aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMaxin B. John <maxin.john@intel.com>2016-08-22 11:39:31 +0300
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-09-02 08:48:20 +0100
commitd1d6c93b491056b18b528216303047e353956e34 (patch)
tree6882c054cb400433eb9b787a1f04e3d81bdd6848
parenta27b907dd3ad20fc60b7732c19012793aaaba2df (diff)
downloadopenembedded-core-contrib-d1d6c93b491056b18b528216303047e353956e34.tar.gz
curl: security fix for CVE-2016-5419
Affected versions: libcurl 7.1 to and including 7.50.0 Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-support/curl/curl/CVE-2016-5419.patch76
-rw-r--r--meta/recipes-support/curl/curl_7.44.0.bb1
2 files changed, 77 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2016-5419.patch b/meta/recipes-support/curl/curl/CVE-2016-5419.patch
new file mode 100644
index 0000000000..2bea362c87
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2016-5419.patch
@@ -0,0 +1,76 @@
+From 247d890da88f9ee817079e246c59f3d7d12fde5f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 1 Jul 2016 13:32:31 +0200
+Subject: [PATCH] TLS: switch off SSL session id when client cert is used
+
+
+Bug: https://curl.haxx.se/docs/adv_20160803A.html
+Reported-by: Bru Rom
+Contributions-by: Eric Rescorla and Ray Satiro
+
+Upstream-Status: Backport
+https://curl.haxx.se/CVE-2016-5419.patch
+
+CVE: CVE-2016-5419
+Signed-off-by: Maxin B. John <maxin.john@intel.com>
+---
+ lib/url.c | 1 +
+ lib/urldata.h | 1 +
+ lib/vtls/vtls.c | 10 ++++++++++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/lib/url.c b/lib/url.c
+index 258a286..e547e5c 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -6123,6 +6123,7 @@ static CURLcode create_conn(struct Curl_easy *data,
+ data->set.ssl.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
+ data->set.ssl.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
+ data->set.ssl.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
++ data->set.ssl.clientcert = data->set.str[STRING_CERT];
+ #ifdef USE_TLS_SRP
+ data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
+ data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 611c5a7..3cf7ed9 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -351,6 +351,7 @@ struct ssl_config_data {
+ char *CAfile; /* certificate to verify peer against */
+ const char *CRLfile; /* CRL to check certificate revocation */
+ const char *issuercert;/* optional issuer certificate filename */
++ char *clientcert;
+ char *random_file; /* path to file containing "random" data */
+ char *egdsocket; /* path to file containing the EGD daemon socket */
+ char *cipher_list; /* list of ciphers to use */
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index d3e41cd..33e209d 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -156,6 +156,15 @@ Curl_clone_ssl_config(struct ssl_config_data *source,
+ else
+ dest->random_file = NULL;
+
++ if(source->clientcert) {
++ dest->clientcert = strdup(source->clientcert);
++ if(!dest->clientcert)
++ return FALSE;
++ dest->sessionid = FALSE;
++ }
++ else
++ dest->clientcert = NULL;
++
+ return TRUE;
+ }
+
+@@ -166,6 +175,7 @@ void Curl_free_ssl_config(struct ssl_config_data* sslc)
+ Curl_safefree(sslc->cipher_list);
+ Curl_safefree(sslc->egdsocket);
+ Curl_safefree(sslc->random_file);
++ Curl_safefree(sslc->clientcert);
+ }
+
+
+--
+2.4.0
+
diff --git a/meta/recipes-support/curl/curl_7.44.0.bb b/meta/recipes-support/curl/curl_7.44.0.bb
index 419ed8365e..dcd63aa938 100644
--- a/meta/recipes-support/curl/curl_7.44.0.bb
+++ b/meta/recipes-support/curl/curl_7.44.0.bb
@@ -13,6 +13,7 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
# from mucking around with debug options
#
SRC_URI += " file://configure_ac.patch \
+ file://CVE-2016-5419.patch \
file://CVE-2016-0754.patch \
file://CVE-2016-0755.patch"