public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/curl] f43: Resolves: CVE-2026-12064 - proto-default skips SSH verification
@ 2026-08-27 15:01 Jan Macku
0 siblings, 0 replies; only message in thread
From: Jan Macku @ 2026-08-27 15:01 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/curl
Branch : f43
Commit : 8cf6fb688b14b97e142478c17f34a6ee67d00fe5
Author : Jan Macku <jamacku@redhat.com>
Date : 2026-08-26T16:03:54+02:00
Stats : +263/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/curl/c/8cf6fb688b14b97e142478c17f34a6ee67d00fe5?branch=f43
Log:
Resolves: CVE-2026-12064 - proto-default skips SSH verification
---
diff --git a/0013-curl-8.15.0-CVE-2026-12064.patch b/0013-curl-8.15.0-CVE-2026-12064.patch
new file mode 100644
index 0000000..c4af9d5
--- /dev/null
+++ b/0013-curl-8.15.0-CVE-2026-12064.patch
@@ -0,0 +1,256 @@
+From a9223d620c41600e07ff65c4feaa6885bcdc6bdd Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 12 Jun 2026 09:01:22 +0200
+Subject: [PATCH] config2setopts: use default protocol properly
+
+Verified by test 1724, 1725 and 2036
+
+Closes #21983
+
+(cherry picked from commit ab3bb8cd8be8f9d4acb97da0418abc279182041e)
+---
+ docs/cmdline-opts/proto-default.md | 6 +++-
+ src/config2setopts.c | 41 ++++++++++++++++-------
+ tests/data/Makefile.am | 4 +--
+ tests/data/test1724 | 53 ++++++++++++++++++++++++++++++
+ tests/data/test1725 | 29 ++++++++++++++++
+ tests/data/test2036 | 26 +++++++++++++++
+ 6 files changed, 144 insertions(+), 15 deletions(-)
+ create mode 100644 tests/data/test1724
+ create mode 100644 tests/data/test1725
+ create mode 100644 tests/data/test2036
+
+diff --git a/docs/cmdline-opts/proto-default.md b/docs/cmdline-opts/proto-default.md
+index 209e5cdc83..903fac73a5 100644
+--- a/docs/cmdline-opts/proto-default.md
++++ b/docs/cmdline-opts/proto-default.md
+@@ -16,7 +16,8 @@ Example:
+
+ # `--proto-default`
+
+-Use *protocol* for any provided URL missing a scheme.
++Use *protocol* for any provided URL missing a scheme. The case-insensitive
++name should be given without any `://` suffix.
+
+ An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*.
+
+@@ -24,3 +25,6 @@ This option does not change the default proxy protocol (http).
+
+ Without this option set, curl guesses protocol based on the hostname, see
+ --url for details.
++
++The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to
++be used explicitly in the URL.
