Bug 906590 (CVE-2023-28319, CVE-2023-28320, CVE-2023-28321, CVE-2023-28322)

Summary:	<net-misc/curl-8.1.0: Multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	base-system, Matt.Jolly
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=699632
Whiteboard:	B3 [glsa+ cleanup]
Package list:		Runtime testing required:	---
Bug Depends on:	910089
Bug Blocks:

Description Sam James archtester

2023-05-17 06:26:34 UTC

- CVE-2023-28322: more POST-after-PUT confusion (https://curl.se/docs/CVE-2023-28322.html)
- CVE-2023-28321: IDN wildcard match (https://curl.se/docs/CVE-2023-28321.html)
- CVE-2023-28320: siglongjmp race condition (https://curl.se/docs/CVE-2023-28320.html)
- CVE-2023-28319: UAF in SSH sha256 fingerprint check (https://curl.se/docs/CVE-2023-28319.html)

All fixed in just-released 8.1.0.

Comment 1 Sam James archtester

2023-05-17 06:34:58 UTC

> - CVE-2023-28320: siglongjmp race condition
> (https://curl.se/docs/CVE-2023-28320.html)

Fascinatingly, this one is the thing we struggled with for years. See bug 699632 and e.g. https://stackoverflow.com/questions/9191668/error-longjmp-causes-uninitialized-stack-frame.

Comment 2 Larry the Git Cow gentoo-dev

2023-05-17 07:58:42 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=31dc8554f228c128a5b81dbe05395057b029f4da

commit 31dc8554f228c128a5b81dbe05395057b029f4da
Author:     Matt Jolly <Matt.Jolly@footclan.ninja>
AuthorDate: 2023-05-17 07:10:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-05-17 07:58:06 +0000

    net-misc/curl: add 8.1.0
    
    Bug: https://bugs.gentoo.org/906590
    Signed-off-by: Matt Jolly <Matt.Jolly@footclan.ninja>
    Signed-off-by: Sam James <sam@gentoo.org>

 net-misc/curl/Manifest          |   2 +
 net-misc/curl/curl-8.1.0.ebuild | 316 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 318 insertions(+)

Comment 3 Sam James archtester

2023-10-10 04:38:49 UTC

Please cleanup, thanks.

Comment 4 Larry the Git Cow gentoo-dev

2023-10-11 08:41:30 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=3dfe02046c2bc76fb7e910a04702603b72fcb98c

commit 3dfe02046c2bc76fb7e910a04702603b72fcb98c
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-10-11 08:40:59 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-10-11 08:41:24 +0000

    [ GLSA 202310-12 ] curl: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/887745
    Bug: https://bugs.gentoo.org/894676
    Bug: https://bugs.gentoo.org/902801
    Bug: https://bugs.gentoo.org/906590
    Bug: https://bugs.gentoo.org/910564
    Bug: https://bugs.gentoo.org/914091
    Bug: https://bugs.gentoo.org/915195
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202310-12.xml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)