From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f44: Resolves: CVE-2026-8926 - password leak with netrc and user in URL Date: Fri, 31 Jul 2026 10:22:17 GMT Message-ID: <178549333744.1.2205291616354373859.rpms-curl-b0815da9f9b0@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f44 X-Git-Rev: b0815da9f9b01814a71976d69721c4803aefc7b8 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDQKQ29tbWl0IDogYjA4MTVkYTlmOWIwMTgxNGE3MTk3NmQ2OTcyMWM0ODAzYWVmYzdiOApB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wNy0z MFQxMjozNzowNSswMjowMApTdGF0cyAgOiArMTI5Ly0wIGluIDIgZmlsZShzKQpVUkwgICAgOiBo dHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2N1cmwvYy9iMDgxNWRhOWY5YjAxODE0 YTcxOTc2ZDY5NzIxYzQ4MDNhZWZjN2I4P2JyYW5jaD1mNDQKCkxvZzoKUmVzb2x2ZXM6IENWRS0y MDI2LTg5MjYgLSBwYXNzd29yZCBsZWFrIHdpdGggbmV0cmMgYW5kIHVzZXIgaW4gVVJMCgotLS0K ZGlmZiAtLWdpdCBhLzAwMDktY3VybC04LjE4LjAtQ1ZFLTIwMjYtODkyNi5wYXRjaCBiLzAwMDkt Y3VybC04LjE4LjAtQ1ZFLTIwMjYtODkyNi5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwLi4zZDQ4OGM0Ci0tLSAvZGV2L251bGwKKysrIGIvMDAwOS1jdXJsLTguMTguMC1D VkUtMjAyNi04OTI2LnBhdGNoCkBAIC0wLDAgKzEsMTI1IEBACitGcm9tIDc5MWNkNjE3ODE2NDMz NGYyNzA5ZTE0ZmVjNDQ0NWI0MTQ1NjgwMmQgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9t OiBTdGVmYW4gRWlzc2luZyA8c3RlZmFuQGVpc3Npbmcub3JnPgorRGF0ZTogRnJpLCAxNSBNYXkg MjAyNiAxMTo0NTo0OSArMDIwMAorU3ViamVjdDogW1BBVENIXSBuZXRyYzogc2Nhbm5lciByZWZh Y3RvcgorCitSZWZhY3RvciB0aGUgbmV0cmMgc2Nhbm5lci4gQWRkIHRlc3QgY2FzZSBmb3IgY2hl Y2tpbmcgdGhhdCB0aGUgbGFzdAorbWF0Y2hlZCBtYWNoaW5lIHdpdGggdW5tYXRjaGVkIGxvZ2lu IGRvZXMgbm90IHJldHVybiB0aGUgcGFzc3dvcmQgYXMKK3N1Y2Nlc3MgKHVuaXQxMzA0KS4KKwor Q2xvc2VzICMyMTYyNAorCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCA0YWUxZDdjYzI2NDNl NDc3M2ExMzYzOTVmMTJiYzAyZmM2ODY3ODU0KQorQ28tYXV0aG9yZWQtYnk6IEN1cnNvciA8Y3Vy c29yYWdlbnRAY3Vyc29yLmNvbT4KKy0tLQorIGxpYi9uZXRyYy5jICAgICAgICAgICB8IDE1ICsr KysrKysrKysrKysrLQorIHRlc3RzL3VuaXQvdW5pdDEzMDQuYyB8IDIyICsrKysrKysrKysrKysr KysrKystLS0KKyAyIGZpbGVzIGNoYW5nZWQsIDMzIGluc2VydGlvbnMoKyksIDQgZGVsZXRpb25z KC0pCisKK2RpZmYgLS1naXQgYS9saWIvbmV0cmMuYyBiL2xpYi9uZXRyYy5jCitpbmRleCAwNjc4 NzMzZDIyLi42YjVmNzI1MDU0IDEwMDY0NAorLS0tIGEvbGliL25ldHJjLmMKKysrKyBiL2xpYi9u