rpms
/
curl
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Resolves: CVE-2016-5419 - fix TLS session resumption client cert bypass

This commit is contained in:
Kamil Dudka 2016-08-03 16:47:36 +02:00
parent 8288db1fc2
commit 22a15a2535
2 changed files with 78 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
0009-curl-7.47.1-CVE-2016-5419.patch Normal file
View File

@ -0,0 +1,73 @@
From 86eef63a05eaabd60e4a10d0fc173bab0e7dbf9e Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 1 Jul 2016 13:32:31 +0200
Subject: [PATCH] TLS: switch off SSL session id when client cert is used
CVE-2016-5419
Bug: https://curl.haxx.se/docs/adv_20160803A.html
Reported-by: Bru Rom
Contributions-by: Eric Rescorla and Ray Satiro
Upstream-commit: 247d890da88f9ee817079e246c59f3d7d12fde5f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
lib/url.c | 1 +
lib/urldata.h | 1 +
lib/vtls/vtls.c | 10 ++++++++++
3 files changed, 12 insertions(+)
diff --git a/lib/url.c b/lib/url.c
index 576b8e8..ff99c58 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -5781,6 +5781,7 @@ static CURLcode create_conn(struct SessionHandle *data,
data->set.ssl.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
data->set.ssl.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
data->set.ssl.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
+ data->set.ssl.clientcert = data->set.str[STRING_CERT];
#ifdef USE_TLS_SRP
data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
diff --git a/lib/urldata.h b/lib/urldata.h
index e7341ac..c96dfd4 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -354,6 +354,7 @@ struct ssl_config_data {
char *CAfile; /* certificate to verify peer against */
const char *CRLfile; /* CRL to check certificate revocation */
const char *issuercert;/* optional issuer certificate filename */
+ char *clientcert;
char *random_file; /* path to file containing "random" data */
char *egdsocket; /* path to file containing the EGD daemon socket */
char *cipher_list; /* list of ciphers to use */
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 36465a7..697560d 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -156,6 +156,15 @@ Curl_clone_ssl_config(struct ssl_config_data *source,
else
dest->random_file = NULL;
+ if(source->clientcert) {
+ dest->clientcert = strdup(source->clientcert);
+ if(!dest->clientcert)
+ return FALSE;
+ dest->sessionid = FALSE;
+ }
+ else
+ dest->clientcert = NULL;
+
return TRUE;
}
@@ -166,6 +175,7 @@ void Curl_free_ssl_config(struct ssl_config_data* sslc)
Curl_safefree(sslc->cipher_list);
Curl_safefree(sslc->egdsocket);
Curl_safefree(sslc->random_file);
+ Curl_safefree(sslc->clientcert);
}
--
2.5.5

5
curl.spec
View File

@ -16,6 +16,9 @@ Patch7: 0007-curl-7.49.1-urlglob.patch
# fix use of connection struct after free (CVE-2016-5421)
Patch8: 0008-curl-7.47.1-CVE-2016-5421.patch
# fix TLS session resumption client cert bypass (CVE-2016-5419)
Patch9: 0009-curl-7.47.1-CVE-2016-5419.patch
# patch making libcurl multilib ready
Patch101: 0101-curl-7.32.0-multilib.patch
@ -130,6 +133,7 @@ documentation of the library, too.
%patch1 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
# Fedora patches
%patch101 -p1
@ -243,6 +247,7 @@ rm -rf $RPM_BUILD_ROOT
%changelog
* Wed Aug 03 2016 Kamil Dudka <kdudka@redhat.com> 7.47.1-6
- fix TLS session resumption client cert bypass (CVE-2016-5419)
- fix use of connection struct after free (CVE-2016-5421)
* Fri Jun 03 2016 Kamil Dudka <kdudka@redhat.com> 7.47.1-5