From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f43: Resolves: CVE-2026-8926 - password leak with netrc and user in URL Date: Tue, 04 Aug 2026 07:09:04 GMT Message-ID: <178582734444.1.11117680720888758363.rpms-curl-e08d6793abe5@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f43 X-Git-Rev: e08d6793abe55e9a4cd3c63a56525b75e66b3bd7 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDMKQ29tbWl0IDogZTA4ZDY3OTNhYmU1NWU5YTRjZDNjNjNhNTY1MjViNzVlNjZiM2JkNwpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0w M1QxNDoyNzo1OSswMjowMApTdGF0cyAgOiArMTI5Ly0wIGluIDIgZmlsZShzKQpVUkwgICAgOiBo dHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2N1cmwvYy9lMDhkNjc5M2FiZTU1ZTlh NGNkM2M2M2E1NjUyNWI3NWU2NmIzYmQ3P2JyYW5jaD1mNDMKCkxvZzoKUmVzb2x2ZXM6IENWRS0y MDI2LTg5MjYgLSBwYXNzd29yZCBsZWFrIHdpdGggbmV0cmMgYW5kIHVzZXIgaW4gVVJMCgotLS0K ZGlmZiAtLWdpdCBhLzAwMTAtY3VybC04LjE1LjAtQ1ZFLTIwMjYtODkyNi5wYXRjaCBiLzAwMTAt Y3VybC04LjE1LjAtQ1ZFLTIwMjYtODkyNi5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwLi5kMmEzYWExCi0tLSAvZGV2L251bGwKKysrIGIvMDAxMC1jdXJsLTguMTUuMC1D VkUtMjAyNi04OTI2LnBhdGNoCkBAIC0wLDAgKzEsMTI1IEBACitGcm9tIDlmYjAzYjdiYjE0OTQz YzJkYzk5ZDAxNTNhOTIyODI2ZWRkNDg4NzkgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9t OiBTdGVmYW4gRWlzc2luZyA8c3RlZmFuQGVpc3Npbmcub3JnPgorRGF0ZTogTW9uLCAzIEF1ZyAy MDI2IDEyOjU2OjE2ICswMjAwCitTdWJqZWN0OiBbUEFUQ0ggMy81XSBuZXRyYzogc2Nhbm5lciBy ZWZhY3RvcgorCitSZWZhY3RvciB0aGUgbmV0cmMgc2Nhbm5lci4gQWRkIHRlc3QgY2FzZSBmb3Ig Y2hlY2tpbmcgdGhhdCB0aGUgbGFzdAorbWF0Y2hlZCBtYWNoaW5lIHdpdGggdW5tYXRjaGVkIGxv Z2luIGRvZXMgbm90IHJldHVybiB0aGUgcGFzc3dvcmQgYXMKK3N1Y2Nlc3MgKHVuaXQxMzA0KS4K KworQ2xvc2VzICMyMTYyNAorCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCA0YWUxZDdjYzI2 NDNlNDc3M2ExMzYzOTVmMTJiYzAyZmM2ODY3ODU0KQorLS0tCisgbGliL25ldHJjLmMgICAgICAg ICAgIHwgMTUgKysrKysrKysrKysrKystCisgdGVzdHMvdW5pdC91bml0MTMwNC5jIHwgMjMgKysr KysrKysrKysrKysrKysrKystLS0KKyAyIGZpbGVzIGNoYW5nZWQsIDM0IGluc2VydGlvbnMoKyks IDQgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1naXQgYS9saWIvbmV0cmMuYyBiL2xpYi9uZXRyYy5j CitpbmRleCBiZjUzZmMwMWUxLi5lMGYwMzQwZDUwIDEwMDY0NAorLS0tIGEvbGliL25ldHJjLmMK KysrKyBiL2xpYi9uZXRyYy5jCitAQCAtMTIxLDYgKzEyMSw3IEBAIHN0YXRpYyBORVRSQ2NvZGUg