ZXRyYy5jCitAQCAtMTIxLDYgKzEyMSw3IEBAIHN0YXRpYyBORVRSQ2NvZGUgcGFyc2VuZXRyYyhz dHJ1Y3Qgc3RvcmVfbmV0cmMgKnN0b3JlLAorICAgdW5zaWduZWQgY2hhciBmb3VuZCA9IDA7IC8q IGxvZ2luICsgcGFzc3dvcmQgZm91bmQgYml0cywgYXMgdGhleSBjYW4gY29tZSBpbgorICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGFueSBvcmRlciAqLworICAgYm9vbCBvdXJfbG9naW4g PSBGQUxTRTsgIC8qIGZvdW5kIG91ciBsb2dpbiBuYW1lICovCisrICBib29sIGxvZ2luX21pc21h dGNoID0gRkFMU0U7IC8qIGhvc3QgbWF0Y2hlZCBidXQgbG9naW4gZGlkIG5vdCAqLworICAgYm9v bCBkb25lID0gRkFMU0U7CisgICBjaGFyICpuZXRyY2J1ZmZlcjsKKyAgIHN0cnVjdCBkeW5idWYg dG9rZW47CitAQCAtMzAzLDE2ICszMDQsMjMgQEAgc3RhdGljIE5FVFJDY29kZSBwYXJzZW5ldHJj KHN0cnVjdCBzdG9yZV9uZXRyYyAqc3RvcmUsCisgICAgICAgICAgICAgZG9uZSA9IFRSVUU7Cisg ICAgICAgICAgICAgYnJlYWs7CisgICAgICAgICAgIH0KKysgICAgICAgICAgaWYoc3BlY2lmaWNf bG9naW4gJiYgIW91cl9sb2dpbiAmJiAoZm91bmQgJiBGT1VORF9MT0dJTikpCisrICAgICAgICAg ICAgbG9naW5fbWlzbWF0Y2ggPSBUUlVFOworICAgICAgICAgICBzdGF0ZSA9IEhPU1RGT1VORDsK KyAgICAgICAgICAga2V5d29yZCA9IE5PTkU7CisgICAgICAgICAgIGZvdW5kID0gMDsKKysgICAg ICAgICAgb3VyX2xvZ2luID0gRkFMU0U7CisgICAgICAgICAgIEN1cmxfc2FmZWZyZWUocGFzc3dv cmQpOworICAgICAgICAgICBpZighc3BlY2lmaWNfbG9naW4pCisgICAgICAgICAgICAgQ3VybF9z YWZlZnJlZShsb2dpbik7CisgICAgICAgICB9CisgICAgICAgICBlbHNlIGlmKGN1cmxfc3RyZXF1 YWwoImRlZmF1bHQiLCB0b2spKSB7CisrICAgICAgICAgIGlmKHNwZWNpZmljX2xvZ2luICYmICFv dXJfbG9naW4gJiYgKGZvdW5kICYgRk9VTkRfTE9HSU4pKQorKyAgICAgICAgICAgIGxvZ2luX21p c21hdGNoID0gVFJVRTsKKyAgICAgICAgICAgc3RhdGUgPSBIT1NUVkFMSUQ7CisgICAgICAgICAg IHJldGNvZGUgPSBORVRSQ19PSzsgLyogd2UgZGlkIGZpbmQgb3VyIGhvc3QgKi8KKysgICAgICAg ICAgZm91bmQgPSAwOworKyAgICAgICAgICBvdXJfbG9naW4gPSBGQUxTRTsKKyAgICAgICAgICAg Q3VybF9zYWZlZnJlZShwYXNzd29yZCk7CisgICAgICAgICAgIGlmKCFzcGVjaWZpY19sb2dpbikK KyAgICAgICAgICAgICBDdXJsX3NhZmVmcmVlKGxvZ2luKTsKK0BAIC0zMzksNyArMzQ3LDEyIEBA IHN0YXRpYyBORVRSQ2NvZGUgcGFyc2VuZXRyYyhzdHJ1Y3Qgc3RvcmVfbmV0cmMgKnN0b3JlLAor IG91dDoKKyAgIGN1cmx4X2R5bl9mcmVlKCZ0b2tlbik7CisgICBpZighcmV0Y29kZSkgeworLSAg ICBpZighcGFzc3dvcmQgJiYgb3VyX2xvZ2luKSB7CisrICAgIGlmKHNwZWNpZmljX2xvZ2luICYm ICFvdXJfbG9naW4gJiYKKysgICAgICAgKChmb3VuZCAmIEZPVU5EX0xPR0lOKSB8fCBsb2dpbl9t aXNtYXRjaCkpIHsKKysgICAgICAvKiBob3N0IG1hdGNoZWQsIGEgbG9naW4gd2FzIHByZXNlbnQg YnV0IGRpZCBub3QgbWF0Y2ggdGhlIHVzZXIgKi8KKysgICAgICByZXRjb2RlID0gTkVUUkNfTk9f