Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5675

curl: Incomplete patch for host name wildcard checking [9.6]

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: Generate New Ti...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • curl-7.76.1-32.el9
    • Yes
    • Critical
    • ZStream
    • 2
    • rhel-plumbers
    • ssg_core_services
    • 26
    • 2
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Plumbers Sprint 2, Plumbers Sprint 3
    • Approved Blocker
    • Bug Fix
    • Hide
      .The `curl` utility now correctly validates wildcard SSL/TLS certificates

      Before this update, an incomplete patch related to hostname wildcard certificate checking caused the certificate validation function (`Curl_cert_hostcheck`) to fail. Consequently, `curl` incorrectly failed to validate wildcard SSL/TLS certificates for certain hostname formats (for example, matching `*.e.llo` against `h.e.llo`), which could prevent secure HTTPS connections.

      With this update, the patch for hostname wildcard checking has been completed to ensure proper validation of wildcard patterns according to RFC standards.

      As a result, `curl` correctly matches wildcard certificates against all hostname formats, ensuring reliable and secure certificate validation for HTTPS connections.
      Show
      .The `curl` utility now correctly validates wildcard SSL/TLS certificates Before this update, an incomplete patch related to hostname wildcard certificate checking caused the certificate validation function (`Curl_cert_hostcheck`) to fail. Consequently, `curl` incorrectly failed to validate wildcard SSL/TLS certificates for certain hostname formats (for example, matching `*.e.llo` against `h.e.llo`), which could prevent secure HTTPS connections. With this update, the patch for hostname wildcard checking has been completed to ensure proper validation of wildcard patterns according to RFC standards. As a result, `curl` correctly matches wildcard certificates against all hostname formats, ensuring reliable and secure certificate validation for HTTPS connections.
    • In Progress
    • None
    • 57,005

      Description of problem:
      While testing a patch of BZ#2233497 using the upstream unit test 1397 I've discovered that the current patch may be incomplete – the unit1397 test fails without the patch attached.

      Version-Release number of selected component (if applicable):
      7.76.1-23.el9_2.2 (rhel-9.2)
      7.76.1-26 (rhel-9)
      7.76.1-23.el9_2.2 (rhel-8.8)

      How reproducible:
      Always

      Steps to Reproduce:
      1. Build curl with --enable-debug (triggers unit testing)
      2. Wait for unit test 1397 to run.
      3. Inspect build log.

      Actual results:

      test 1397...[Curl_cert_hostcheck unit tests]
      ../libtool --mode=execute /usr/bin/valgrind --tool=memcheck --quiet --leak-check=yes --suppressions=../../tests/valgrind.supp --num-callers=16 --log-file=log/valgrind1397 ./unit/unit1397 - >log/stdout1397 2>log/stderr1397
      CMD (1536): ../libtool --mode=execute /usr/bin/valgrind --tool=memcheck --quiet --leak-check=yes --suppressions=../../tests/valgrind.supp --num-callers=16 --log-file=log/valgrind1397 ./unit/unit1397 - >log/stdout1397 2>log/stderr1397
      unit1397 returned 6, when expecting 0
      exit FAILED
      == Contents of files in the log/ dir after test 1397
      === Start of file commands.log
      ../libtool --mode=execute /usr/bin/valgrind --tool=memcheck --quiet --leak-check=yes --suppressions=../../tests/valgrind.supp --num-callers=16 --log-file=log/valgrind1397 ./unit/unit1397 - >log/stdout1397 2>log/stderr1397
      === End of file commands.log
      === Start of file ftpserver.cmd
      Testnum 1397
      === End of file ftpserver.cmd
      === Start of file stderr1397
      URL: -
      HOST: h.e.llo.
      PTRN: *.e.llo
      did NOT MATCH
      HOST: *.e.llo.
      PTRN: *.e.llo
      did NOT MATCH
      HOST: ************.e.llo.
      PTRN: *.e.llo
      did NOT MATCH
      HOST: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.e.llo.
      PTRN: *.e.llo
      did NOT MATCH
      HOST: ��.e.llo.
      PTRN: *.e.llo
      did NOT MATCH
      HOST: h.e.llo
      PTRN: *.e.llo.
      did NOT MATCH
      === End of file stderr1397

      Expected results:
      Test passes.

      Additional info:

              jmigacz@redhat.com Jacek Migacz
              rhn-support-sbroz Stepan Broz
              Jacek Migacz Jacek Migacz
              Daniel Rusek Daniel Rusek
              Michal Stubna Michal Stubna
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

                Created:
                Updated: