curl-8.9.1

[Douglas R. Reno]

New point version

This version also comes with another security fix.

[Tim Tassonis]

Fixes CVE-2024-7264

Bugfixes:

• cmake: detect libssh via pkg-config
• cmake: detect nettle when building with GnuTLS
• cmake: drop if(PKG_CONFIG_FOUND) guard for pkg_check_modules()
• configure: limit __builtin_available test to Darwin
• connect: fix connection shutdown for event based processing
• contrithanks.sh: use -F with -v to match lines as strings
• curl: more defensive socket code for --ip-tos
• CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
• CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
• example/multi-uv: remove the use of globals
• ftpserver.pl: make POP3 LIST serve content from the test file
• GHA/windows: increase timeout for vcpkg build step
• lib: survive some NULL input args
• macos: fix Apple SDK bug workaround for non-macOS targets
• misc: cleanup after removing years from copyright
• os400: build cli manual.
• os400: workaround an IBM ASCII run-time library bug
• RELEASE-PROCEDURE.md: remove the initial build step
• runtests: fold timing details with GHA, sync -r tflags
• tests: provide FTP directory contents in the test file
• tidy-up: URL updates
• TODO: thread-safe sharing
• transfer: speed limiting fix for 32bit systems
• vtls: avoid forward declaration in MultiSSL builds
• wolfSSL: allow wolfSSL's implementation of kyber to be used
• wolfssl: avoid calling get_cached_x509_store if store is uncachable
• wolfssl: CA store share fix
• x509asn1: unittests and fixes for gtime2str

[Douglas R. Reno]

ASN.1 date parser overread
==========================

Project curl Security Advisory, July 31st 2024 -
[Permalink](https://curl.se/docs/CVE-2024-7264.html)

VULNERABILITY
-------------

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area that is not
(purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents
getting returned to the application when
[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.

INFO
----

The ANS.1 parsing is done *after* a successful TLS handshake, which then also
means that the used TLS library has parsed the certificate. If the TLS library
rejects the bad date string, then it cannot reach and trigger libcurl's bug.
We can however not be sure that there are not circumstances in which the bad
data still gets parsed by libcurl.

This bug is considered a *C mistake* (likely to have been avoided had we not
been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2024-7264 to this issue.

CWE-125: Out-of-bounds Read

Severity: Low

AFFECTED VERSIONS
-----------------

The vulnerable code can only be reached when curl is built to use GnuTLS,
Schannel, Secure Transport or mbedTLS. Builds using other TLS backends are not
vulnerable.

- Affected versions: curl 7.32.0 to and including 8.9.0
- Not affected versions: curl < 7.32.0 and >= 8.9.1
- Introduced-in: https://github.com/curl/curl/commit/3a24cb7bc45

libcurl is used by many applications, but not always advertised as such!

This parser bug was actually introduced in curl 7.32.0 but was then used only
by the GSKit TLS backend which is no longer supported. The functionality was
later brought to other TLS backends in different versions, so this bug affects
curl built with different backends starting in different versions:

- GnuTLS since 7.42.0
- Schannel since 7.50.0
- Secure Transport since 7.79.0
- mbedTLS since 8.9.0

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/27959ecce75cdb2

Note that this fixing commit was a follow-up to this previous incomplete fix:
https://github.com/curl/curl/commit/3c914bc680155b321

RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

 A - Upgrade curl and libcurl to version 8.9.1

 B - Apply the patch to your version and rebuild

 C - Build your libcurl with an unaffected TLS backend

TIMELINE
---------

This issue was reported to the curl project on July 30, 2024. We contacted
distros@openwall on July 30, 2024.

curl 8.9.1 was released on July 31 2024 around 06:00 UTC, coordinated with
the publication of this advisory.

CREDITS
-------

- Reported-by: Dov Murik (Transmit Security)
- Patched-by: Daniel Stenberg
- Patched-by: Stefan Eissing

Thanks a lot!

[Douglas R. Reno]

Fixed at c1c63196e6806cbbdc711ade203b6a0d987c4a08

SA-12.1-084 issued