CVE-2020-8169 (https://curl.haxx.se/docs/CVE-2020-8169.html): libcurl can be tricked to prepend a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s). CVE-2020-8177 (https://curl.haxx.se/docs/CVE-2020-8177.html): curl can be tricked my a malicious server to overwrite a local file when using -J (--remote-header-name) and -i (--head) in the same command line. Both of these are fixed in cURL 7.71.0.
Maintainer, please bump.
Please let us know when ready to stable.
(In reply to Sam James (sec padawan) from comment #2) > Please let us know when ready to stable. It should be good to go. KEYWORDS="amd64 arm arm64 hppa ppc ppc64 sparc x86"
(In reply to Anthony Basile from comment #3) > (In reply to Sam James (sec padawan) from comment #2) > > Please let us know when ready to stable. > > It should be good to go. > > KEYWORDS="amd64 arm arm64 hppa ppc ppc64 sparc x86" Excellent, thank you!
amd64 stable
sparc stable
x86 stable
arm stable
ppc stable
ppc64 stable
hppa stable
arm64 stable ---- @maintainer, please cleanup. Also see dependent bug.
(In reply to Sam James (sec padawan) from comment #12) > @maintainer, please cleanup. Also see dependent bug. blocker
(In reply to Sam James (sec padawan) from comment #13) > (In reply to Sam James (sec padawan) from comment #12) > > @maintainer, please cleanup. Also see dependent bug. > > blocker Please read bug #730416 for more detail, but USE=quiche is stable masked on amd64. So its available for ~amd64 but not for amd64 which is where the bug occurs. It is a known issue and should not block stabilization. I'm moving the blocker to "See Also".
s390 stable. Maintainer(s), please cleanup. Security, please vote.
(In reply to Anthony Basile from comment #14) > (In reply to Sam James (sec padawan) from comment #13) > > (In reply to Sam James (sec padawan) from comment #12) > > > @maintainer, please cleanup. Also see dependent bug. > > > > blocker > > Please read bug #730416 for more detail, but USE=quiche is stable masked on > amd64. So its available for ~amd64 but not for amd64 which is where the bug > occurs. It is a known issue and should not block stabilization. I'm moving > the blocker to "See Also". (Thank you) GLSA vote: yes
This issue was resolved and addressed in GLSA 202007-16 at https://security.gentoo.org/glsa/202007-16 by GLSA coordinator Sam James (sam_c).
(In reply to GLSAMaker/CVETool Bot from comment #17) > This issue was resolved and addressed in > GLSA 202007-16 at https://security.gentoo.org/glsa/202007-16 > by GLSA coordinator Sam James (sam_c). Reopening for cleanup.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f0cf742462897b3ddeb3705b7d606e0f98bf2c5e commit f0cf742462897b3ddeb3705b7d606e0f98bf2c5e Author: Sam James <sam@gentoo.org> AuthorDate: 2020-07-27 02:33:27 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2020-07-27 03:15:18 +0000 net-misc/curl: security cleanup Closes: https://bugs.gentoo.org/729374 Package-Manager: Portage-3.0.0, Repoman-2.3.23 Signed-off-by: Sam James <sam@gentoo.org> net-misc/curl/Manifest | 3 - net-misc/curl/curl-7.68.0.ebuild | 265 --------------------------- net-misc/curl/curl-7.69.1.ebuild | 265 --------------------------- net-misc/curl/curl-7.70.0-r1.ebuild | 267 ---------------------------- net-misc/curl/files/curl-fix-cpu-load.patch | 94 ---------- 5 files changed, 894 deletions(-)
