#8909 closed enhancement (fixed)
curl-7.53.1 (CVE-2017-2629)
| Reported by: | Owned by: | Douglas R. Reno | |
|---|---|---|---|
| Priority: | high | Milestone: | 8.1 |
| Component: | BOOK | Version: | SVN |
| Severity: | normal | Keywords: | |
| Cc: |
Description
New minor version.
Change History (13)
comment:1 by , 8 years ago
comment:2 by , 8 years ago
| Priority: | normal → high |
|---|---|
| Summary: | curl-7.53.0 → curl-7.53.0 (CVE-2017-2629) |
comment:3 by , 8 years ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:4 by , 8 years ago
| Summary: | curl-7.53.0 (CVE-2017-2629) → curl-7.53.1 (CVE-2017-2629) |
|---|
Now 7.53.1
Curl and libcurl 7.53.1 Public curl releases: 164 Command line options: 205 curl_easy_setopt() options: 244 Public functions in libcurl: 61 Contributors: 1507 This release includes the following bugfixes: o cyassl: fix typo o url: Improve CURLOPT_PROXY_CAPATH error handling [1] o urldata: include curl_sspi.h when Windows SSPI is enabled [2] o formdata: check for EOF when reading from stdin [3] o tests: Set CHARSET & LANG to UTF-8 in 1035, 2046 and 2047 [4] o url: Default the proxy CA bundle location to CURL_CA_BUNDLE [5] o rand: added missing #ifdef HAVE_FCNTL_H around fcntl.h header [6] This release includes the following known bugs: o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html) This release would not have looked like this without help, code, reports and advice from friends like these: Dan Fandrich, Daniel Stenberg, İsmail Dönmez, jveazey on github, Ray Satiro, Sergii Pylypenko, Shachaf Ben-Kiki, Viktor Szakáts, (8 contributors)
follow-up: 6 comment:5 by , 8 years ago
I'm asking the folks in #curl about this. Here's the problem:
TESTDONE: 12 tests out of 852 reported OK: 1%
You're seeing that right. 1% of tests passed with 7.53.1.
Here's the final output:
TESTDONE: 12 tests out of 852 reported OK: 1% TESTFAIL: These test cases failed: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 70 71 72 73 74 75 76 77 78 79 80 82 83 84 85 86 87 88 92 93 94 95 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 151 152 153 154 156 157 158 160 161 162 163 164 166 167 168 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 210 211 212 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 231 233 234 235 236 237 238 240 242 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 266 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 320 321 322 324 350 351 352 353 354 402 405 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 549 550 551 552 553 554 556 557 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 578 579 580 581 584 585 586 587 588 591 592 593 595 596 597 598 599 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 824 825 826 828 829 830 831 833 834 837 838 839 840 841 842 843 844 845 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 870 871 872 874 875 876 877 879 880 883 884 885 886 887 888 889 890 900 901 902 903 904 905 908 909 910 911 912 913 914 915 916 917 918 919 920 922 923 924 925 926 927 928 929 930 931 932 933 935 936 939 940 941 942 943 944 945 946 947 948 949 1000 1001 1002 1003 1005 1006 1007 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1098 1099 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1113 1114 1115 1116 1117 1118 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1133 1134 1137 1138 1141 1142 1143 1144 1145 1146 1200 1201 1202 1203 1204 1205 1206 1207 1208 1212 1213 1214 1216 1217 1218 1219 1220 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1245 1246 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1280 1281 1282 1283 1284 1285 1286 1314 1315 1317 1318 1319 1320 1321 1322 1325 1326 1327 1328 1329 1331 1332 1333 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1423 1424 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1511 1513 1514 1515 1516 1517 1520 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1900 1901 1902 1903 2000 2001 2002 2003 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2036 2039 2040 2045 2049 2050 2051 2052 2053 2054 2055 TESTDONE: 1073 tests were considered during 159 seconds.
I think there is something wrong upstream.
comment:6 by , 8 years ago
Replying to renodr:
I'm asking the folks in #curl about this. Here's the problem:
TESTDONE: 12 tests out of 852 reported OK: 1%
You're seeing that right. 1% of tests passed with 7.53.1.
[...] I think there is something wrong upstream.
