Bug 813270 – <net-misc/curl-7.79.0: Multiple vulnerabilities (CVE-2021-{22945,22946,22947})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2021-09-16 00:54:56 UTC]

Fixed in 7.79.0:
    CVE-2021-22945: clear the leftovers pointer when sending succeeds
    CVE-2021-22946: do not ignore --ssl-reqd
    CVE-2021-22947: reject STARTTLS server response pipelining

[Comment 1 Larry the Git Cow 2021-09-18 03:01:20 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9886665e4f3d22da1d722509fd5de9000a36d4d6

commit 9886665e4f3d22da1d722509fd5de9000a36d4d6
Author:     Sam James <[e-mail]>
AuthorDate: 2021-09-18 02:52:49 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-09-18 02:52:49 +0000

    net-misc/curl: add 7.79.0
    
    Bug: https://bugs.gentoo.org/813270
    Signed-off-by: Sam James <[e-mail]>

 net-misc/curl/Manifest                             |   1 +
 net-misc/curl/curl-7.79.0.ebuild                   | 293 +++++++++++++++++++++
 .../curl-7.79.0-http-3digit-response-code.patch    | 107 ++++++++
 .../files/curl-7.79.0-http2-connection-data.patch  |  43 +++
 4 files changed, 444 insertions(+)

[Comment 2 Larry the Git Cow 2021-09-18 04:22:55 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc195c961bbf981a8368f108fa33ae38e4a9e1e8

commit bc195c961bbf981a8368f108fa33ae38e4a9e1e8
Author:     Sam James <[e-mail]>
AuthorDate: 2021-09-18 04:21:34 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-09-18 04:22:39 +0000

    net-misc/curl: drop test case for response code
    
    Fails for now, but keeping an eye upstream.
    
    Bug: https://bugs.gentoo.org/813270
    Signed-off-by: Sam James <[e-mail]>

 .../curl-7.79.0-http-3digit-response-code.patch    | 60 ----------------------
 1 file changed, 60 deletions(-)

[Comment 3 Sam James 2021-09-18 04:28:22 UTC]

Not going to stable until at least patch release on Wednesday: https://github.com/curl/curl/issues/7738#issuecomment-922028899

[Comment 4 Anthony Basile 2021-09-23 11:33:50 UTC]

(In reply to Sam James from comment #3)
> Not going to stable until at least patch release on Wednesday:
> https://github.com/curl/curl/issues/7738#issuecomment-922028899

7.79.1 is now on the tree and includes both back ported patches that are in 7.79.0.

    curl-7.79.0-http2-connection-data.patch
    curl-7.79.0-http-3digit-response-code.patch

[Comment 5 John Helmert III 2021-10-03 00:53:33 UTC]

Please cleanup

[Comment 6 Anthony Basile 2022-08-15 14:16:56 UTC]

(In reply to John Helmert III from comment #5)
> Please cleanup

Sorry I just notice this.   <net-misc/curl-7.79.0 has been off the tree for a long time.

[Comment 7 Larry the Git Cow 2022-12-19 02:05:16 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d4066956acc3f238eef20bbbad18f982301dd80b

commit d4066956acc3f238eef20bbbad18f982301dd80b
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-12-19 01:59:44 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-12-19 02:04:27 +0000

    [ GLSA 202212-01 ] curl: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/803308
    Bug: https://bugs.gentoo.org/813270
    Bug: https://bugs.gentoo.org/841302
    Bug: https://bugs.gentoo.org/843824
    Bug: https://bugs.gentoo.org/854708
    Bug: https://bugs.gentoo.org/867679
    Bug: https://bugs.gentoo.org/878365
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202212-01.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

[Comment 8 John Helmert III 2022-12-19 02:29:00 UTC]

GLSA released, all done.