Bug 33730 - curl new security issue CVE-2024-9681
Summary: curl new security issue CVE-2024-9681
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-11-06 10:38 CET by Nicolas Salguero
Modified: 2024-11-12 21:27 CET (History)
6 users (show)

See Also:
Source RPM: curl-7.88.1-4.3.mga9.src.rpm
CVE: CVE-2024-9681
Status comment: Fixed upstream in 8.11.0 and patch available from upstream


Attachments
Log of LC_ALL=C urpmi.update -a -ff --debug (56.84 KB, text/plain)
2024-11-06 23:12 CET, katnatek
Details

Description Nicolas Salguero 2024-11-06 10:38:09 CET
cURL has issued an advisory on November 6:
https://curl.se/docs/CVE-2024-9681.html

The issue is fixed upstream in 8.11.0 (for Cauldron).

Patch (for Mageia 9): https://github.com/curl/curl/commit/a94973805df96269bf
Nicolas Salguero 2024-11-06 10:38:49 CET

Whiteboard: (none) => MGA9TOO
Source RPM: (none) => curl-8.10.1-1.mga10.src.rpm, curl-7.88.1-4.3.mga9.src.rpm
Status comment: (none) => Fixed upstream in 8.11.0 and patch available from upstream
CVE: (none) => CVE-2024-9681

Dan Fandrich 2024-11-06 18:14:53 CET

Assignee: bugsquad => dan
CC: (none) => dan
Status: NEW => ASSIGNED

Comment 1 Dan Fandrich 2024-11-06 18:15:28 CET
Cauldron has been updated to curl-8.11.0-1.mga10
Comment 2 Dan Fandrich 2024-11-06 20:15:28 CET
The following are available in 9/updates_testing:

RPMs:
  curl-7.88.1-4.4.mga9
  curl-debuginfo-7.88.1-4.4.mga9
  curl-debugsource-7.88.1-4.4.mga9
  curl-examples-7.88.1-4.4.mga9
  lib64curl4-7.88.1-4.4.mga9
  lib64curl4-debuginfo-7.88.1-4.4.mga9
  lib64curl-devel-7.88.1-4.4.mga9

SRPMS:
  curl-7.88.1-4.4.mga9

Suggested advisory text (mostly cobbled together from the curl advisory):

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. This flaw also affects the curl command line tool.

When triggered, this is a potential minor DoS security problem when trying to use HTTPS when that no longer works or a cleartext transmission of data that was otherwise intended to possibly be protected.

This update fixes the issue so subdomains cannot affect the HSTS cache of a parent domain.

Assignee: dan => qa-bugs

katnatek 2024-11-06 21:27:17 CET

Version: Cauldron => 9
Source RPM: curl-8.10.1-1.mga10.src.rpm, curl-7.88.1-4.3.mga9.src.rpm => curl-7.88.1-4.3.mga9.src.rpm

katnatek 2024-11-06 21:29:37 CET

Keywords: (none) => advisory
Whiteboard: MGA9TOO => (none)

Comment 3 katnatek 2024-11-06 23:12:22 CET
Created attachment 14749 [details]
Log of LC_ALL=C urpmi.update -a -ff --debug

RH x86_64

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (32-bit)" is up-to-date
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing curl-7.88.1-4.4.mga9.x86_64.rpm lib64curl4-7.88.1-4.4.mga9.x86_64.rpm lib64curl-devel-7.88.1-4.4.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/3: lib64curl4            ##################################################################################################
      2/3: curl                  ##################################################################################################
      3/3: lib64curl-devel       ##################################################################################################
      1/3: removing lib64curl-devel-1:7.88.1-4.3.mga9.x86_64
                                 ##################################################################################################
      2/3: removing curl-1:7.88.1-4.3.mga9.x86_64
                                 ##################################################################################################
      3/3: removing lib64curl4-1:7.88.1-4.3.mga9.x86_64
                                 ##################################################################################################

Change download manager to curl in drakrpm-editmedia
And run LC_ALL=C urpmi.update -a -ff --debug  , the attached log shows that works
Comment 4 katnatek 2024-11-06 23:18:32 CET
RH x86_64

strace transmission-qt shows
openat(AT_FDCWD, "/lib64/libcurl.so.4", O_RDONLY|O_CLOEXEC) = 3

The application works
PC LX 2024-11-07 00:04:22 CET

CC: (none) => mageia

Comment 5 Morgan Leijström 2024-11-11 10:03:31 CET
I run into error 22 but that is no regression i think.
https://wiki.mageia.org/en/Mageia_9_Errata

CC: (none) => fri

Comment 6 Herman Viaene 2024-11-11 11:48:34 CET
MGA9-64 Plasma Wayland on HP-Pavillion
No installation issues
Ref bug 32362 for testing and bug 33020 comment 5 
$ curl https://ident.me ; echo
94.105.126.32
[tester9@mach4 ~]$ rm -f /tmp/cookiejar /tmp/out.html
[tester9@mach4 ~]$ curl -d name=yummy -d value=chocolate -d path=/ -b /tmp/cookiejar -c /tmp/cookiejar https://setcookie.net/ -o /tmp/out.html
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4576  100  4543  100    33  13313     96 --:--:-- --:--:-- --:--:-- 13458
[tester9@mach4 ~]$ curl -d name=yummy -d value=chocolate -d path=/ -b /tmp/cookiejar -c /tmp/cookiejar https://setcookie.net/ -o /tmp/out.html
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4625  100  4592  100    33  24229    174 --:--:-- --:--:-- --:--:-- 24601
[tester9@mach4 ~]$ grep ' = ' /tmp/out.html
<li><code>yummy = chocolate</code></li>
Looks OK

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 7 Thomas Andrews 2024-11-11 19:30:12 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 8 Dan Fandrich 2024-11-12 07:16:15 CET
This package was pushed today but for some reason this bug wasn't automatically closed.

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED

Comment 9 Mageia Robot 2024-11-12 21:27:15 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0360.html

Note You need to log in before you can comment on or make changes to this bug.