Isn't it a bad interaction between openssl and valgrind again (just guessing)?
comment:7 by , 8 years ago
Pierre, Bruce and I were discussing that it might be valgrind related. I'm trying a couple things first. I do have mine setup to link to gnutls, or at least that's one of the things I tried. Last time this happened, I got more than 12 passes -- close to 60 passes
follow-up: 9 comment:8 by , 8 years ago
Alright, for future reference, in the event that this happens again. Rebuild glibc with debugging symbols as upstream told me to do.
With debugging symbols, I get the following results:
100% tests reported OK.
After further consultation with upstream, it appears that even with valgrind disabled, the tests still fail without the debugging symbols. That points to their suite relying on gdb and a few others that want debugging symbols to be present.
FWIW, I never strip my symbols because I'm going through classes where having them present for debugging is probably a good idea. However, since I used jhalfs this time around, they were not stripped.
Pierre, is there a way (if there isn't already, haven't checked) to avoid stripping libraries and binaries in jhalfs?
Proceeding with update.
follow-up: 10 comment:9 by , 8 years ago
Replying to renodr:
Pierre, is there a way (if there isn't already, haven't checked) to avoid stripping libraries and binaries in jhalfs?
Yes: in "Build Settings", do not tick "Strip Installed Binaries/LIbraries".
comment:10 by , 8 years ago
Replying to pierre.labastie:
Replying to renodr:
Pierre, is there a way (if there isn't already, haven't checked) to avoid stripping libraries and binaries in jhalfs?
Yes: in "Build Settings", do not tick "Strip Installed Binaries/LIbraries".
The default is to enable stripping. Maybe it'd be better to default to not stripping. What do you think? I'll post on ALFS-DISCUSS, in case users of jhalfs are monitoring...
comment:11 by , 8 years ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Pierre, I'm thinking not stripping is a good default. Makes lots of things a lot easier in terms of debugging. Let's take it to alfs-discuss
Either way:
Fixed at r18422
Hi friends! I'm thrilled to once again offer the world a brand new curl release. This time with a slightly larger amount of bug fixes than usual, including a security advisory (see separate mail following this.) - with contributions from no less than 47 individuals. As always, run over and get the source tarballs at https://curl.haxx.se/ Curl and libcurl 7.53.0 Public curl releases: 163 Command line options: 205 curl_easy_setopt() options: 244 Public functions in libcurl: 61 Contributors: 1506 This release includes the following changes: o unix_socket: added --abstract-unix-socket and CURLOPT_ABSTRACT_UNIX_SOCKET [25] o CURLOPT_BUFFERSIZE: support enlarging receive buffer [29] This release includes the following bugfixes: o CVE-2017-2629: make SSL_VERIFYSTATUS work again [64] o gnutls-random: check return code for failed random o openssl-random: check return code when asking for random o http: remove "Curl_http_done: called premature" message o cyassl: use time_t instead of long for timeout o build-wolfssl: Sync config with wolfSSL 3.10 o ftp-gss: check for init before use o configure: accept --with-libidn2 instead [1] o ftp: failure to resolve proxy should return that error code o curl.1: add three more exit codes o docs/ciphers: link to our own new page about ciphers o vtls: s/SSLEAY/OPENSSL - fixes multi_socket timeouts with openssl [2] o darwinssl: fix iOS build [3] o darwinssl: fix CFArrayRef leak [4] o cmake: use crypt32.lib when building with OpenSSL on windows [5] o curl_formadd.3: CURLFORM_CONTENTSLENGTH not needed when chunked [6] o digest_sspi: copy terminating NUL as well [7] o curl: fix --remote-time incorrect times on Windows [8] o curl.1: several updates and corrections [11] o content_encoding: change return code on a failure o curl.h: CURLE_FUNCTION_NOT_FOUND