Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 906590 (CVE-2023-28319, CVE-2023-28320, CVE-2023-28321, CVE-2023-28322) - <net-misc/curl-8.1.0: Multiple vulnerabilities
Summary: <net-misc/curl-8.1.0: Multiple vulnerabilities
Status: IN_PROGRESS
Alias: CVE-2023-28319, CVE-2023-28320, CVE-2023-28321, CVE-2023-28322
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa+ cleanup]
Keywords:
Depends on: 910089
Blocks:
  Show dependency tree
 
Reported: 2023-05-17 06:26 UTC by Sam James
Modified: 2023-10-11 08:42 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-17 06:26:34 UTC
- CVE-2023-28322: more POST-after-PUT confusion (https://curl.se/docs/CVE-2023-28322.html)
- CVE-2023-28321: IDN wildcard match (https://curl.se/docs/CVE-2023-28321.html)
- CVE-2023-28320: siglongjmp race condition (https://curl.se/docs/CVE-2023-28320.html)
- CVE-2023-28319: UAF in SSH sha256 fingerprint check (https://curl.se/docs/CVE-2023-28319.html)

All fixed in just-released 8.1.0.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-17 06:34:58 UTC
> - CVE-2023-28320: siglongjmp race condition
> (https://curl.se/docs/CVE-2023-28320.html)

Fascinatingly, this one is the thing we struggled with for years. See bug 699632 and e.g. https://stackoverflow.com/questions/9191668/error-longjmp-causes-uninitialized-stack-frame.
Comment 2 Larry the Git Cow gentoo-dev 2023-05-17 07:58:42 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=31dc8554f228c128a5b81dbe05395057b029f4da

commit 31dc8554f228c128a5b81dbe05395057b029f4da
Author:     Matt Jolly <Matt.Jolly@footclan.ninja>
AuthorDate: 2023-05-17 07:10:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-05-17 07:58:06 +0000

    net-misc/curl: add 8.1.0
    
    Bug: https://bugs.gentoo.org/906590
    Signed-off-by: Matt Jolly <Matt.Jolly@footclan.ninja>
    Signed-off-by: Sam James <sam@gentoo.org>

 net-misc/curl/Manifest          |   2 +
 net-misc/curl/curl-8.1.0.ebuild | 316 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 318 insertions(+)
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-10-10 04:38:49 UTC
Please cleanup, thanks.
Comment 4 Larry the Git Cow gentoo-dev 2023-10-11 08:41:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=3dfe02046c2bc76fb7e910a04702603b72fcb98c

commit 3dfe02046c2bc76fb7e910a04702603b72fcb98c
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-10-11 08:40:59 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-10-11 08:41:24 +0000

    [ GLSA 202310-12 ] curl: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/887745
    Bug: https://bugs.gentoo.org/894676
    Bug: https://bugs.gentoo.org/902801
    Bug: https://bugs.gentoo.org/906590
    Bug: https://bugs.gentoo.org/910564
    Bug: https://bugs.gentoo.org/914091
    Bug: https://bugs.gentoo.org/915195
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202310-12.xml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)