diff -Nru curl-8.2.1/debian/changelog curl-8.2.1/debian/changelog --- curl-8.2.1/debian/changelog 2023-11-29 19:13:09.000000000 +0000 +++ curl-8.2.1/debian/changelog 2024-03-19 11:56:43.000000000 +0000 @@ -1,3 +1,18 @@ +curl (8.2.1-1ubuntu3.3) mantic-security; urgency=medium + + * SECURITY UPDATE: Usage of disabled protocol + - debian/patches/CVE-2024-2004.patch: fix disabling all protocols in + lib/setopt.c, tests/data/Makefile.inc, tests/data/test1474. + - CVE-2024-2004 + * SECURITY UPDATE: HTTP/2 push headers memory-leak + - debian/patches/CVE-2024-2398.patch: push headers better cleanup in + lib/http2.c. + - CVE-2024-2398 + * debian/patches/fix_expired_test.patch: update cookie expiry dates to + far in the future to fix expired date in tests/data/test420. + + -- Marc Deslauriers Tue, 19 Mar 2024 07:56:43 -0400 + curl (8.2.1-1ubuntu3.2) mantic-security; urgency=medium * SECURITY UPDATE: cookie mixed case PSL bypass diff -Nru curl-8.2.1/debian/patches/CVE-2024-2004.patch curl-8.2.1/debian/patches/CVE-2024-2004.patch --- curl-8.2.1/debian/patches/CVE-2024-2004.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.2.1/debian/patches/CVE-2024-2004.patch 2024-03-19 11:55:49.000000000 +0000 @@ -0,0 +1,128 @@ +Backport of: + +From 17d302e56221f5040092db77d4f85086e8a20e0e Mon Sep 17 00:00:00 2001 +From: Daniel Gustafsson +Date: Tue, 27 Feb 2024 15:43:56 +0100 +Subject: [PATCH] setopt: Fix disabling all protocols + +When disabling all protocols without enabling any, the resulting +set of allowed protocols remained the default set. Clearing the +allowed set before inspecting the passed value from --proto make +the set empty even in the errorpath of no protocols enabled. + +Co-authored-by: Dan Fandrich +Reported-by: Dan Fandrich +Reviewed-by: Daniel Stenberg +Closes: #13004 +--- + lib/setopt.c | 16 ++++++++-------- + tests/data/Makefile.inc | 2 +- + tests/data/test1474 | 42 +++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 51 insertions(+), 9 deletions(-) + create mode 100644 tests/data/test1474 + +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -154,6 +154,12 @@ static CURLcode setstropt_userpwd(char * + + static CURLcode protocol2num(const char *str, curl_prot_t *val) + { ++ /* ++ * We are asked to cherry-pick protocols, so play it safe and disallow all ++ * protocols to start with, and re-add the wanted ones back in. ++ */ ++ *val = 0; ++ + if(!str) + return CURLE_BAD_FUNCTION_ARGUMENT; + +@@ -162,8 +168,6 @@ static CURLcode protocol2num(const char + return CURLE_OK; + } + +- *val = 0; +- + do { + const char *token = str; + size_t tlen; +@@ -2679,22 +2683,18 @@ CURLcode Curl_vsetopt(struct Curl_easy * + break; + + case CURLOPT_PROTOCOLS_STR: { +- curl_prot_t prot; + argptr = va_arg(param, char *); +- result = protocol2num(argptr, &prot); ++ result = protocol2num(argptr, &data->set.allowed_protocols); + if(result) + return result; +- data->set.allowed_protocols = prot; + break; + } + + case CURLOPT_REDIR_PROTOCOLS_STR: { +- curl_prot_t prot; + argptr = va_arg(param, char *); +- result = protocol2num(argptr, &prot); ++ result = protocol2num(argptr, &data->set.redir_protocols); + if(result) + return result; +- data->set.redir_protocols = prot; + break; + } + +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -185,7 +185,7 @@ test1440 test1441 test1442 test1443 test + test1448 test1449 test1450 test1451 test1452 test1453 test1454 test1455 \ + test1456 test1457 test1458 test1459 test1460 test1461 test1462 test1463 \ + test1464 test1465 test1466 