is no longer in use o docs: TCP_KEEPALIVE start and interval default to 60 [9] o darwinssl: --insecure overrides --cacert if both settings are in use [10] o TheArtOfHttpScripting: grammar o CIPHERS.md: document GSKit ciphers o wolfssl: support setting cipher list o wolfssl: display negotiated SSL version and cipher o lib506: fix build for Open Watcom [12] o asiohiper: improved socket handling [13] o examples: make the C++ examples follow our code style too o tests/sws: retry send() on EWOULDBLOCK [14] o cmake: Fix passing _WINSOCKAPI_ macro to compiler [15] o smtp: Fix STARTTLS denied error message o imap/pop3: don't print response character in STARTTLS denied messages [16] o rand: make it work without TLS backing [17] o url: fix parsing for when 'file' is the default protocol [18] o url: allow file://X:/path URLs on windows again [19] o gnutls: check for alpn and ocsp in configure [20] o IDN: Use TR46 'non-transitional' for toASCII translations [21] o url: Fix NO_PROXY env var to work properly with --proxy option [22] o CURLOPT_PREQUOTE.3: takes a struct curl_slist*, not a char* [23] o docs: Add note about libcurl copying strings to CURLOPT_* manpages [24] o curl: reset the easy handle at --next o --next docs: --trace and --trace-ascii are also global o --write-out docs: 'time_total' is not always shown with ms precision o http: print correct HTTP string in verbose output when using HTTP/2 o docs: improved language in README.md HISTORY.md CONTRIBUTE.md [26] o http2: disable server push if not requested [27] o nss: use the correct lock in nss_find_slot_by_name() o usercertinmem.c: improve the short description o CURLOPT_CONNECT_TO: Fix compile warnings o docs: non-blocking SSL handshake is now supported with NSS o *.rc: escape non-ASCII/non-UTF-8 character for clarity [28] o mbedTLS: fix multi interface non-blocking handshake [30] o PolarSSL: fix multi interface non-blocking handshake [31] o VC: remove the makefile.vc6 build infra [32] o telnet: fix windows compiler warnings [33] o cookies: do not assume a valid domain has a dot o polarssl: fix hangs o gnutls: disable TLS session tickets [34] o mbedtls: disable TLS session tickets [35] o mbedtls: implement CTR-DRBG and HAVEGE random generators [36] o openssl: Don't use certificate after transferring ownership [37] o cmake: Support curl --xattr when built with cmake [38] o OS400: Fix symbols [39] o docs: Add more HTTPS proxy documentation [40] o docs: use more HTTPS links [41] o cmdline-opts: Fixed build and test in out of source tree builds o CHANGES.0: removed o schannel: Remove incorrect SNI disabled message [42] o darwinssl: Avoid parsing certificates when not in verbose mode [43] o test552: Fix typos [44] o telnet: Fix typos [45] o transfer: only retry nobody-requests for HTTP [46] o http2: reset push header counter fixes crash [47] o nss: make FTPS work with --proxytunnel [48] o test1139: Added the --manual keyword since the manual is required o polarssl, mbedtls: Fix detection of pending data [49] o http_proxy: Fix tiny memory leak upon edge case connecting to proxy [50] o URL: only accept ";options" in SMTP/POP3/IMAP URL schemes [51] o curl.1: ftp.sunet.se is no longer an FTP mirror o tool_operate: Show HTTPS-Proxy options on CURLE_SSL_CACERT [52] o http2: fix memory-leak when denying push streams [53] o configure: Allow disabling pthreads, fall back on Win32 threads [54] o curl: fix typo in time condition warning message [55] o axtls: adapt to API changes [56] o tool_urlglob: Allow a glob range with the same start and stop [57] o winbuild: add note on auto-detection of MACHINE in Makefile.vc [58] o http: fix missing 'Content-Length: 0' while negotiating auth [59] o proxy: fix hostname resolution and IDN conversion [60] o docs: fix timeout handling in multi-uv example o digest_sspi: Fix nonce-count generation in HTTP digest [61] o sftp: improved checks for create dir failures [62] o smb: use getpid replacement for windows UWP