TUFUQ0g7CisrICAgIH0KKysgICAgZWxzZSBpZighcGFzc3dvcmQgJiYgb3VyX2xvZ2luKSB7Cisg ICAgICAgLyogc3VjY2VzcyB3aXRob3V0IGEgcGFzc3dvcmQsIHNldCBhIGJsYW5rIG9uZSAqLwor ICAgICAgIHBhc3N3b3JkID0gY3VybHhfc3RyZHVwKCIiKTsKKyAgICAgICBpZighcGFzc3dvcmQp CitkaWZmIC0tZ2l0IGEvdGVzdHMvdW5pdC91bml0MTMwNC5jIGIvdGVzdHMvdW5pdC91bml0MTMw NC5jCitpbmRleCAzNDM4Yzk3MTA0Li5hN2RkOGEyM2QyIDEwMDY0NAorLS0tIGEvdGVzdHMvdW5p dC91bml0MTMwNC5jCisrKysgYi90ZXN0cy91bml0L3VuaXQxMzA0LmMKK0BAIC01OSw3ICs1OSw3 IEBAIHN0YXRpYyBDVVJMY29kZSB0ZXN0X3VuaXQxMzA0KGNvbnN0IGNoYXIgKmFyZykKKyAgIGxv Z2luID0gKGNoYXIgKilDVVJMX1VOQ09OU1QoIm1lIik7CisgICBDdXJsX25ldHJjX2luaXQoJnN0 b3JlKTsKKyAgIHJlc3VsdCA9IEN1cmxfcGFyc2VuZXRyYygmc3RvcmUsICJleGFtcGxlLmNvbSIs ICZsb2dpbiwgJnBhc3N3b3JkLCBhcmcpOworLSAgZmFpbF91bmxlc3MocmVzdWx0ID09IDAsICJI b3N0IHNob3VsZCBoYXZlIGJlZW4gZm91bmQiKTsKKysgIGZhaWxfdW5sZXNzKHJlc3VsdCA9PSAx LCAiZXhwZWN0ZWQgbm8gbWF0Y2giKTsKKyAgIGFib3J0X3VubGVzcyhwYXNzd29yZCA9PSBOVUxM LCAicGFzc3dvcmQgaXMgbm90IE5VTEwhIik7CisgICBDdXJsX25ldHJjX2NsZWFudXAoJnN0b3Jl KTsKKyAKK0BAIC04MCw3ICs4MCw3IEBAIHN0YXRpYyBDVVJMY29kZSB0ZXN0X3VuaXQxMzA0KGNv bnN0IGNoYXIgKmFyZykKKyAgIGxvZ2luID0gKGNoYXIgKilDVVJMX1VOQ09OU1QoImFkbWkiKTsg Lyogc3BlbGxjaGVja2VyOmRpc2FibGUtbGluZSAqLworICAgQ3VybF9uZXRyY19pbml0KCZzdG9y ZSk7CisgICByZXN1bHQgPSBDdXJsX3BhcnNlbmV0cmMoJnN0b3JlLCAiZXhhbXBsZS5jb20iLCAm bG9naW4sICZwYXNzd29yZCwgYXJnKTsKKy0gIGZhaWxfdW5sZXNzKHJlc3VsdCA9PSAwLCAiSG9z dCBzaG91bGQgaGF2ZSBiZWVuIGZvdW5kIik7CisrICBmYWlsX3VubGVzcyhyZXN1bHQgPT0gMSwg ImV4cGVjdGVkIG5vIG1hdGNoIik7CisgICBhYm9ydF91bmxlc3MocGFzc3dvcmQgPT0gTlVMTCwg InBhc3N3b3JkIGlzIG5vdCBOVUxMISIpOworICAgQ3VybF9uZXRyY19jbGVhbnVwKCZzdG9yZSk7 CisgCitAQCAtOTEsNyArOTEsNyBAQCBzdGF0aWMgQ1VSTGNvZGUgdGVzdF91bml0MTMwNChjb25z dCBjaGFyICphcmcpCisgICBsb2dpbiA9IChjaGFyICopQ1VSTF9VTkNPTlNUKCJhZG1pbm4iKTsK KyAgIEN1cmxfbmV0cmNfaW5pdCgmc3RvcmUpOworICAgcmVzdWx0ID0gQ3VybF9wYXJzZW5ldHJj KCZzdG9yZSwgImV4YW1wbGUuY29tIiwgJmxvZ2luLCAmcGFzc3dvcmQsIGFyZyk7CistICBmYWls X3VubGVzcyhyZXN1bHQgPT0gMCwgIkhvc3Qgc2hvdWxkIGhhdmUgYmVlbiBmb3VuZCIpOworKyAg ZmFpbF91bmxlc3MocmVzdWx0ID09IDEsICJleHBlY3RlZCBubyBtYXRjaCIpOworICAgYWJvcnRf dW5sZXNzKHBhc3N3b3JkID09IE5VTEwsICJwYXNzd29yZCBpcyBub3QgTlVMTCEiKTsKKyAgIEN1 cmxfbmV0cmNfY2xlYW51cCgmc3RvcmUpOworIAorQEAgLTE2Miw2ICsxNjIsMjIgQEAgc3RhdGlj