Skip to content

Commit c402b55

Browse files
CBL-Mariner-Bothbeberman
CBL-Mariner-Bot
and
hbeberman
authored
[AUTO-CHERRYPICK] cmake: patch CVE-2024-11053 - branch main (#11943)
Co-authored-by: Henry Beberman <[email protected]>
1 parent d846084 commit c402b55

File tree

4 files changed

+340
-5
lines changed

4 files changed

+340
-5
lines changed

‎SPECS/cmake/CVE-2024-11053.patch

+331
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,331 @@
1+
From 277c4661bd10b7f513c18f84b64431dad20c2722 Mon Sep 17 00:00:00 2001
2+
From: Henry Beberman <[email protected]>
3+
Date: Wed, 15 Jan 2025 01:03:08 +0000
4+
Subject: [PATCH] Backport updated netrc parsing
5+
6+
Backport fix for CVE-2024-11053 from upstream commit to vendored libcurl 7.77.0
7+
8+
From e9b9bbac22c26cf67316fa8e6c6b9e831af31949 Mon Sep 17 00:00:00 2001
9+
From: Daniel Stenberg <[email protected]>
10+
Date: Fri, 15 Nov 2024 11:06:36 +0100
11+
Subject: [PATCH] netrc: address several netrc parser flaws
12+
13+
- make sure that a match that returns a username also returns a
14+
password, that should be blank if no password is found
15+
16+
- fix handling of multiple logins for same host where the password/login
17+
order might be reversed.
18+
19+
- reject credentials provided in the .netrc if they contain ASCII control
20+
codes - if the used protocol does not support such (like HTTP and WS do)
21+
22+
diff --git a/Utilities/cmcurl/lib/netrc.c b/Utilities/cmcurl/lib/netrc.c
23+
index 13610bb..2c93c6e 100644
24+
--- a/Utilities/cmcurl/lib/netrc.c
25+
+++ b/Utilities/cmcurl/lib/netrc.c
26+
@@ -42,9 +42,19 @@
27+
enum host_lookup_state {
28+
NOTHING,
29+
HOSTFOUND, /* the 'machine' keyword was found */
30+
- HOSTVALID /* this is "our" machine! */
31+
+ HOSTVALID, /* this is "our" machine! */
32+
+ MACDEF
33+
};
34+
35+
+enum found_state {
36+
+ NONE,
37+
+ LOGIN,
38+
+ PASSWORD
39+
+};
40+
+
41+
+#define FOUND_LOGIN 1
42+
+#define FOUND_PASSWORD 2
43+
+
44+
#define NETRC_FILE_MISSING 1
45+
#define NETRC_FAILED -1
46+
#define NETRC_SUCCESS 0
47+
@@ -62,16 +72,14 @@ static int parsenetrc(const char *host,
48+
FILE *file;
49+
int retcode = NETRC_FILE_MISSING;
50+
char *login = *loginp;
51+
- char *password = *passwordp;
52+
- bool specific_login = (login && *login != 0);
53+
- bool login_alloc = FALSE;
54+
- bool password_alloc = FALSE;
55+
+ char *password = NULL;
56+
+ bool specific_login = !!login; /* points to something */
57+
enum host_lookup_state state = NOTHING;
58+
-
59+
- char state_login = 0; /* Found a login keyword */
60+
- char state_password = 0; /* Found a password keyword */
61+
- int state_our_login = FALSE; /* With specific_login, found *our* login
62+
- name */
63+
+ enum found_state keyword = NONE;
64+
+ unsigned char found = 0; /* login + password found bits, as they can come in
65+
+ any order */
66+
+ bool our_login = FALSE; /* found our login name */
67+
+ bool done = FALSE;
68+
69+
DEBUGASSERT(netrcfile);
70+
71+
@@ -90,110 +98,129 @@ static int parsenetrc(const char *host,
72+
continue;
73+
while(tok) {
74+
75+
- if((login && *login) && (password && *password)) {
76+
- done = TRUE;
77+
- break;
78+
- }
79+
-
80+
switch(state) {
81+
- case NOTHING:
82+
- if(strcasecompare("machine", tok)) {
83+
- /* the next tok is the machine name, this is in itself the
84+
- delimiter that starts the stuff entered for this machine,
85+
- after this we need to search for 'login' and
86+
- 'password'. */
87+
- state = HOSTFOUND;
88+
- }
89+
- else if(strcasecompare("default", tok)) {
90+
- state = HOSTVALID;
91+
- retcode = NETRC_SUCCESS; /* we did find our host */