test1467 test1468 test1469 test1470 test1471 \ +-test1472 \ ++test1472 test1474 \ + test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ + test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \ + test1516 test1517 test1518 test1519 test1520 test1521 test1522 test1523 \ +--- /dev/null ++++ b/tests/data/test1474 +@@ -0,0 +1,42 @@ ++ ++ ++ ++HTTP ++HTTP GET ++--proto ++ ++ ++ ++# ++# Server-side ++ ++ ++ ++ ++ ++# ++# Client-side ++ ++ ++none ++ ++ ++http ++ ++ ++--proto -all disables all protocols ++ ++ ++--proto -all http://%HOSTIP:%NOLISTENPORT/%TESTNUMBER ++ ++ ++ ++# ++# Verify data after the test has been "shot" ++ ++# 1 - Protocol "http" disabled ++ ++1 ++ ++ ++ diff -Nru curl-8.2.1/debian/patches/CVE-2024-2398.patch curl-8.2.1/debian/patches/CVE-2024-2398.patch --- curl-8.2.1/debian/patches/CVE-2024-2398.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.2.1/debian/patches/CVE-2024-2398.patch 2024-03-19 11:56:43.000000000 +0000 @@ -0,0 +1,89 @@ +Backport of: + +From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Wed, 6 Mar 2024 09:36:08 +0100 +Subject: [PATCH] http2: push headers better cleanup + +- provide common cleanup method for push headers + +Closes #13054 +--- + lib/http2.c | 34 +++++++++++++++------------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +--- a/lib/http2.c ++++ b/lib/http2.c +@@ -267,6 +267,15 @@ static CURLcode http2_data_setup(struct + return CURLE_OK; + } + ++static void free_push_headers(struct stream_ctx *stream) ++{ ++ size_t i; ++ for(i = 0; ipush_headers_used; i++) ++ free(stream->push_headers[i]); ++ Curl_safefree(stream->push_headers); ++ stream->push_headers_used = 0; ++} ++ + static void http2_data_done(struct Curl_cfilter *cf, + struct Curl_easy *data, bool premature) + { +@@ -313,15 +322,7 @@ static void http2_data_done(struct Curl_ + Curl_bufq_free(&stream->sendbuf); + Curl_bufq_free(&stream->recvbuf); + Curl_dynhds_free(&stream->resp_trailers); +- if(stream->push_headers) { +- /* if they weren't used and then freed before */ +- for(; stream->push_headers_used > 0; --stream->push_headers_used) { +- free(stream->push_headers[stream->push_headers_used - 1]); +- } +- free(stream->push_headers); +- stream->push_headers = NULL; +- } +- ++ free_push_headers(stream); + free(stream); + H2_STREAM_LCTX(data) = NULL; + } +@@ -859,7 +860,6 @@ static int push_promise(struct Curl_cfil + struct curl_pushheaders heads; + CURLMcode rc; + CURLcode result; +- size_t i; + /* clone the parent */ + struct Curl_easy *newhandle = h2_duphandle(cf, data); + if(!newhandle) { +@@ -904,11 +904,7 @@ static int push_promise(struct Curl_cfil + Curl_set_in_callback(data, false); + + /* free the headers again */ +- for(i = 0; ipush_headers_used; i++) +- free(stream->push_headers[i]); +- free(stream->push_headers); +- stream->push_headers = NULL; +- stream->push_headers_used = 0; ++ free_push_headers(stream); + + if(rv) { + DEBUGASSERT((rv > CURL_PUSH_OK) && (rv <= CURL_PUSH_ERROROUT)); +@@ -1357,14 +1353,14 @@ static int on_header(nghttp2_session *se + if(stream->push_headers_alloc > 1000) { + /* this is beyond crazy many headers, bail out */ + failf(data_s, "Too many PUSH_PROMISE headers"); +- Curl_safefree(stream->push_headers); ++ free_push_headers(stream); + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; + } + stream->push_headers_alloc *= 2; +- headp = Curl_saferealloc(stream->push_headers, +- stream->push_headers_alloc * sizeof(char *)); ++ headp = realloc(stream->push_headers, ++ stream->push_headers_alloc * sizeof(char *)); + if(!headp) { +- stream->push_headers = NULL; ++ free_push_headers(stream); + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; + } + stream->push_headers = headp; diff -Nru curl-8.2.1/debian/patches/fix_expired_test.patch curl-8.2.1/debian/patches/fix_expired_test.patch --- curl-8.2.1/debian/patches/fix_expired_test.