cGFyc2VuZXRyYyhzdHJ1Y3Qgc3RvcmVfbmV0cmMgKnN0b3JlLAorICAgdW5zaWduZWQgY2hhciBm b3VuZCA9IDA7IC8qIGxvZ2luICsgcGFzc3dvcmQgZm91bmQgYml0cywgYXMgdGhleSBjYW4gY29t ZSBpbgorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFueSBvcmRlciAqLworICAgYm9v bCBvdXJfbG9naW4gPSBGQUxTRTsgIC8qIGZvdW5kIG91ciBsb2dpbiBuYW1lICovCisrICBib29s IGxvZ2luX21pc21hdGNoID0gRkFMU0U7IC8qIGhvc3QgbWF0Y2hlZCBidXQgbG9naW4gZGlkIG5v dCAqLworICAgYm9vbCBkb25lID0gRkFMU0U7CisgICBjaGFyICpuZXRyY2J1ZmZlcjsKKyAgIHN0 cnVjdCBkeW5idWYgdG9rZW47CitAQCAtMzAzLDE2ICszMDQsMjMgQEAgc3RhdGljIE5FVFJDY29k ZSBwYXJzZW5ldHJjKHN0cnVjdCBzdG9yZV9uZXRyYyAqc3RvcmUsCisgICAgICAgICAgICAgZG9u ZSA9IFRSVUU7CisgICAgICAgICAgICAgYnJlYWs7CisgICAgICAgICAgIH0KKysgICAgICAgICAg aWYoc3BlY2lmaWNfbG9naW4gJiYgIW91cl9sb2dpbiAmJiAoZm91bmQgJiBGT1VORF9MT0dJTikp CisrICAgICAgICAgICAgbG9naW5fbWlzbWF0Y2ggPSBUUlVFOworICAgICAgICAgICBzdGF0ZSA9 IEhPU1RGT1VORDsKKyAgICAgICAgICAga2V5d29yZCA9IE5PTkU7CisgICAgICAgICAgIGZvdW5k ID0gMDsKKysgICAgICAgICAgb3VyX2xvZ2luID0gRkFMU0U7CisgICAgICAgICAgIEN1cmxfc2Fm ZWZyZWUocGFzc3dvcmQpOworICAgICAgICAgICBpZighc3BlY2lmaWNfbG9naW4pCisgICAgICAg ICAgICAgQ3VybF9zYWZlZnJlZShsb2dpbik7CisgICAgICAgICB9CisgICAgICAgICBlbHNlIGlm KGN1cmxfc3RyZXF1YWwoImRlZmF1bHQiLCB0b2spKSB7CisrICAgICAgICAgIGlmKHNwZWNpZmlj X2xvZ2luICYmICFvdXJfbG9naW4gJiYgKGZvdW5kICYgRk9VTkRfTE9HSU4pKQorKyAgICAgICAg ICAgIGxvZ2luX21pc21hdGNoID0gVFJVRTsKKyAgICAgICAgICAgc3RhdGUgPSBIT1NUVkFMSUQ7 CisgICAgICAgICAgIHJldGNvZGUgPSBORVRSQ19PSzsgLyogd2UgZGlkIGZpbmQgb3VyIGhvc3Qg Ki8KKysgICAgICAgICAgZm91bmQgPSAwOworKyAgICAgICAgICBvdXJfbG9naW4gPSBGQUxTRTsK KyAgICAgICAgICAgQ3VybF9zYWZlZnJlZShwYXNzd29yZCk7CisgICAgICAgICAgIGlmKCFzcGVj aWZpY19sb2dpbikKKyAgICAgICAgICAgICBDdXJsX3NhZmVmcmVlKGxvZ2luKTsKK0BAIC0zMzks NyArMzQ3LDEyIEBAIHN0YXRpYyBORVRSQ2NvZGUgcGFyc2VuZXRyYyhzdHJ1Y3Qgc3RvcmVfbmV0 cmMgKnN0b3JlLAorIG91dDoKKyAgIGN1cmx4X2R5bl9mcmVlKCZ0b2tlbik7CisgICBpZighcmV0 Y29kZSkgeworLSAgICBpZighcGFzc3dvcmQgJiYgb3VyX2xvZ2luKSB7CisrICAgIGlmKHNwZWNp ZmljX2xvZ2luICYmICFvdXJfbG9naW4gJiYKKysgICAgICAgKChmb3VuZCAmIEZPVU5EX0xPR0lO KSB8fCBsb2dpbl9taXNtYXRjaCkpIHsKKysgICAgICAvKiBob3N0IG1hdGNoZWQsIGEgbG9naW4g d2FzIHByZXNlbnQgYnV0IGRpZCBub3QgbWF0Y2ggdGhlIHVzZXIgKi8KKysgICAgICByZXRjb2Rl