mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-30 21:32:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

curl: patch CVE-2025-14524

Browse Source 
(From OE-Core rev: 951113a6e8185969444b5e28292f23434dba1f6c)

Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Amaury Couderc
2026-01-30 14:08:54 +01:00
committed by Richard Purdie
parent 68f03e2a9f
commit cc5e0688c0
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
meta/recipes-support/curl/curl/CVE-2025-14524.patch Normal file
View File

@@ -0,0 +1,44 @@
From 0bccd8d29c89d70120444088d3893af59f3772bf Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 10 Dec 2025 11:40:47 +0100
Subject: [PATCH] curl_sasl: if redirected, require permission to use bearer
Closes #19933
CVE: CVE-2025-14524
Upstream-Status: Backport [https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640]
Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
---
lib/curl_sasl.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
index 66639cbacc..fe646548a8 100644
--- a/lib/curl_sasl.c
+++ b/lib/curl_sasl.c
@@ -357,7 +357,9 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
data->set.str[STRING_SERVICE_NAME] :
sasl->params->service;
#endif
- const char *oauth_bearer = data->set.str[STRING_BEARER];
+ const char *oauth_bearer =
+ (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
+ data->set.str[STRING_BEARER] : NULL;
struct bufref nullmsg;
Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
@@ -544,7 +546,9 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
data->set.str[STRING_SERVICE_NAME] :
sasl->params->service;
#endif
- const char *oauth_bearer = data->set.str[STRING_BEARER];
+ const char *oauth_bearer =
+ (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
+ data->set.str[STRING_BEARER] : NULL;
struct bufref serverdata;
Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
--
2.43.0

1
meta/recipes-support/curl/curl_8.7.1.bb
View File

@@ -27,6 +27,7 @@ SRC_URI = " \
file://CVE-2025-9086.patch \
file://CVE-2025-10148.patch \
file://CVE-2025-14017.patch \
file://CVE-2025-14524.patch \
file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
file://CVE-2025-14819.patch \
file://CVE-2025-15079.patch \