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.2.1/debian/patches/fix_expired_test.patch 2024-03-19 11:56:43.000000000 +0000 @@ -0,0 +1,63 @@ +Partial backport of: + +From c2212c05aa99bb31e4b99b0b66fc1747b7d01be6 Mon Sep 17 00:00:00 2001 +From: Alexander Kanavin +Date: Fri, 4 Aug 2023 13:48:12 +0200 +Subject: [PATCH] tests: update cookie expiry dates to far in the future + +This allows testing Y2038 with system time set to after that, so that +actual Y2038 issues can be exposed, and not masked by expiry errors. + +Fixes #11576 +Closes #11610 +--- + tests/data/test1104 | 4 ++-- + tests/data/test1216 | 6 +++--- + tests/data/test1415 | 16 ++++++++++++++++ + tests/data/test172 | 2 +- + tests/data/test179 | 4 ++-- + tests/data/test1915 | 6 ++++++ + tests/data/test31 | 18 ++++++++++++++++++ + tests/data/test327 | 2 +- + tests/data/test329 | 4 ++-- + tests/data/test420 | 14 +++++++------- + tests/data/test46 | 20 ++++++++++++++++++++ + tests/data/test53 | 2 +- + tests/data/test61 | 10 ++++++++++ + tests/data/test62 | 6 +++--- + tests/data/test676 | 2 +- + tests/libtest/lib1915.c | 7 ++++++- + 16 files changed, 99 insertions(+), 24 deletions(-) + +diff --git a/tests/data/test420 b/tests/data/test420 +index 3d6b624c6e8d69..7b7ecb437ee0e0 100644 +--- a/tests/data/test420 ++++ b/tests/data/test420 +@@ -40,12 +40,12 @@ Setting cookies set with expired dates that were loaded from jar + http://%HOSTIP:%HTTPPORT/func_test/del_cookie -b %LOGDIR/cookie%TESTNUMBER -c %LOGDIR/save%TESTNUMBER + + +-%HOSTIP FALSE /func_test FALSE 1709598616 mycookie6 991 +-#HttpOnly_%HOSTIP FALSE /func_test FALSE 1709598616 mycookie5 990 +-#HttpOnly_%HOSTIP FALSE /func_test FALSE 1709598616 mycookie4 950 +-#HttpOnly_%HOSTIP FALSE /func_test FALSE 1709598616 mycookie3 900 +-#HttpOnly_%HOSTIP FALSE /func_test/ FALSE 1709598616 mycookie2 5900 +-#HttpOnly_%HOSTIP FALSE / FALSE 1709598616 mycookie1 4900 ++%HOSTIP FALSE /func_test FALSE 21709598616 mycookie6 991 ++#HttpOnly_%HOSTIP FALSE /func_test FALSE 21709598616 mycookie5 990 ++#HttpOnly_%HOSTIP FALSE /func_test FALSE 21709598616 mycookie4 950 ++#HttpOnly_%HOSTIP FALSE /func_test FALSE 21709598616 mycookie3 900 ++#HttpOnly_%HOSTIP FALSE /func_test/ FALSE 21709598616 mycookie2 5900 ++#HttpOnly_%HOSTIP FALSE / FALSE 21709598616 mycookie1 4900 + #HttpOnly_%HOSTIP FALSE /func_test/ FALSE 0 mycookie 1200 + + +@@ -69,7 +69,7 @@ Cookie: mycookie2=5900; mycookie=1200; mycookie3=900; mycookie4=950; mycookie5=9 + # https://curl.se/docs/http-cookies.html + # This file was generated by libcurl! Edit at your own risk. + +-#HttpOnly_127.0.0.1 FALSE /func_test/ FALSE 1709598616 mycookie2 5900 ++#HttpOnly_127.0.0.1 FALSE /func_test/ FALSE 21709598616 mycookie2 5900 + + + diff -Nru curl-8.2.1/debian/patches/series curl-8.2.1/debian/patches/series --- curl-8.2.1/debian/patches/series 2023-11-29 19:12:34.000000000 +0000 +++ curl-8.2.1/debian/patches/series 2024-03-19 11:56:43.000000000 +0000 @@ -10,6 +10,9 @@ CVE-2023-38546.patch CVE-2023-46218.patch CVE-2023-46219.patch +CVE-2024-2004.patch +CVE-2024-2398.patch +fix_expired_test.patch # Do not add patches below. # Used to generate packages for the other crypto libraries.