From 1add6f34e69e5000202f781a424084c72e43f041 Mon Sep 17 00:00:00 2001 From: anolis-bot Date: Thu, 17 Nov 2022 14:30:32 +0800 Subject: [PATCH 1/2] update to curl-7.61.1-25.el8 Signed-off-by: anolis-bot --- 0042-curl-7.61.1-ssh-known-hosts.patch | 43 ++++++++++++++++++++++++ curl.spec | 46 ++++++++++---------------- dist | 2 +- 3 files changed, 61 insertions(+), 30 deletions(-) create mode 100644 0042-curl-7.61.1-ssh-known-hosts.patch diff --git a/0042-curl-7.61.1-ssh-known-hosts.patch b/0042-curl-7.61.1-ssh-known-hosts.patch new file mode 100644 index 0000000..02ad592 --- /dev/null +++ b/0042-curl-7.61.1-ssh-known-hosts.patch @@ -0,0 +1,43 @@ +From 9ea407a0476d22cde575826c18b5aa56b57ac9b4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Felix=20H=C3=A4dicke?= +Date: Wed, 23 Jan 2019 23:10:39 +0100 +Subject: [PATCH] setopt: enable CURLOPT_SSH_KNOWNHOSTS and + CURLOPT_SSH_KEYFUNCTION for libssh + +CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION are supported for +libssh as well. So accepting these options only when compiling with +libssh2 is wrong here. + +Fixes #3493 +Closes #3494 + +Upstream-commit: 3cbf731d9ec7146f9f1a6ac0fbd9af7fe358f5bb +Signed-off-by: Kamil Dudka +--- + lib/setopt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/setopt.c b/lib/setopt.c +index b07ccfe..88a05ff 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -2208,7 +2208,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, + result = Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5], + va_arg(param, char *)); + break; +-#ifdef HAVE_LIBSSH2_KNOWNHOST_API ++ + case CURLOPT_SSH_KNOWNHOSTS: + /* + * Store the file name to read known hosts from. +@@ -2229,7 +2229,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, + */ + data->set.ssh_keyfunc_userp = va_arg(param, void *); + break; +-#endif /* HAVE_LIBSSH2_KNOWNHOST_API */ + #endif /* USE_LIBSSH2 */ + + case CURLOPT_HTTP_TRANSFER_DECODING: +-- +2.34.1 + diff --git a/curl.spec b/curl.spec index e4ae8fe..29634bd 100644 --- a/curl.spec +++ b/curl.spec @@ -1,8 +1,7 @@ -%define anolis_release .0.1 Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.61.1 -Release: 22%{anolis_release}%{?dist}.4 +Release: 25%{?dist} License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz @@ -119,6 +118,9 @@ Patch40: 0040-curl-7.61.1-CVE-2022-32208.patch # fix HTTP compression denial of service (CVE-2022-32206) Patch41: 0041-curl-7.61.1-CVE-2022-32206.patch +# setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703) +Patch42: 0042-curl-7.61.1-ssh-known-hosts.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -136,8 +138,6 @@ Patch105: 0105-curl-7.61.1-test-ports.patch Provides: curl-full = %{version}-%{release} Provides: webclient -Provides: /usr/bin/curl -Requires: glibc URL: https://curl.haxx.se/ BuildRequires: automake BuildRequires: brotli-devel @@ -277,14 +277,6 @@ comes with a limited set of features compared to the 'libcurl' package. On the other hand, the package is smaller and requires fewer run-time dependencies to be installed. -%package doc -Summary: Documents for %{name} -BuildArch: noarch -Requires: %{name} = %{version}-%{release} - -%description doc -Doc pages for %{name}. - %prep %setup -q @@ -343,6 +335,7 @@ sed -e 's|:8992/|:%{?__isa_bits}92/|g' -i tests/data/test97{3..6} %patch39 -p1 %patch40 -p1 %patch41 -p1 +%patch42 -p1 # make tests/*.py use Python 3 sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py @@ -471,15 +464,22 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %ldconfig_scriptlets -n libcurl-minimal %files +%doc CHANGES README* +%doc docs/BUGS docs/FAQ docs/FEATURES +%doc docs/MANUAL docs/RESOURCES +%doc docs/TheArtOfHttpScripting docs/TODO %{_bindir}/curl %{_mandir}/man1/curl.1* %{_datadir}/zsh/site-functions %files -n libcurl +%license COPYING %{_libdir}/libcurl.so.4 %{_libdir}/libcurl.so.4.[0-9].