}
192+
- else
193+
- infof(data, " server certificate status verification OK");
194+
+
195+
+ gnutls_ocsp_resp_deinit(ocsp_resp);
196+
+ if(status != GNUTLS_OCSP_CERT_GOOD)
197+
+ return CURLE_SSL_INVALIDCERTSTATUS;
198+
}
199+
else
200+
infof(data, " server certificate status verification SKIPPED");

‎SPECS/curl/curl.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: An URL retrieval utility and library
22
Name: curl
33
Version: 8.8.0
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: curl
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: System Environment/NetworkingLibraries
99
URL: https://curl.haxx.se
1010
Source0: https://curl.haxx.se/download/%{name}-%{version}.tar.gz
1111
Patch0: CVE-2024-6197.patch
12+
Patch1: CVE-2024-8096.patch
1213
BuildRequires: krb5-devel
1314
BuildRequires: libssh2-devel
1415
BuildRequires: nghttp2-devel
@@ -86,6 +87,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
8687
%{_libdir}/libcurl.so.*
8788

8889
%changelog
90+
* Tue Oct 15 2024 Muhammad Falak <[email protected]> - 8.8.0-3
91+
- Address CVE-2024-8096
92+
8993
* Wed Sep 4 2024 Aadhar Agarwal <[email protected]> - 8.8.0-2
9094
- Patch CVE-2024-6197
9195

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,9 @@ libssh2-1.9.0-4.cm2.aarch64.rpm
190190
libssh2-devel-1.9.0-4.cm2.aarch64.rpm
191191
krb5-1.19.4-3.cm2.aarch64.rpm
192192
nghttp2-1.57.0-2.cm2.aarch64.rpm
193-
curl-8.8.0-2.cm2.aarch64.rpm
194-
curl-devel-8.8.0-2.cm2.aarch64.rpm
195-
curl-libs-8.8.0-2.cm2.aarch64.rpm
193+
curl-8.8.0-3.cm2.aarch64.rpm
194+
curl-devel-8.8.0-3.cm2.aarch64.rpm
195+
curl-libs-8.8.0-3.cm2.aarch64.rpm
196196
createrepo_c-0.17.5-1.cm2.aarch64.rpm
197197
libxml2-2.10.4-4.cm2.aarch64.rpm
198198
libxml2-devel-2.10.4-4.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,9 @@ libssh2-1.9.0-4.cm2.x86_64.rpm
190190
libssh2-devel-1.9.0-4.cm2.x86_64.rpm
191191
krb5-1.19.4-3.cm2.x86_64.rpm
192192
nghttp2-1.57.0-2.cm2.x86_64.rpm
193-
curl-8.8.0-2.cm2.x86_64.rpm
194-
curl-devel-8.8.0-2.cm2.x86_64.rpm
195-
curl-libs-8.8.0-2.cm2.x86_64.rpm
193+
curl-8.8.0-3.cm2.x86_64.rpm
194+
curl-devel-8.8.0-3.cm2.x86_64.rpm
195+
curl-libs-8.8.0-3.cm2.x86_64.rpm
196196
createrepo_c-0.17.5-1.cm2.x86_64.rpm
197197
libxml2-2.10.4-4.cm2.x86_64.rpm
198198
libxml2-devel-2.10.4-4.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,10 @@ cracklib-lang-2.9.7-5.cm2.aarch64.rpm
4646
createrepo_c-0.17.5-1.cm2.aarch64.rpm
4747
createrepo_c-debuginfo-0.17.5-1.cm2.aarch64.rpm
4848
createrepo_c-devel-0.17.5-1.cm2.aarch64.rpm
49-
curl-8.8.0-2.cm2.aarch64.rpm
50-
curl-debuginfo-8.8.0-2.cm2.aarch64.rpm
51-
curl-devel-8.8.0-2.cm2.aarch64.rpm
52-
curl-libs-8.8.0-2.cm2.aarch64.rpm
49+
curl-8.8.0-3.cm2.aarch64.rpm
50+
curl-debuginfo-8.8.0-3.cm2.aarch64.rpm
51+
curl-devel-8.8.0-3.cm2.aarch64.rpm
52+
curl-libs-8.8.0-3.cm2.aarch64.rpm
5353
Cython-debuginfo-0.29.33-2.cm2.aarch64.rpm
5454
debugedit-5.0-2.cm2.aarch64.rpm
5555
debugedit-debuginfo-5.0-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
4949
createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
5050
cross-binutils-common-2.37-8.cm2.noarch.rpm
5151
cross-gcc-common-11.2.0-8.cm2.noarch.rpm
52-
curl-8.8.0-2.cm2.x86_64.rpm
53-
curl-debuginfo-8.8.0-2.cm2.x86_64.rpm
54-
curl-devel-8.8.0-2.cm2.x86_64.rpm
55-
curl-libs-8.8.0-2.cm2.x86_64.rpm
52+
curl-8.8.0-3.cm2.x86_64.rpm
53+
curl-debuginfo-8.8.0-3.cm2.x86_64.rpm
54+
curl-devel-8.8.0-3.cm2.x86_64.rpm
55+
curl-libs-8.8.0-3.cm2.x86_64.rpm
5656
Cython-debuginfo-0.29.33-2.cm2.x86_64.rpm
5757
debugedit-5.0-2.cm2.x86_64.rpm
5858
debugedit-debuginfo-5.0-2.cm2.x86_64.rpm

0 commit comments

Comments
 (0)