* CVE-2021-22922: Wrong content via metalink not discarded "This was one of the problems we found that that all together made us take the drastic decision to completely remove metalink support. The metalink format has a hash for the content so that a client can detect faulty contents. curl didn’t act properly if the has mismatched and it could easily make users not realize the bad content." * CVE-2021-22923: Metalink download sends credentials "If you download the metalink file using credentials, the subsequent download(s) of the file mentioned in that XML file will also get the same credentials passed to those servers, unexpectedly, thus potentially leaking sensitive information to other parties! CVE-2021-22924: Bad connection reuse due to flawed path name checks libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take ‘issuer cert’ into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections!" * CVE-2021-22925: TELNET stack contents disclosure again "Possibly the most embarrassing security flaw in a long time. When we shipped 7.77.0 we announced CVE-2021-22898, which was a flaw in the telnet code and an associated fix. Know what? The fix was incomplete and plain wrong so the original problem actually remained for a certain set of input. This is thus the second advisory for the same problem and now we fix this again. Hopefully for real and for good this time…" * CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport "When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name – using the same option. If the name exists as a file, it will be used instead of by name. This could be exploited in rare circumstances."
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f7d7fb78e3689b5a56f384d9e0eca42ac36b23c7 commit f7d7fb78e3689b5a56f384d9e0eca42ac36b23c7 Author: Sam James <sam@gentoo.org> AuthorDate: 2021-07-22 02:52:33 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-07-22 03:20:27 +0000 net-misc/curl: add 7.78.0 * Security bump to 7.78.0 * Drops metalink support (gone upstream entirely) * Drops two obsolete seds Bug: https://bugs.gentoo.org/382241 Bug: https://bugs.gentoo.org/637252 Bug: https://bugs.gentoo.org/803308 Signed-off-by: Sam James <sam@gentoo.org> net-misc/curl/Manifest | 1 + net-misc/curl/curl-7.78.0.ebuild | 289 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 290 insertions(+)
Let’s go?
(In reply to Sam James from comment #2) > Let’s go? Its ready
amd64 done
ppc done
ppc64 done
sparc done
arm64 done
Unable to check for sanity: > no match for package: net-misc/curl-7.78.0
hppa done
x86 stable
arm done all arches done
Please cleanup, thanks!
(In reply to Sam James from comment #13) > Please cleanup, thanks! cleanup done.
(In reply to Anthony Basile from comment #14) > (In reply to Sam James from comment #13) > > Please cleanup, thanks! > > cleanup done. Thanks!
Unable to check for sanity: > no match for package: net-misc/curl-7.78.0-r1
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=d4066956acc3f238eef20bbbad18f982301dd80b commit d4066956acc3f238eef20bbbad18f982301dd80b Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-12-19 01:59:44 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-12-19 02:04:27 +0000 [ GLSA 202212-01 ] curl: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/803308 Bug: https://bugs.gentoo.org/813270 Bug: https://bugs.gentoo.org/841302 Bug: https://bugs.gentoo.org/843824 Bug: https://bugs.gentoo.org/854708 Bug: https://bugs.gentoo.org/867679 Bug: https://bugs.gentoo.org/878365 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202212-01.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+)
GLSA released, all done.