92+
- }
93+
- break;
94+
- case HOSTFOUND:
95+
- if(strcasecompare(host, tok)) {
96+
- /* and yes, this is our host! */
97+
- state = HOSTVALID;
98+
- retcode = NETRC_SUCCESS; /* we did find our host */
99+
- }
100+
- else
101+
- /* not our host */
102+
- state = NOTHING;
103+
- break;
104+
- case HOSTVALID:
105+
- /* we are now parsing sub-keywords concerning "our" host */
106+
- if(state_login) {
107+
- if(specific_login) {
108+
- state_our_login = strcasecompare(login, tok);
109+
+ case NOTHING:
110+
+ if(strcasecompare("macdef", tok))
111+
+ /* Define a macro. A macro is defined with the specified name; its
112+
+ contents begin with the next .netrc line and continue until a
113+
+ null line (consecutive new-line characters) is encountered. */
114+
+ state = MACDEF;
115+
+ else if(strcasecompare("machine", tok)) {
116+
+ /* the next tok is the machine name, this is in itself the delimiter
117+
+ that starts the stuff entered for this machine, after this we
118+
+ need to search for 'login' and 'password'. */
119+
+ state = HOSTFOUND;
120+
+ keyword = NONE;
121+
+ found = 0;
122+
+ our_login = FALSE;
123+
+ Curl_safefree(password);
124+
+ if(!specific_login)
125+
+ Curl_safefree(login);
126+
}
127+
- else if(!login || strcmp(login, tok)) {
128+
- if(login_alloc) {
129+
+ else if(strcasecompare("default", tok)) {
130+
+ state = HOSTVALID;
131+
+ retcode = NETRC_SUCCESS; /* we did find our host */
132+
+ }
133+
+ break;
134+
+ case MACDEF:
135+
+ if(!*tok)
136+
+ state = NOTHING;
137+
+ break;
138+
+ case HOSTFOUND:
139+
+ if(strcasecompare(host, tok)) {
140+
+ /* and yes, this is our host! */
141+
+ state = HOSTVALID;
142+
+ retcode = NETRC_SUCCESS; /* we did find our host */
143+
+ }
144+
+ else
145+
+ /* not our host */
146+
+ state = NOTHING;
147+
+ break;
148+
+ case HOSTVALID:
149+
+ /* we are now parsing sub-keywords concerning "our" host */
150+
+ if(keyword == LOGIN) {
151+
+ if(specific_login)
152+
+ our_login = !Curl_timestrcmp(login, tok);
153+
+ else {
154+
+ our_login = TRUE;
155+
free(login);
156+
- login_alloc = FALSE;
157+
- }
158+
- login = strdup(tok);
159+
- if(!login) {
160+
- retcode = NETRC_FAILED; /* allocation failed */
161+
- goto out;
162+
+ login = strdup(tok);
163+
+ if(!login) {
164+
+ retcode = NETRC_FAILED; /* allocation failed */
165+
+ goto out;
166+
+ }
167+
}
168+
- login_alloc = TRUE;
169+
+ found |= FOUND_LOGIN;
170+
+ keyword = NONE;
171+
}
172+
- state_login = 0;
173+
- }
174+
- else if(state_password) {
175+
- if((state_our_login || !specific_login)
176+
- && (!password || strcmp(password, tok))) {
177+
- if(password_alloc) {
178+
- free(password);
179+
- password_alloc = FALSE;
180+
- }
181+
+ else if(keyword == PASSWORD) {
182+
+ free(password);
183+
password = strdup(tok);
184+
if(!password) {
185+
retcode = NETRC_FAILED; /* allocation failed */
186+
goto out;
187+
}
188+
- password_alloc = TRUE;
189+
+ if(!specific_login || our_login)
190+
+ found |= FOUND_PASSWORD;
191+
+ keyword = NONE;
192+
+ }
193+
+ else if(strcasecompare("login", tok))
194+
+ keyword = LOGIN;
195+
+ else if(strcasecompare("password", tok))
196+
+ keyword = PASSWORD;
197+
+ else if(strcasecompare("machine", tok)) {
198+
+ /* a new machine here */
199+
+ if(found & FOUND_PASSWORD) {
200+
+ done = TRUE;
201+
+ break;
202+
+ }
203+
+ state = HOSTFOUND;
204+
+ keyword = NONE;
205+
+ found = 0;
206+
+ Curl_safefree(password);
207+
+ if(!specific_login)
208+
+ Curl_safefree(login);
209+
+ }
210+
+ else if(strcasecompare("default", tok)) {
211+
+ state = HOSTVALID;
212+
