mirror of
https://git.yoctoproject.org/poky
synced 2026-04-22 15:32:14 +02:00
curl: fix CVE-2025-0167
When asked to use a `.netrc` file for credentials *and* to
follow HTTP redirects, curl could leak the password used
for the first host to the followed-to host under certain
circumstances.
This flaw only manifests itself if the netrc file has a
`default` entry that omits both login and password. A
rare circumstance.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-0167
Upstream patch:
0e120c5b92
(From OE-Core rev: 7c5aee3066e4c8056d994cd50b26c18a16316c96)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Yogita Urade
committed by
Steve Sakoman
Steve Sakoman
parent
580a1571c4
commit
022d6ec767
175
meta/recipes-support/curl/curl/CVE-2025-0167.patch
Normal file
175
meta/recipes-support/curl/curl/CVE-2025-0167.patch
Normal file
@@ -0,0 +1,175 @@
|
||||
From 0e120c5b925e8ca75d5319e319e5ce4b8080d8eb Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Stenberg <daniel@haxx.se>
|
||||
Date: Fri, 3 Jan 2025 16:22:27 +0100
|
||||
Subject: [PATCH] netrc: 'default' with no credentials is not a match
|
||||
|
||||
Test 486 verifies.
|
||||
|
||||
Reported-by: Yihang Zhou
|
||||
|
||||
Closes #15908
|
||||
|
||||
Changes:
|
||||
- Test files are added in Makefile.inc.
|
||||
- Adjust `%LOGDIR/` to 'log/' due to its absence in code.
|
||||
|
||||
CVE: CVE-2025-0167
|
||||
Upstream-Status: Backport [https://github.com/curl/curl/commit/0e120c5b925e8ca75d5319e319e5ce4b8080d8eb]
|
||||
|
||||
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
|
||||
---
|
||||
lib/netrc.c | 7 ++-
|
||||
tests/data/Makefile.in | 2 +
|
||||
tests/data/test486 | 105 +++++++++++++++++++++++++++++++++++++++++
|
||||
3 files changed, 113 insertions(+), 1 deletion(-)
|
||||
create mode 100644 tests/data/test486
|
||||
|
||||
diff --git a/lib/netrc.c b/lib/netrc.c
|
||||
index 23080b3..6d87007 100644
|
||||
--- a/lib/netrc.c
|
||||
+++ b/lib/netrc.c
|
||||
@@ -205,12 +205,17 @@ static int parsenetrc(const char *host,
|
||||
} /* while fgets() */
|
||||
|
||||
out:
|
||||
- if(!retcode && !password && our_login) {
|
||||
+ if(!retcode) {
|
||||
+ if(!password && our_login) {
|
||||
/* success without a password, set a blank one */
|
||||
password = strdup("");
|
||||
if(!password)
|
||||
retcode = 1; /* out of memory */
|
||||
}
|
||||
+ else if(!login && !password)
|
||||
+ /* a default with no credentials */
|
||||
+ retcode = NETRC_FILE_MISSING;
|
||||
+ }
|
||||
if(!retcode) {
|
||||
/* success */
|
||||
*login_changed = FALSE;
|
||||
diff --git a/tests/data/Makefile.in b/tests/data/Makefile.in
|
||||
index 3da7d31..5a3ec48 100644
|
||||
--- a/tests/data/Makefile.in
|
||||
+++ b/tests/data/Makefile.in
|
||||
@@ -431,6 +431,8 @@ test409 test410 \
|
||||
\
|
||||
test430 test431 test432 test433 test434 test435 test436 \
|
||||
\
|
||||
+test486 \
|
||||
+\
|
||||
test490 test491 test492 test493 test494 \
|
||||
\
|
||||
test500 test501 test502 test503 test504 test505 test506 test507 test508 \
|
||||
diff --git a/tests/data/test486 b/tests/data/test486
|
||||
new file mode 100644
|
||||
index 0000000..6926092
|
||||
