From 1a2ecf333de0c50ed447c1347552a8804558fd63 Mon Sep 17 00:00:00 2001 From: wangkaiqiang Date: Wed, 15 Jan 2025 19:59:05 +0800 Subject: [PATCH] to #13384 fix CVE-2024-9681 Project: TC2024080204 Signed-off-by: wangkaiqiang --- 0002-fix-cve-2024-9681.patch | 86 ++++++++++++++++++++++++++++++++++++ curl.spec | 7 ++- 2 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 0002-fix-cve-2024-9681.patch diff --git a/0002-fix-cve-2024-9681.patch b/0002-fix-cve-2024-9681.patch new file mode 100644 index 0000000..f084bf0 --- /dev/null +++ b/0002-fix-cve-2024-9681.patch @@ -0,0 +1,86 @@ +From f81f4dabed925fe1363a72af334544fba316181b Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 9 Oct 2024 10:04:35 +0200 +Subject: [PATCH] hsts: improve subdomain handling + +- on load, only replace existing HSTS entries if there is a full host + match + +- on matching, prefer a full host match and secondary the longest tail + subdomain match + +Closes #15210 + +Signed-off-by: wangkaiqiang +--- + lib/hsts.c | 14 ++++++++++---- + tests/data/test1660 | 2 +- + 2 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/lib/hsts.c b/lib/hsts.c +index 7ecf004..9afeebd 100644 +--- a/lib/hsts.c ++++ b/lib/hsts.c +@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname, + struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, + bool subdomain) + { ++ struct stsentry *bestsub = NULL; + if(h) { + char buffer[MAX_HSTS_HOSTLEN + 1]; + time_t now = time(NULL); + size_t hlen = strlen(hostname); + struct Curl_llist_element *e; + struct Curl_llist_element *n; ++ size_t blen = 0; + + if((hlen > MAX_HSTS_HOSTLEN) || !hlen) + return NULL; +@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, + if(ntail < hlen) { + size_t offs = hlen - ntail; + if((hostname[offs-1] == '.') && +- strncasecompare(&hostname[offs], sts->host, ntail)) +- return sts; ++ strncasecompare(&hostname[offs], sts->host, ntail) && ++ (ntail > blen)) { ++ /* save the tail match with the longest tail */ ++ bestsub = sts; ++ blen = ntail; ++ } + } + } + if(strcasecompare(hostname, sts->host)) + return sts; + } + } +- return NULL; /* no match */ ++ return bestsub; + } + + /* +@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line) + e = Curl_hsts(h, p, subdomain); + if(!e) + result = hsts_create(h, p, subdomain, expires); +- else { ++ else if(strcasecompare(p, e->host)) { + /* the same host name, use the largest expire time */ + if(expires > e->expires) + e->expires = expires; +diff --git a/tests/data/test1660 b/tests/data/test1660 +index f86126d..4b6f961 100644 +--- a/tests/data/test1660 ++++ b/tests/data/test1660 +@@ -52,7 +52,7 @@ this.example [this.example]: 1548400797 + Input 12: error 43 + Input 13: error 43 + Input 14: error 43 +-3.example.com [example.com]: 1569905261 includeSubDomains ++3.example.com [3.example.com]: 1569905261 includeSubDomains + 3.example.com [example.com]: 1569905261 includeSubDomains + foo.example.com [example.com]: 1569905261 includeSubDomains + 'foo.xample.com' is not HSTS +-- +2.39.3 + diff --git a/curl.spec b/curl.spec index 77fa6e4..25abac5 100644 --- a/curl.spec +++ b/curl.spec @@ -1,4 +1,4 @@ -%define anolis_release 4 +%define anolis_release 5 Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Epoch: 1 @@ -76,6 +76,8 @@ BuildRequires: perl(Time::HiRes) BuildRequires: perl(vars) Patch: 0001-fix-cve-2024-2398.patch +# https://github.com/curl/curl/commit/a94973805df96269bf +Patch: 0002-fix-cve-2024-9681.patch # The test-suite runs automatically through valgrind if valgrind is available # on the system. By not installing valgrind into mock's chroot, we disable @@ -367,6 +369,9 @@ rm -rf ${RPM_BUILD_ROOT}%{_datadir}/fish %doc docs/TheArtOfHttpScripting.md %changelog +* Wed Jan 15 2025 Kaiqiang Wang - 8.4.0-5 +- fix CVE-2024-9681 + * Mon Jun 24 2024 yanyihao - 8.4.0-4 - fix conflict when both install libcurl and libcurl-devel -- Gitee