builds [63] o digest_sspi: Handle 'stale=TRUE' directive in HTTP digest [65] This release includes the following known bugs: o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html) This release would not have looked like this without help, code, reports and advice from friends like these: Adam Langley, Alessandro Ghedini, Anatol Belski, Andreas Roth, Antoine Aubert, Cameron MacMinn, Chris Araman, Christian Weisgerber, Chungtsun Li, Dan Fandrich, Daniel Gustafsson, Daniel Romero, Daniel Stenberg, Dan Jacobson, Dominik Hölzl, Douglas R. Reno, Eramoto Masaya, Fahim Chandurwala, Frank Gevaerts, Gisle Vanem, Isaac Boukris, Jean Gressmann, Jiří Malák, Joel Depooter, John Kohl, jonrumsey on github, Kamil Dudka, Kim Minjoong, Kyselgov E.N, Marcus Hoffmann, Markus Westerlind, Max Khon, Michael Kaufmann, Mingliang Zhu, Nick Draffen, Nick Zitzmann, Patrick Monnerat, Peter Wu, Praveen Pvs, Ray Satiro, R. Dennis Steed, Richy Kim, Sean Burford, Simon Warta, tarek112 on github, Tim Rühsen, Viktor Szakáts, zelinchen on github, (47 contributors) Thanks! (and sorry if I forgot to mention someone) References to bug reports and discussions on issues: [1] = https://curl.haxx.se/mail/lib-2016-12/0110.html [2] = https://curl.haxx.se/bug/?i=1174 [3] = https://curl.haxx.se/bug/?i=1172 [4] = https://curl.haxx.se/bug/?i=1173 [5] = https://curl.haxx.se/bug/?i=1147 [6] = https://curl.haxx.se/bug/?i=1013 [7] = https://curl.haxx.se/bug/?i=1180 [8] = https://curl.haxx.se/bug/?i=1121 [9] = https://curl.haxx.se/mail/lib-2017-01/0000.html [10] = https://curl.haxx.se/bug/?i=1184 [11] = https://curl.haxx.se/bug/?i=1190 [12] = https://curl.haxx.se/bug/?i=1196 [13] = https://curl.haxx.se/bug/?i=1191 [14] = https://curl.haxx.se/mail/lib-2017-01/0009.html [15] = https://curl.haxx.se/bug/?i=1195 [16] = https://curl.haxx.se/bug/?i=1203 [17] = https://curl.haxx.se/mail/lib-2017-01/0055.html [18] = https://curl.haxx.se/bug/?i=1124 [19] = https://curl.haxx.se/bug/?i=1187 [20] = https://curl.haxx.se/bug/?i=1204 [21] = https://curl.haxx.se/bug/?i=1207 [22] = https://curl.haxx.se/bug/?i=1140 [23] = https://curl.haxx.se/bug/?i=1169 [24] = https://curl.haxx.se/bug/?i=1169 [25] = https://curl.haxx.se/bug/?i=1197 [26] = https://curl.haxx.se/bug/?i=1211 [27] = https://curl.haxx.se/bug/?i=1160 [28] = https://curl.haxx.se/bug/?i=1217 [29] = https://curl.haxx.se/bug/?i=1222 [30] = https://curl.haxx.se/bug/?i=1223 [31] = https://github.com/curl/curl/issues/1174#issuecomment-274018791 [32] = https://curl.haxx.se/bug/?i=1215 [33] = https://curl.haxx.se/bug/?i=1225 [34] = https://curl.haxx.se/bug/?i=1109 [35] = https://curl.haxx.se/bug/?i=1109 [36] = https://curl.haxx.se/bug/?i=1227 [37] = https://curl.haxx.se/bug/?i=1236 [38] = https://curl.haxx.se/bug/?i=1176 [39] = https://curl.haxx.se/bug/?i=1237 [40] = https://github.com/curl/curl/commit/cb4e2be [41] = https://curl.haxx.se/bug/?i=1247 [42] = https://curl.haxx.se/bug/?i=1240 [43] = https://curl.haxx.se/bug/?i=1246 [44] = https://curl.haxx.se/bug/?i=1245 [45] = https://curl.haxx.se/bug/?i=1245 [46] = https://curl.haxx.se/bug/?i=1243 [47] = https://curl.haxx.se/bug/?i=1249 [48] = https://bugzilla.redhat.com/1420327 [49] = https://curl.haxx.se/mail/lib-2017-02/0032.html [50] = https://curl.haxx.se/bug/?i=1255 [51] = https://curl.haxx.se/bug/?i=1252 [52] = https://curl.haxx.se/bug/?i=1258 [53] = https://curl.haxx.se/bug/?i=1229 [54] = https://curl.haxx.se/bug/?i=1260 [55] = https://curl.haxx.se/bug/?i=1263 [56] = https://curl.haxx.se/bug/?i=1220 [57] = https://curl.haxx.se/bug/?i=1238 [58] = https://curl.haxx.se/bug/?i=1265 [59] = https://curl.haxx.se/bug/?i=1242 [60] = https://curl.haxx.se/bug/?i=1248 [61] = https://curl.haxx.se/bug/?i=1251 [62] = https://curl.haxx.se/bug/?i=1269 [63] = https://github.com/Microsoft/vcpkg/blob/7676b8780db1e1e591c4fc7eba4f96f73c428cb4/ports/curl/0002_fix_uwp.patch [64] = https://curl.haxx.se/docs/adv_20170222.html [65] = https://github.com/curl/curl/issues/928