+ retcode = NETRC_SUCCESS; /* we did find our host */
213+
+ Curl_safefree(password);
214+
+ if(!specific_login)
215+
+ Curl_safefree(login);
216+
+ }
217+
+ if((found == (FOUND_PASSWORD|FOUND_LOGIN)) && our_login) {
218+
+ done = TRUE;
219+
+ break;
220+
}
221+
- state_password = 0;
222+
- }
223+
- else if(strcasecompare("login", tok))
224+
- state_login = 1;
225+
- else if(strcasecompare("password", tok))
226+
- state_password = 1;
227+
- else if(strcasecompare("machine", tok)) {
228+
- /* ok, there's machine here go => */
229+
- state = HOSTFOUND;
230+
- state_our_login = FALSE;
231+
- }
232+
- break;
233+
- } /* switch (state) */
234+
+ break;
235+
+ } /* switch (state) */
236+
237+
tok = strtok_r(NULL, " \t\n", &tok_buf);
238+
} /* while(tok) */
239+
} /* while fgets() */
240+
241+
out:
242+
+ if(!retcode) {
243+
+ if(!password && our_login) {
244+
+ /* success without a password, set a blank one */
245+
+ password = strdup("");
246+
+ if(!password)
247+
+ retcode = 1; /* out of memory */
248+
+ }
249+
+ else if(!login && !password)
250+
+ /* a default with no credentials */
251+
+ retcode = NETRC_FILE_MISSING;
252+
+ }
253+
if(!retcode) {
254+
/* success */
255+
- *login_changed = FALSE;
256+
- *password_changed = FALSE;
257+
- if(login_alloc) {
258+
- if(*loginp)
259+
- free(*loginp);
260+
+ if(!specific_login)
261+
*loginp = login;
262+
- *login_changed = TRUE;
263+
- }
264+
- if(password_alloc) {
265+
- if(*passwordp)
266+
- free(*passwordp);
267+
- *passwordp = password;
268+
- *password_changed = TRUE;
269+
- }
270+
+ *passwordp = password;
271+
}
272+
else {
273+
- if(login_alloc)
274+
+ if(!specific_login)
275+
free(login);
276+
- if(password_alloc)
277+
- free(password);
278+
+ free(password);
279+
}
280+
fclose(file);
281+
}
282+
diff --git a/Utilities/cmcurl/lib/url.c b/Utilities/cmcurl/lib/url.c
283+
index 1ee38af..28ab55a 100644
284+
--- a/Utilities/cmcurl/lib/url.c
285+
+++ b/Utilities/cmcurl/lib/url.c
286+
@@ -2890,23 +2890,25 @@ static CURLcode override_login(struct Curl_easy *data,
287+
bool netrc_passwd_changed = FALSE;
288+
int ret;
289+
290+
- ret = Curl_parsenetrc(conn->host.name,
291+
- userp, passwdp,
292+
- &netrc_user_changed, &netrc_passwd_changed,
293+
- data->set.str[STRING_NETRC_FILE]);
294+
- if(ret > 0) {
295+
- infof(data, "Couldn't find host %s in the %s file; using defaults\n",
296+
- conn->host.name, data->set.str[STRING_NETRC_FILE]);
297+
- }
298+
- else if(ret < 0) {
299+
- return CURLE_OUT_OF_MEMORY;
300+
- }
301+
- else {
302+
- /* set bits.netrc TRUE to remember that we got the name from a .netrc
303+
- file, so that it is safe to use even if we followed a Location: to a
304+
- different host or similar. */
305+
- conn->bits.netrc = TRUE;
306+
- conn->bits.user_passwd = TRUE; /* enable user+password */
307+
+ if(!*passwdp) {
308+
+ ret = Curl_parsenetrc(conn->host.name,
309+
+ userp, passwdp,
310+
+ &netrc_user_changed, &netrc_passwd_changed,
311+
+ data->set.str[STRING_NETRC_FILE]);
312+
+ if(ret > 0) {
313+
+ infof(data, "Couldn't find host %s in the %s file; using defaults\n",
314+
+ conn->host.name, data->set.str[STRING_NETRC_FILE]);
315+
+ }
316+
+ else if(ret < 0) {
317+
+ return CURLE_OUT_OF_MEMORY;
318+
+ }
319+
+ else {
320+
+ /* set bits.netrc TRUE to remember that we got the name from a .netrc
321+
+ file, so that it is safe to use even if we followed a Location: to a
322+
+ different host or similar. */
323+
+ conn->bits.netrc = TRUE;
324+
+ conn->bits.user_passwd = TRUE; /* enable user+password */
325+
+ }
326+
}
327+
}
328+
329+
--
330+
2.45.2
331+