IENVUkxjb2RlIHRlc3RfdW5pdDEzMDQoY29uc3QgY2hhciAqYXJnKQorICAgZmFpbF91bmxlc3Mo c3RybmNtcChsb2dpbiwgIm5vbmUiLCA0KSA9PSAwLCAibG9naW4gc2hvdWxkIGJlICdub25lJyIp OworICAgQ3VybF9uZXRyY19jbGVhbnVwKCZzdG9yZSk7CisgCisrICAvKgorKyAgICogVGVzdCBm b3IgdGhlIGxhc3QgaG9zdCB3aGVyZSB3ZSBkbyBub3Qgd2FudCB0byBzZWUgdGhlIHBhc3N3b3Jk CisrICAgKiBpZiB0aGUgbG9naW4gZG9lcyBub3QgbWF0Y2guCisrICAgKi8KKysgIGN1cmx4X2Zy ZWUocGFzc3dvcmQpOworKyAgcGFzc3dvcmQgPSBOVUxMOworKyAgY3VybHhfZnJlZShsb2dpbik7 CisrICBsb2dpbiA9IChjaGFyICopQ1VSTF9VTkNPTlNUKCJoaWxhcmlvdXMiKTsKKysgIEN1cmxf bmV0cmNfaW5pdCgmc3RvcmUpOworKyAgcmVzdWx0ID0gQ3VybF9wYXJzZW5ldHJjKCZzdG9yZSwg ImN1cmwuZXhhbXBsZS5jb20iLCAmbG9naW4sICZwYXNzd29yZCwgYXJnKTsKKysgIGZhaWxfdW5s ZXNzKHJlc3VsdCA9PSAxLCAiZXhwZWN0IG5vIG1hdGNoIik7CisrICBhYm9ydF91bmxlc3MocGFz c3dvcmQgPT0gTlVMTCwgInBhc3N3b3JkIG11c3QgYmUgTlVMTCIpOworKyAgQ3VybF9uZXRyY19j bGVhbnVwKCZzdG9yZSk7CisrCisrICBsb2dpbiA9IE5VTEw7CisrCisgICBVTklUVEVTVF9FTkQo dDEzMDRfc3RvcCgmcGFzc3dvcmQsICZsb2dpbikpCisgfQorIAorLS0gCisyLjU1LjAKKwoKZGlm ZiAtLWdpdCBhL2N1cmwuc3BlYyBiL2N1cmwuc3BlYwppbmRleCA5NGM1ZTNhLi5hOWZhMzg1IDEw MDY0NAotLS0gYS9jdXJsLnNwZWMKKysrIGIvY3VybC5zcGVjCkBAIC00OCw2ICs0OCw5IEBAIFBh dGNoMDA3OiAwMDA3LWN1cmwtOC4xOC4wLUNWRS0yMDI2LTg5MjQucGF0Y2gKICMgRml4IFNTSCBp bXByb3BlciBob3N0IHZhbGlkYXRpb24gKENWRS0yMDI2LTk1NDcpCiBQYXRjaDAwODogMDAwOC1j dXJsLTguMTguMC1DVkUtMjAyNi05NTQ3LnBhdGNoCiAKKyMgRml4IHBhc3N3b3JkIGxlYWsgd2l0 aCBuZXRyYyBhbmQgdXNlciBpbiBVUkwgKENWRS0yMDI2LTg5MjYpCitQYXRjaDAwOTogMDAwOS1j dXJsLTguMTguMC1DVkUtMjAyNi04OTI2LnBhdGNoCisKICMgcGF0Y2ggbWFraW5nIGxpYmN1cmwg bXVsdGlsaWIgcmVhZHkKIFBhdGNoMTAxOiAwMTAxLWN1cmwtNy4zMi4wLW11bHRpbGliLnBhdGNo CiAKQEAgLTQ3NCw2ICs0NzcsNyBAQCBybSAtZiAke1JQTV9CVUlMRF9ST09UfSV7X21hbmRpcn0v bWFuMS93Y3VybC4xKgogKiBXZWQgSnVsIDI5IDIwMjYgSmFuIE1hY2t1IDxqYW1hY2t1QHJlZGhh dC5jb20+IC0gOC4xOC4wLTgKIC0gRml4IHRyYWlsaW5nIGRvdCBkb21haW4gc3VwZXIgY29va2ll IChDVkUtMjAyNi04OTI0KQogLSBGaXggU1NIIGltcHJvcGVyIGhvc3QgdmFsaWRhdGlvbiAoQ1ZF LTIwMjYtOTU0NykKKy0gRml4IHBhc3N3b3JkIGxlYWsgd2l0aCBuZXRyYyBhbmQgdXNlciBpbiBV UkwgKENWRS0yMDI2LTg5MjYpCiAKICogTW9uIEp1bCAyMCAyMDI2IEphbiBNYWNrdSA8amFtYWNr dUByZWRoYXQuY29tPiAtIDguMTguMC03CiAtIGV4cGxpY2l0bHkgZGlzYWJsZSBIVFRQLzMgc3Vw cG9ydCBpbiB0aGUgbWluaW1hbCBidWlsZAo=