Bug 33844 - curl new security issue CVE-2024-11053
Summary: curl new security issue CVE-2024-11053
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-12-11 10:32 CET by Nicolas Salguero
Modified: 2024-12-17 20:43 CET (History)
5 users (show)

See Also:
Source RPM: curl-7.88.1-4.4.mga9.src.rpm
CVE: CVE-2024-11053
Status comment: Fixed upstream in 8.11.1 and patch available from upstream


Attachments

Description Nicolas Salguero 2024-12-11 10:32:22 CET
cURL has issued an advisory on December 11:
https://curl.se/docs/CVE-2024-11053.html

Fix: https://github.com/curl/curl/commit/e9b9bbac22c26cf6731
Nicolas Salguero 2024-12-11 10:33:24 CET

Source RPM: (none) => curl-8.11.0-2.mga10.src.rpm, curl-7.88.1-4.4.mga9.src.rpm
Whiteboard: (none) => MGA9TOO
Status comment: (none) => Fixed upstream in 8.11.1 and patch available from upstream
CVE: (none) => CVE-2024-11053

Comment 1 Dan Fandrich 2024-12-12 04:19:40 CET
Cauldron has been updated to 8.11.1

Status: NEW => ASSIGNED
Assignee: bugsquad => dan
CC: (none) => dan

Comment 2 Dan Fandrich 2024-12-12 07:25:51 CET
There have been some significant changes to the netrc parsing code since 7.88.1, so rather than try to back-port the changes in logic, I applied minimal subsets of the previous commits necessary to apply the final fix. This made for a somewhat larger patch than strictly necessary, but if you exclude the netrc file and the added regression tests to verify the fix, there's really not that much more.
Comment 3 Dan Fandrich 2024-12-12 07:50:23 CET
curl-7.88.1-4.5.mga9 is available in updates_testing. The patch includes three new tests 478, 479 and 480 to verify the fix, which can be checked in the build logs as having passed. A related non-security issue is also fixed, which is verified by tests 998 and 999.

RPMS:
curl-7.88.1-4.5.mga9
lib64curl4-7.88.1-4.5.mga9
lib64curl-devel-7.88.1-4.5.mga9
curl-examples-7.88.1-4.5.mga9
curl-debuginfo-7.88.1-4.5.mga9
curl-debugsource-7.88.1-4.5.mga9

SRPMS:
curl-7.88.1-4.5.mga9.src.rpm

Suggested advisory notice:

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

This update fixes this logic to avoid sending a password to the wrong host.

Assignee: dan => qa-bugs

katnatek 2024-12-12 23:19:31 CET

Version: Cauldron => 9
Source RPM: curl-8.11.0-2.mga10.src.rpm, curl-7.88.1-4.4.mga9.src.rpm => curl-7.88.1-4.4.mga9.src.rpm
Whiteboard: MGA9TOO => (none)

katnatek 2024-12-12 23:23:28 CET

Keywords: (none) => advisory

Comment 4 Guillaume Royer 2024-12-13 08:34:45 CET
Mageia x64 GNOME

Updated with RPMs: 

curl                           7.88.1       4.5.mga9      x86_64  
lib64curl-devel                7.88.1       4.5.mga9      x86_64  
lib64curl4                     7.88.1       4.5.mga9      x86_64  

No issues after installation.

curl -I https://www.mageia.org/fr/
HTTP/1.1 200 OK
Date: Fri, 13 Dec 2024 07:28:42 GMT
Server: Apache
Vary: User-Agent
Content-Type: text/html; charset=UTF-8

curl -O https://geex.freeboxos.fr/distrib/9/x86_64/install/images/Mageia-9-netinstall-x86_64.iso
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 70.0M  100 70.0M    0     0  56.2M      0  0:00:01  0:00:01 --:--:-- 56.2M

NOTA: 

curl-debuginfo-7.88.1-4.5.mga9
curl-debugsource-7.88.1-4.5.mga9

are not in update testing

CC: (none) => guillaume.royer

Comment 5 Herman Viaene 2024-12-13 11:59:03 CET
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Repeated tests above:
$ curl -I https://www.mageia.org/fr/r/
HTTP/1.1 200 OK
Date: Fri, 13 Dec 2024 10:53:52 GMT
Server: Apache
Vary: User-Agent
Content-Type: text/html; charset=UTF-8

[tester9@mach3 ~]$ cd tmp
[tester9@mach3 tmp]$ curl -O https://geex.freeboxos.fr/distrib/9/x86_64/install/images/Mageia-9-netinstall-x86_64.iso
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 70.0M  100 70.0M    0     0  6330k      0  0:00:11  0:00:11 --:--:-- 6462k
file downloaded OK.
This is similar to tests on previous updates, so OK.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 6 katnatek 2024-12-13 20:54:43 CET
(In reply to Guillaume Royer from comment #4)
> NOTA: 
> 
> curl-debuginfo-7.88.1-4.5.mga9
> curl-debugsource-7.88.1-4.5.mga9
> 
> are not in update testing

That packages are in the debug repositories testing flavor, not for testing by qa
Comment 7 katnatek 2024-12-13 21:00:26 CET
RH x86_64

installing lib64curl4-7.88.1-4.5.mga9.x86_64.rpm lib64curl-devel-7.88.1-4.5.mga9.x86_64.rpm curl-7.88.1-4.5.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/3: lib64curl4            ##################################################################################################
      2/3: lib64curl-devel       ##################################################################################################
      3/3: curl                  ##################################################################################################
      1/3: removing lib64curl-devel-1:7.88.1-4.4.mga9.x86_64
                                 ##################################################################################################
      2/3: removing curl-1:7.88.1-4.4.mga9.x86_64
                                 ##################################################################################################
      3/3: removing lib64curl4-1:7.88.1-4.4.mga9.x86_64
                                 ##################################################################################################

Switch to curl as dowloadmanager in drakrpm-editmedia
urpmi.update -a --debug
Works

CC: (none) => andrewsfarm

Comment 8 Thomas Andrews 2024-12-17 18:00:13 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 9 Mageia Robot 2024-12-17 20:43:10 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0391.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.