ID0gTkVUUkNfTk9fTUFUQ0g7CisrICAgIH0KKysgICAgZWxzZSBpZighcGFzc3dvcmQgJiYgb3Vy X2xvZ2luKSB7CisgICAgICAgLyogc3VjY2VzcyB3aXRob3V0IGEgcGFzc3dvcmQsIHNldCBhIGJs YW5rIG9uZSAqLworICAgICAgIHBhc3N3b3JkID0gc3RyZHVwKCIiKTsKKyAgICAgICBpZighcGFz c3dvcmQpCitkaWZmIC0tZ2l0IGEvdGVzdHMvdW5pdC91bml0MTMwNC5jIGIvdGVzdHMvdW5pdC91 bml0MTMwNC5jCitpbmRleCAwZDdmMDRmOWRlLi5lNjkxY2FkZjMyIDEwMDY0NAorLS0tIGEvdGVz dHMvdW5pdC91bml0MTMwNC5jCisrKysgYi90ZXN0cy91bml0L3VuaXQxMzA0LmMKK0BAIC02MSw3 ICs2MSw3IEBAIHN0YXRpYyBDVVJMY29kZSB0ZXN0X3VuaXQxMzA0KGNoYXIgKmFyZykKKyAgIEN1 cmxfbmV0cmNfaW5pdCgmc3RvcmUpOworICAgcmVzdWx0ID0gQ3VybF9wYXJzZW5ldHJjKCZzdG9y ZSwKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZXhhbXBsZS5jb20iLCAmbG9naW4sICZw YXNzd29yZCwgYXJnKTsKKy0gIGZhaWxfdW5sZXNzKHJlc3VsdCA9PSAwLCAiSG9zdCBzaG91bGQg aGF2ZSBiZWVuIGZvdW5kIik7CisrICBmYWlsX3VubGVzcyhyZXN1bHQgPT0gMSwgImV4cGVjdGVk IG5vIG1hdGNoIik7CisgICBhYm9ydF91bmxlc3MocGFzc3dvcmQgPT0gTlVMTCwgInBhc3N3b3Jk IGlzIG5vdCBOVUxMISIpOworICAgQ3VybF9uZXRyY19jbGVhbnVwKCZzdG9yZSk7CisgCitAQCAt ODQsNyArODQsNyBAQCBzdGF0aWMgQ1VSTGNvZGUgdGVzdF91bml0MTMwNChjaGFyICphcmcpCisg ICBDdXJsX25ldHJjX2luaXQoJnN0b3JlKTsKKyAgIHJlc3VsdCA9IEN1cmxfcGFyc2VuZXRyYygm c3RvcmUsCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgImV4YW1wbGUuY29tIiwgJmxvZ2lu LCAmcGFzc3dvcmQsIGFyZyk7CistICBmYWlsX3VubGVzcyhyZXN1bHQgPT0gMCwgIkhvc3Qgc2hv dWxkIGhhdmUgYmVlbiBmb3VuZCIpOworKyAgZmFpbF91bmxlc3MocmVzdWx0ID09IDEsICJleHBl Y3RlZCBubyBtYXRjaCIpOworICAgYWJvcnRfdW5sZXNzKHBhc3N3b3JkID09IE5VTEwsICJwYXNz d29yZCBpcyBub3QgTlVMTCEiKTsKKyAgIEN1cmxfbmV0cmNfY2xlYW51cCgmc3RvcmUpOworIAor QEAgLTk2LDcgKzk2LDcgQEAgc3RhdGljIENVUkxjb2RlIHRlc3RfdW5pdDEzMDQoY2hhciAqYXJn KQorICAgQ3VybF9uZXRyY19pbml0KCZzdG9yZSk7CisgICByZXN1bHQgPSBDdXJsX3BhcnNlbmV0 cmMoJnN0b3JlLAorICAgICAgICAgICAgICAgICAgICAgICAgICAgICJleGFtcGxlLmNvbSIsICZs b2dpbiwgJnBhc3N3b3JkLCBhcmcpOworLSAgZmFpbF91bmxlc3MocmVzdWx0ID09IDAsICJIb3N0 IHNob3VsZCBoYXZlIGJlZW4gZm91bmQiKTsKKysgIGZhaWxfdW5sZXNzKHJlc3VsdCA9PSAxLCAi ZXhwZWN0ZWQgbm8gbWF0Y2giKTsKKyAgIGFib3J0X3VubGVzcyhwYXNzd29yZCA9PSBOVUxMLCAi cGFzc3dvcmQgaXMgbm90IE5VTEwhIik7CisgICBDdXJsX25ldHJjX2NsZWFudXAoJnN0b3JlKTsK KyAKK0BAIC0xNzMsNiArMTczLDIzIEBAIHN0YXRpYyBDVVJMY29kZSB0ZXN0X3VuaXQxMzA0KGNo