Skip to content

Commit ecf1c5a

Browse files
shubhamshinde360shubhamshinde360
authored
Merge pull request #920 from shubhamshinde360/PA-6961
(PA-6961) Patch for CVE-2024-8096 (Curl)
2 parents 0feece8 + 831affc commit ecf1c5a

File tree

2 files changed

+190
-0
lines changed

2 files changed

+190
-0
lines changed

‎configs/components/curl.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
pkg.apply_patch 'resources/patches/curl/CVE-2024-2004.patch'
5050
pkg.apply_patch 'resources/patches/curl/CVE-2024-2398.patch'
5151
pkg.apply_patch 'resources/patches/curl/CVE-2024-7264.patch'
52+
pkg.apply_patch 'resources/patches/curl/CVE-2024-8096.patch'
5253
end
5354

5455
configure_options = []

‎resources/patches/curl/CVE-2024-8096.patch‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
2+
index 07dfaa437..db9221b96 100644
3+
--- a/lib/vtls/gtls.c
4+
+++ b/lib/vtls/gtls.c
5+
@@ -526,6 +526,13 @@ CURLcode gtls_client_init(struct Curl_easy *data,
6+
init_flags |= GNUTLS_NO_TICKETS;
7+
#endif
8+
9+
+#if defined(GNUTLS_NO_STATUS_REQUEST)
10+
+ if(!config->verifystatus)
11+
+ /* Disable the "status_request" TLS extension, enabled by default since
12+
+ GnuTLS 3.8.0. */
13+
+ init_flags |= GNUTLS_NO_STATUS_REQUEST;
14+
+#endif
15+
+
16+
rc = gnutls_init(&gtls->session, init_flags);
17+
if(rc != GNUTLS_E_SUCCESS) {
18+
failf(data, "gnutls_init() failed: %d", rc);
19+
@@ -919,104 +926,97 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
20+
infof(data, " server certificate verification SKIPPED");
21+
22+
if(config->verifystatus) {
23+
- if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
24+
- gnutls_datum_t status_request;
25+
- gnutls_ocsp_resp_t ocsp_resp;
26+
+ gnutls_datum_t status_request;
27+
+ gnutls_ocsp_resp_t ocsp_resp;
28+
+ gnutls_ocsp_cert_status_t status;
29+
+ gnutls_x509_crl_reason_t reason;
30+
31+
- gnutls_ocsp_cert_status_t status;
32+
- gnutls_x509_crl_reason_t reason;
33+
+ rc = gnutls_ocsp_status_request_get(session, &status_request);
34+
35+
- rc = gnutls_ocsp_status_request_get(session, &status_request);
36+
+ if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
37+
+ failf(data, "No OCSP response received");
38+
+ return CURLE_SSL_INVALIDCERTSTATUS;
39+
+ }
40+
41+
- infof(data, " server certificate status verification FAILED");
42+
+ if(rc < 0) {
43+
+ failf(data, "Invalid OCSP response received");
44+
+ return CURLE_SSL_INVALIDCERTSTATUS;
45+
+ }
46+
47+
- if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
48+
- failf(data, "No OCSP response received");
49+
- return CURLE_SSL_INVALIDCERTSTATUS;
50+
- }
51+
+ gnutls_ocsp_resp_init(&ocsp_resp);
52+
53+
- if(rc < 0) {
54+
- failf(data, "Invalid OCSP response received");
55+
- return CURLE_SSL_INVALIDCERTSTATUS;
56+
- }
57+
+ rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
58+
+ if(rc < 0) {
59+
+ failf(data, "Invalid OCSP response received");
60+
+ return CURLE_SSL_INVALIDCERTSTATUS;
61+
+ }
62+
63+
- gnutls_ocsp_resp_init(&ocsp_resp);
64+
+ (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
65+
+ &status, NULL, NULL, NULL, &reason);
66+
67+
- rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
68+
- if(rc < 0) {
69+
- failf(data, "Invalid OCSP response received");
70+
- return CURLE_SSL_INVALIDCERTSTATUS;
71+
- }
72+
+ switch(status) {
73+
+ case GNUTLS_OCSP_CERT_GOOD:
74+
+ break;
75+
76+
- (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
77+
- &status, NULL, NULL, NULL, &reason);
78+
+ case GNUTLS_OCSP_CERT_REVOKED: {
