aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorHauke Mehrtens <hauke@hauke-m.de>2017-03-13 22:51:20 +0100
committerHauke Mehrtens <hauke@hauke-m.de>2017-03-13 22:51:20 +0100
commit111cf1b9f37b902dbc4ac2934f38ee6418600f69 (patch)
treefa7a0cd98508324cd0a5e119d5330dccf8bfd019 /package
parentc4ed92ae7d9568b42490eeba540e68684c6ed981 (diff)
downloadupstream-111cf1b9f37b902dbc4ac2934f38ee6418600f69.tar.gz
upstream-111cf1b9f37b902dbc4ac2934f38ee6418600f69.tar.bz2
upstream-111cf1b9f37b902dbc4ac2934f38ee6418600f69.zip
curl: fix CVE-2017-2629 SSL_VERIFYSTATUS ignored
This fixes the following security problem: https://curl.haxx.se/docs/adv_20170222.html Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'package')
-rw-r--r--package/network/utils/curl/Makefile2
-rw-r--r--package/network/utils/curl/patches/001-curl-https-openssl-fix.patch6
-rw-r--r--package/network/utils/curl/patches/100-CVE-2017-2629.patch33
3 files changed, 36 insertions, 5 deletions
diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile
index 950044a226..68558a9eda 100644
--- a/package/network/utils/curl/Makefile
+++ b/package/network/utils/curl/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=curl
PKG_VERSION:=7.52.1
-PKG_RELEASE:=2
+PKG_RELEASE:=3
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=http://curl.haxx.se/download/ \
diff --git a/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch b/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch
index 259f618d46..9658ef554b 100644
--- a/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch
+++ b/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch
@@ -12,11 +12,9 @@ Bug: #1174
lib/vtls/vtls.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index b808e1c..707f24b 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
-@@ -484,7 +484,7 @@ void Curl_ssl_close_all(struct Curl_easy *data)
+@@ -484,7 +484,7 @@ void Curl_ssl_close_all(struct Curl_easy
curlssl_close_all(data);
}
@@ -25,7 +23,7 @@ index b808e1c..707f24b 100644
defined(USE_DARWINSSL) || defined(USE_NSS)
/* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */
int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
-@@ -518,7 +518,7 @@ int Curl_ssl_getsock(struct connectdata *conn,
+@@ -518,7 +518,7 @@ int Curl_ssl_getsock(struct connectdata
(void)numsocks;
return GETSOCK_BLANK;
}
diff --git a/package/network/utils/curl/patches/100-CVE-2017-2629.patch b/package/network/utils/curl/patches/100-CVE-2017-2629.patch
new file mode 100644
index 0000000000..f2cd869c5b
--- /dev/null
+++ b/package/network/utils/curl/patches/100-CVE-2017-2629.patch
@@ -0,0 +1,33 @@
+From a00a42b4abe8363a46071bb3b43b1b7138f5259b Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sun, 22 Jan 2017 18:11:55 +0100
+Subject: [PATCH] TLS: make SSL_VERIFYSTATUS work again
+
+The CURLOPT_SSL_VERIFYSTATUS option was not properly handled by libcurl
+and thus even if the status couldn't be verified, the connection would
+be allowed and the user would not be told about the failed verification.
+
+Regression since cb4e2be7c6d42ca
+
+CVE-2017-2629
+Bug: https://curl.haxx.se/docs/adv_20170222.html
+
+Reported-by: Marcus Hoffmann
+---
+ lib/url.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -4141,8 +4141,11 @@ static struct connectdata *allocate_conn
+ conn->bits.ftp_use_epsv = data->set.ftp_use_epsv;
+ conn->bits.ftp_use_eprt = data->set.ftp_use_eprt;
+
++ conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus;
+ conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer;
+ conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost;
++ conn->proxy_ssl_config.verifystatus =
++ data->set.proxy_ssl.primary.verifystatus;
+ conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer;
+ conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost;
+