[0-9] %files -n libcurl-devel +%doc docs/examples/*.c docs/examples/Makefile.example docs/INTERNALS.md +%doc docs/CONTRIBUTE.md docs/libcurl/ABI %{_bindir}/curl-config* %{_includedir}/curl %{_libdir}/*.so @@ -493,33 +493,21 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_mandir}/man1/curl.1* %files -n libcurl-minimal +%license COPYING %{_libdir}/libcurl.so.4.minimal %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal -%files doc -%license COPYING -%doc docs/examples/*.c docs/examples/Makefile.example docs/INTERNALS.md -%doc docs/CONTRIBUTE.md docs/libcurl/ABI -%doc CHANGES README* -%doc docs/BUGS docs/FAQ docs/FEATURES -%doc docs/MANUAL docs/RESOURCES -%doc docs/TheArtOfHttpScripting docs/TODO - %changelog -* Thu Sep 22 2022 Weisson - 7.61.1-22.0.1.el8_6.4 -- Add doc sub package - -* Wed Jun 29 2022 Kamil Dudka - 7.61.1-22.el8_6.4 +* Wed Jun 29 2022 Kamil Dudka - 7.61.1-25 +- setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703) - fix HTTP compression denial of service (CVE-2022-32206) - fix FTP-KRB bad message verification (CVE-2022-32208) -* Wed May 11 2022 Kamil Dudka - 7.61.1-22.el8_6.3 +* Wed May 11 2022 Kamil Dudka - 7.61.1-24 - fix too eager reuse of TLS and SSH connections (CVE-2022-27782) - -* Tue May 04 2022 Kamil Dudka - 7.61.1-22.el8_6.2 - fix invalid type in printf() argument detected by Coverity -* Thu Apr 28 2022 Kamil Dudka - 7.61.1-22.el8_6.1 +* Thu Apr 28 2022 Kamil Dudka - 7.61.1-23 - fix credential leak on redirect (CVE-2022-27774) - fix auth/cookie leak on redirect (CVE-2022-27776) - fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576) diff --git a/dist b/dist index 0ee7539..9c0e36e 100644 --- a/dist +++ b/dist @@ -1 +1 @@ -an8_6 +an8 -- Gitee From d2396ea2952f470be3fe81840c3abc18efb9d0da Mon Sep 17 00:00:00 2001 From: Weisson Date: Sat, 16 Jul 2022 18:56:59 +0800 Subject: [PATCH 2/2] spec: add doc sub package Signed-off-by: Weisson --- curl.spec | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/curl.spec b/curl.spec index 29634bd..64d504a 100644 --- a/curl.spec +++ b/curl.spec @@ -1,7 +1,8 @@ +%define anolis_release .0.1 Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.61.1 -Release: 25%{?dist} +Release: 25%{anolis_release}%{?dist} License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz @@ -138,6 +139,8 @@ Patch105: 0105-curl-7.61.1-test-ports.patch Provides: curl-full = %{version}-%{release} Provides: webclient +Provides: /usr/bin/curl +Requires: glibc URL: https://curl.haxx.se/ BuildRequires: automake BuildRequires: brotli-devel @@ -277,6 +280,14 @@ comes with a limited set of features compared to the 'libcurl' package. On the other hand, the package is smaller and requires fewer run-time dependencies to be installed. +%package doc +Summary: Documents for %{name} +BuildArch: noarch +Requires: %{name} = %{version}-%{release} + +%description doc +Doc pages for %{name}. + %prep %setup -q @@ -464,22 +475,15 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %ldconfig_scriptlets -n libcurl-minimal %files -%doc CHANGES README* -%doc docs/BUGS docs/FAQ docs/FEATURES -%doc docs/MANUAL docs/RESOURCES -%doc docs/TheArtOfHttpScripting docs/TODO %{_bindir}/curl %{_mandir}/man1/curl.1* %{_datadir}/zsh/site-functions %files -n libcurl -%license COPYING %{_libdir}/libcurl.so.4 %{_libdir}/libcurl.so.4.[0-9].[0-9] %files -n libcurl-devel -%doc docs/examples/*.c docs/examples/Makefile.example docs/INTERNALS.md -%doc docs/CONTRIBUTE.md docs/libcurl/ABI %{_bindir}/curl-config* %{_includedir}/curl %{_libdir}/*.so @@ -493,11 +497,22 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_mandir}/man1/curl.1* %files -n libcurl-minimal -%license COPYING %{_libdir}/libcurl.so.4.minimal %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal +%files doc +%license COPYING +%doc docs/examples/*.c docs/examples/Makefile.example docs/INTERNALS.md +%doc docs/CONTRIBUTE.md docs/libcurl/ABI +%doc CHANGES README* +%doc docs/BUGS docs/FAQ docs/FEATURES +%doc docs/MANUAL docs/RESOURCES +%doc docs/TheArtOfHttpScripting docs/TODO + %changelog +* Tue Jan 03 2023 Weisson - 7.61.1-25.0.1 +- Add doc sub package + * Wed Jun 29 2022 Kamil Dudka - 7.61.1-25 - setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703) - fix HTTP compression denial of service (CVE-2022-32206) -- Gitee