YXIgKmFyZykKKyAgIGZhaWxfdW5sZXNzKHN0cm5jbXAobG9naW4sICJub25lIiwgNCkgPT0gMCwg ImxvZ2luIHNob3VsZCBiZSAnbm9uZSciKTsKKyAgIEN1cmxfbmV0cmNfY2xlYW51cCgmc3RvcmUp OworIAorKyAgLyoKKysgICAqIFRlc3QgZm9yIHRoZSBsYXN0IGhvc3Qgd2hlcmUgd2UgZG8gbm90 IHdhbnQgdG8gc2VlIHRoZSBwYXNzd29yZAorKyAgICogaWYgdGhlIGxvZ2luIGRvZXMgbm90IG1h dGNoLgorKyAgICovCisrICBmcmVlKHBhc3N3b3JkKTsKKysgIHBhc3N3b3JkID0gTlVMTDsKKysg IGZyZWUobG9naW4pOworKyAgbG9naW4gPSAoY2hhciAqKUNVUkxfVU5DT05TVCgiaGlsYXJpb3Vz Iik7CisrICBDdXJsX25ldHJjX2luaXQoJnN0b3JlKTsKKysgIHJlc3VsdCA9IEN1cmxfcGFyc2Vu ZXRyYygmc3RvcmUsCisrICAgICAgICAgICAgICAgICAgICAgICAgICAgImN1cmwuZXhhbXBsZS5j b20iLCAmbG9naW4sICZwYXNzd29yZCwgYXJnKTsKKysgIGZhaWxfdW5sZXNzKHJlc3VsdCA9PSAx LCAiZXhwZWN0IG5vIG1hdGNoIik7CisrICBhYm9ydF91bmxlc3MocGFzc3dvcmQgPT0gTlVMTCwg InBhc3N3b3JkIG11c3QgYmUgTlVMTCIpOworKyAgQ3VybF9uZXRyY19jbGVhbnVwKCZzdG9yZSk7 CisrCisrICBsb2dpbiA9IE5VTEw7CisrCisgICBVTklUVEVTVF9FTkQodDEzMDRfc3RvcCgmcGFz c3dvcmQsICZsb2dpbikpCisgfQorIAorLS0gCisyLjU1LjAKKwoKZGlmZiAtLWdpdCBhL2N1cmwu c3BlYyBiL2N1cmwuc3BlYwppbmRleCA0Nzc4NWM2Li5mYmM4YjUzIDEwMDY0NAotLS0gYS9jdXJs LnNwZWMKKysrIGIvY3VybC5zcGVjCkBAIC00Myw2ICs0Myw5IEBAIFBhdGNoMDA4OiAwMDA4LWN1 cmwtOC4xNS4wLUNWRS0yMDI2LTcxNjgucGF0Y2gKICMgZml4IGNyb3NzLW9yaWdpbiBEaWdlc3Qg YXV0aCBzdGF0ZSBsZWFrIChDVkUtMjAyNi0xMTg1NikKIFBhdGNoMDA5OiAwMDA5LWN1cmwtOC4x NS4wLUNWRS0yMDI2LTExODU2LnBhdGNoCiAKKyMgZml4IHBhc3N3b3JkIGxlYWsgd2l0aCBuZXRy YyBhbmQgdXNlciBpbiBVUkwgKENWRS0yMDI2LTg5MjYpCitQYXRjaDAxMDogMDAxMC1jdXJsLTgu MTUuMC1DVkUtMjAyNi04OTI2LnBhdGNoCisKICMgcGF0Y2ggbWFraW5nIGxpYmN1cmwgbXVsdGls aWIgcmVhZHkKIFBhdGNoMTAxOiAwMTAxLWN1cmwtNy4zMi4wLW11bHRpbGliLnBhdGNoCiAKQEAg LTQ0NSw2ICs0NDgsNyBAQCBybSAtZiAke1JQTV9CVUlMRF9ST09UfSV7X21hbmRpcn0vbWFuMS93 Y3VybC4xKgogKiBNb24gQXVnIDAzIDIwMjYgSmFuIE1hY2t1IDxqYW1hY2t1QHJlZGhhdC5jb20+ IC0gOC4xNS4wLTgKIC0gZml4IGNyb3NzLXByb3h5IERpZ2VzdCBhdXRoIHN0YXRlIGxlYWsgKENW RS0yMDI2LTcxNjgpCiAtIGZpeCBjcm9zcy1vcmlnaW4gRGlnZXN0IGF1dGggc3RhdGUgbGVhayAo Q1ZFLTIwMjYtMTE4NTYpCistIGZpeCBwYXNzd29yZCBsZWFrIHdpdGggbmV0cmMgYW5kIHVzZXIg aW4gVVJMIChDVkUtMjAyNi04OTI2KQogCiAqIE1vbiBNYXkgMTEgMjAyNiBKYW4gTWFja3UgPGph bWFja3VAcmVkaGF0LmNvbT4gLSA4LjE1LjAtNwogLSBmaXggT3V0IG9mIGJvdW5kcyByZWFkIGZv ciBjb29raWUgcGF0aCAoQ1ZFLTIwMjUtOTA4NikK