diff options
Diffstat (limited to 'meta/recipes-support/curl/curl/CVE-2015-3153.patch')
| -rw-r--r-- | meta/recipes-support/curl/curl/CVE-2015-3153.patch | 90 |
1 files changed, 90 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2015-3153.patch b/meta/recipes-support/curl/curl/CVE-2015-3153.patch new file mode 100644 index 0000000000..089020a842 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2015-3153.patch @@ -0,0 +1,90 @@ +From 69a2e8d7ec581695a62527cb2252e7350f314ffa Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 23 Apr 2015 15:58:21 +0200 +Subject: [PATCH] CURLOPT_HEADEROPT: default to separate + +Make the HTTP headers separated by default for improved security and +reduced risk for information leakage. + +Bug: http://curl.haxx.se/docs/adv_20150429.html +Reported-by: Yehezkel Horowitz, Oren Souroujon +--- + docs/libcurl/opts/CURLOPT_HEADEROPT.3 | 12 ++++++------ + lib/url.c | 1 + + tests/data/test1527 | 2 +- + tests/data/test287 | 2 +- + tests/libtest/lib1527.c | 1 + + 5 files changed, 10 insertions(+), 8 deletions(-) + +Index: curl-7.37.1/docs/libcurl/opts/CURLOPT_HEADEROPT.3 +=================================================================== +--- curl-7.37.1.orig/docs/libcurl/opts/CURLOPT_HEADEROPT.3 ++++ curl-7.37.1/docs/libcurl/opts/CURLOPT_HEADEROPT.3 +@@ -5,7 +5,7 @@ + .\" * | (__| |_| | _ <| |___ + .\" * \___|\___/|_| \_\_____| + .\" * +-.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. ++.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al. + .\" * + .\" * This software is licensed as described in the file COPYING, which + .\" * you should have received as part of this distribution. The terms +@@ -44,7 +44,7 @@ headers. When doing CONNECT, libcurl wil + headers only do the proxy and then \fICURLOPT_HTTPHEADER(3)\fP headers only to + the server. + .SH DEFAULT +-CURLHEADER_UNIFIED ++CURLHEADER_SEPARATE (changed in 7.42.1, ased CURLHEADER_UNIFIED before then) + .SH PROTOCOLS + HTTP + .SH EXAMPLE +Index: curl-7.37.1/tests/data/test1527 +=================================================================== +--- curl-7.37.1.orig/tests/data/test1527 ++++ curl-7.37.1/tests/data/test1527 +@@ -45,7 +45,7 @@ http-proxy + lib1527 + </tool> + <name> +-Check same headers are generated without CURLOPT_PROXYHEADER ++Check same headers are generated with CURLOPT_HEADEROPT == CURLHEADER_UNIFIED + </name> + <command> + http://the.old.moo.1527:%HTTPPORT/1527 %HOSTIP:%PROXYPORT +Index: curl-7.37.1/tests/data/test287 +=================================================================== +--- curl-7.37.1.orig/tests/data/test287 ++++ curl-7.37.1/tests/data/test287 +@@ -28,7 +28,7 @@ http + HTTP proxy CONNECT with custom User-Agent header + </name> + <command> +-http://test.remote.example.com.287:%HTTPPORT/path/287 -H "User-Agent: looser/2007" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel ++http://test.remote.example.com.287:%HTTPPORT/path/287 -H "User-Agent: looser/2015" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel --proxy-header "User-Agent: looser/2007" + </command> + </client> + +Index: curl-7.37.1/tests/libtest/lib1527.c +=================================================================== +--- curl-7.37.1.orig/tests/libtest/lib1527.c ++++ curl-7.37.1/tests/libtest/lib1527.c +@@ -83,6 +83,7 @@ int test(char *URL) + test_setopt(curl, CURLOPT_READFUNCTION, read_callback); + test_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L); + test_setopt(curl, CURLOPT_INFILESIZE, strlen(data)); ++ test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED); + + res = curl_easy_perform(curl); + +Index: curl-7.37.1/lib/url.c +=================================================================== +--- curl-7.37.1.orig/lib/url.c ++++ curl-7.37.1/lib/url.c +@@ -584,6 +584,7 @@ CURLcode Curl_init_userdefined(struct Us + set->ssl_enable_alpn = TRUE; + + set->expect_100_timeout = 1000L; /* Wait for a second by default. */ ++ set->sep_headers = TRUE; /* separated header lists by default */ + return res; + } + |