79+
+ const char *crl_reason;
80+
81+
- switch(status) {
82+
- case GNUTLS_OCSP_CERT_GOOD:
83+
+ switch(reason) {
84+
+ default:
85+
+ case GNUTLS_X509_CRLREASON_UNSPECIFIED:
86+
+ crl_reason = "unspecified reason";
87+
break;
88+
89+
- case GNUTLS_OCSP_CERT_REVOKED: {
90+
- const char *crl_reason;
91+
-
92+
- switch(reason) {
93+
- default:
94+
- case GNUTLS_X509_CRLREASON_UNSPECIFIED:
95+
- crl_reason = "unspecified reason";
96+
- break;
97+
-
98+
- case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
99+
- crl_reason = "private key compromised";
100+
- break;
101+
-
102+
- case GNUTLS_X509_CRLREASON_CACOMPROMISE:
103+
- crl_reason = "CA compromised";
104+
- break;
105+
-
106+
- case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
107+
- crl_reason = "affiliation has changed";
108+
- break;
109+
+ case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
110+
+ crl_reason = "private key compromised";
111+
+ break;
112+
113+
- case GNUTLS_X509_CRLREASON_SUPERSEDED:
114+
- crl_reason = "certificate superseded";
115+
- break;
116+
+ case GNUTLS_X509_CRLREASON_CACOMPROMISE:
117+
+ crl_reason = "CA compromised";
118+
+ break;
119+
120+
- case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
121+
- crl_reason = "operation has ceased";
122+
- break;
123+
+ case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
124+
+ crl_reason = "affiliation has changed";
125+
+ break;
126+
127+
- case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
128+
- crl_reason = "certificate is on hold";
129+
- break;
130+
+ case GNUTLS_X509_CRLREASON_SUPERSEDED:
131+
+ crl_reason = "certificate superseded";
132+
+ break;
133+
134+
- case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
135+
- crl_reason = "will be removed from delta CRL";
136+
- break;
137+
+ case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
138+
+ crl_reason = "operation has ceased";
139+
+ break;
140+
141+
- case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
142+
- crl_reason = "privilege withdrawn";
143+
- break;
144+
+ case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
145+
+ crl_reason = "certificate is on hold";
146+
+ break;
147+
148+
- case GNUTLS_X509_CRLREASON_AACOMPROMISE:
149+
- crl_reason = "AA compromised";
150+
- break;
151+
- }
152+
+ case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
153+
+ crl_reason = "will be removed from delta CRL";
154+
+ break;
155+
156+
- failf(data, "Server certificate was revoked: %s", crl_reason);
157+
+ case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
158+
+ crl_reason = "privilege withdrawn";
159+
break;
160+
- }
161+
162+
- default:
163+
- case GNUTLS_OCSP_CERT_UNKNOWN:
164+
- failf(data, "Server certificate status is unknown");
165+
+ case GNUTLS_X509_CRLREASON_AACOMPROMISE:
166+
+ crl_reason = "AA compromised";
167+
break;
168+
}
169+
170+
- gnutls_ocsp_resp_deinit(ocsp_resp);
171+
+ failf(data, "Server certificate was revoked: %s", crl_reason);
172+
+ break;
173+
+ }
174+
+
175+
+ default:
176+
+ case GNUTLS_OCSP_CERT_UNKNOWN:
177+
+ failf(data, "Server certificate status is unknown");
178+
+ break;
179+
+ }
180+
181+
+ gnutls_ocsp_resp_deinit(ocsp_resp);
182+
+ if(status != GNUTLS_OCSP_CERT_GOOD)
183+
return CURLE_SSL_INVALIDCERTSTATUS;
184+
- }
185+
- else
186+
- infof(data, " server certificate status verification OK");
187+
}
188+
else
189+
infof(data, " server certificate status verification SKIPPED");

0 commit comments

Comments
 (0)