‎SPECS/cmake/cmake.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.21.4
5-
Release: 14%{?dist}
5+
Release: 15%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -32,6 +32,7 @@ Patch17: CVE-2023-46218.patch
3232
Patch18: CVE-2024-2398.patch
3333
Patch19: CVE-2024-28182.patch
3434
Patch20: CVE-2024-7264.patch
35+
Patch21: CVE-2024-11053.patch
3536
BuildRequires: bzip2
3637
BuildRequires: bzip2-devel
3738
BuildRequires: curl
@@ -97,6 +98,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
9798
%{_prefix}/doc/%{name}-*/*
9899

99100
%changelog
101+
* Tue Jan 14 2025 Henry Beberman <[email protected]> - 3.21.4-15
102+
- Patch vendored curl for CVE-2024-11053
103+
100104
* Thu Nov 21 2024 Vince Perri <[email protected]> - 3.21.4-14
101105
- Patch CVE-2024-2398 and CVE-2024-7264 (bundled curl)
102106
- Patch CVE-2024-28182 (bundled nghttp2)

‎toolkit/resources/manifests/package/toolchain_aarch64.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm
3030
chkconfig-1.20-4.cm2.aarch64.rpm
3131
chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm
3232
chkconfig-lang-1.20-4.cm2.aarch64.rpm
33-
cmake-3.21.4-14.cm2.aarch64.rpm
34-
cmake-debuginfo-3.21.4-14.cm2.aarch64.rpm
33+
cmake-3.21.4-15.cm2.aarch64.rpm
34+
cmake-debuginfo-3.21.4-15.cm2.aarch64.rpm
3535
coreutils-8.32-7.cm2.aarch64.rpm
3636
coreutils-debuginfo-8.32-7.cm2.aarch64.rpm
3737
coreutils-lang-8.32-7.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm
3131
chkconfig-1.20-4.cm2.x86_64.rpm
3232
chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm
3333
chkconfig-lang-1.20-4.cm2.x86_64.rpm
34-
cmake-3.21.4-14.cm2.x86_64.rpm
35-
cmake-debuginfo-3.21.4-14.cm2.x86_64.rpm
34+
cmake-3.21.4-15.cm2.x86_64.rpm
35+
cmake-debuginfo-3.21.4-15.cm2.x86_64.rpm
3636
coreutils-8.32-7.cm2.x86_64.rpm
3737
coreutils-debuginfo-8.32-7.cm2.x86_64.rpm
3838
coreutils-lang-8.32-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)