--- /dev/null
|
||||
+++ b/tests/data/test486
|
||||
@@ -0,0 +1,105 @@
|
||||
+<testcase>
|
||||
+<info>
|
||||
+<keywords>
|
||||
+netrc
|
||||
+HTTP
|
||||
+</keywords>
|
||||
+</info>
|
||||
+#
|
||||
+# Server-side
|
||||
+<reply>
|
||||
+<data crlf="yes">
|
||||
+HTTP/1.1 301 Follow this you fool
|
||||
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
+Server: test-server/fake
|
||||
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||
+ETag: "21025-dc7-39462498"
|
||||
+Accept-Ranges: bytes
|
||||
+Content-Length: 6
|
||||
+Connection: close
|
||||
+Location: http://b.com/%TESTNUMBER0002
|
||||
+
|
||||
+-foo-
|
||||
+</data>
|
||||
+
|
||||
+<data2 crlf="yes">
|
||||
+HTTP/1.1 200 OK
|
||||
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
+Server: test-server/fake
|
||||
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||
+ETag: "21025-dc7-39462498"
|
||||
+Accept-Ranges: bytes
|
||||
+Content-Length: 7
|
||||
+Connection: close
|
||||
+
|
||||
+target
|
||||
+</data2>
|
||||
+
|
||||
+<datacheck crlf="yes">
|
||||
+HTTP/1.1 301 Follow this you fool
|
||||
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
+Server: test-server/fake
|
||||
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||
+ETag: "21025-dc7-39462498"
|
||||
+Accept-Ranges: bytes
|
||||
+Content-Length: 6
|
||||
+Connection: close
|
||||
+Location: http://b.com/%TESTNUMBER0002
|
||||
+
|
||||
+HTTP/1.1 200 OK
|
||||
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
+Server: test-server/fake
|
||||
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||
+ETag: "21025-dc7-39462498"
|
||||
+Accept-Ranges: bytes
|
||||
+Content-Length: 7
|
||||
+Connection: close
|
||||
+
|
||||
+target
|
||||
+</datacheck>
|
||||
+</reply>
|
||||
+
|
||||
+#
|
||||
+# Client-side
|
||||
+<client>
|
||||
+<server>
|
||||
+http
|
||||
+</server>
|
||||
+<features>
|
||||
+proxy
|
||||
+</features>
|
||||
+<name>
|
||||
+.netrc with redirect and "default" with no password or login
|
||||
+</name>
|
||||
+<command>
|
||||
+--netrc --netrc-file log/netrc%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
|
||||
+</command>
|
||||
+<file name="log/netrc%TESTNUMBER" >
|
||||
+
|
||||
+machine a.com
|
||||
+ login alice
|
||||
+ password alicespassword
|
||||
+
|
||||
+default
|
||||
+
|
||||
+</file>
|
||||
+</client>
|
||||
+
|
||||
+<verify>
|
||||
+<protocol>
|
||||
+GET http://a.com/ HTTP/1.1
|
||||
+Host: a.com
|
||||
+Authorization: Basic %b64[alice:alicespassword]b64%
|
||||
+User-Agent: curl/%VERSION
|
||||
+Accept: */*
|
||||
+Proxy-Connection: Keep-Alive
|
||||
+
|
||||
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
|
||||
+Host: b.com
|
||||
+User-Agent: curl/%VERSION
|
||||
+Accept: */*
|
||||
+Proxy-Connection: Keep-Alive
|
||||
+
|
||||
+</protocol>
|
||||
+</verify>
|
||||
+</testcase>
|
||||
--
|
||||
2.40.0
|
||||
@@ -65,6 +65,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
|
||||
file://CVE-2024-9681.patch \
|
||||
file://CVE-2024-11053-0001.patch \
|
||||
file://CVE-2024-11053-0002.patch \
|
||||
file://CVE-2025-0167.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user