+diff --git a/src/config2setopts.c b/src/config2setopts.c
+index 8e4af65bae..6b6568b7b3 100644
+--- a/src/config2setopts.c
++++ b/src/config2setopts.c
+@@ -138,15 +138,31 @@ static CURLcode url_proto_and_rewrite(char **url,
+ DEBUGASSERT(url && *url);
+ if(uh) {
+ char *schemep = NULL;
+- if(!curl_url_set(uh, CURLUPART_URL, *url,
+- CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) &&
+- !curl_url_get(uh, CURLUPART_SCHEME, &schemep,
+- CURLU_DEFAULT_SCHEME)) {
+-#ifdef CURL_DISABLE_IPFS
+- (void)config;
+-#else
+- if(curl_strequal(schemep, proto_ipfs) ||
+- curl_strequal(schemep, proto_ipns)) {
++ CURLUcode uc =
++ curl_url_set(uh, CURLUPART_URL, *url,
++ CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
++ if(!uc) {
++ if(config->proto_default) {
++ /* when a default proto is requested, do not guess */
++ uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
++ CURLU_NO_GUESS_SCHEME);
++ if(uc == CURLUE_NO_SCHEME) {
++ /* use the default */
++ proto = proto_token(config->proto_default);
++ if(proto)
++ uc = CURLUE_OK;
++ }
++ }
++ else {
++ uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
++ CURLU_DEFAULT_SCHEME);
++ }
++ if(schemep)
++ proto = proto_token(schemep);
++#ifndef CURL_DISABLE_IPFS
++ if(!uc &&
++ (curl_strequal(schemep, proto_ipfs) ||
++ curl_strequal(schemep, proto_ipns))) {
+ result = ipfs_url_rewrite(uh, schemep, url, config);
+ /* short-circuit proto_token, we know it is ipfs or ipns */
+ if(curl_strequal(schemep, proto_ipfs))
+@@ -156,12 +172,13 @@ static CURLcode url_proto_and_rewrite(char **url,
+ if(result)
+ config->synthetic_error = TRUE;
+ }
+- else
+ #endif /* !CURL_DISABLE_IPFS */
+- proto = proto_token(schemep);
+-
++ if(uc == CURLUE_OUT_OF_MEMORY)
++ result = CURLE_OUT_OF_MEMORY;
+ curl_free(schemep);
+ }
++ else if(uc == CURLUE_OUT_OF_MEMORY)
++ result = CURLE_OUT_OF_MEMORY;
+ curl_url_cleanup(uh);
+ }
+ else
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index b789c9f009..c1c25f56cc 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -228,7 +228,7 @@ test1670 test1671 \
+ test1680 test1681 test1682 test1683 test1686 \
+ \
+ test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
+-test1708 test1709 test1710 \
++test1708 test1709 test1710 test1724 test1725 \
+ \
+ test1800 test1801 test1850 \
+ \
+@@ -246,7 +246,7 @@ test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
+ \
+ test2023 \
+ test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+-test2032 test2033 test2034 test2035 test2037 test2038 test2039 \
++test2032 test2033 test2034 test2035 test2036 test2037 test2038 test2039 \
+ test2040 test2041 test2042 test2043 test2044 test2045 test2046 test2047 \
+ test2048 test2049 test2050 test2051 test2052 test2053 test2054 test2055 \
+ test2056 test2057 test2058 test2059 test2060 test2061 test2062 test2063 \
+diff --git a/tests/data/test1724 b/tests/data/test1724
+new file mode 100644
+index 0000000000..3cd328e39c
+--- /dev/null
++++ b/tests/data/test1724
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++IPFS
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
++ETag: "21025-dc7-39462498"
++Accept-Ranges: bytes
++Content-Length: 21
++Connection: close
++Content-Type: text/plain
++Funny-head: yesyes
++
++Hello curl from IPFS
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++ipfs
++</features>
++<server>
++http
++</server>
++<name>
++IPFS with --proto-default HTTP
++</name>
++<command>
++--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test1725 b/tests/data/test1725
+new file mode 100644
+index 0000000000..2a882c791d
+--- /dev/null
++++ b/tests/data/test1725
+@@ -0,0 +1,29 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++SCP
++server key check
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++scp
++</server>
++<name>
++SCP incorrect host key with --proto-default SCP
++</name>
++<command>
++--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<errorcode>
++60
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2036 b/tests/data/test2036
+new file mode 100644
+index 0000000000..b017a71abc
+--- /dev/null
++++ b/tests/data/test2036
+@@ -0,0 +1,26 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++--proto-default
++</keywords>
++</info>
++
++# Client-side
++<client>
++<name>
++Attempt to set a default protocol with :// suffix
++</name>
++<command>
++--proto-default https://
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++# CURLE_UNSUPPORTED_PROTOCOL is error code 1
++<errorcode>
++1
++</errorcode>
++</verify>
++</testcase>
+--
+2.55.0
+
diff --git a/curl.spec b/curl.spec
index 61a39ee..725f60c 100644
--- a/curl.spec
+++ b/curl.spec
@@ -7,7 +7,7 @@
Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
Name: curl
Version: 8.15.0
-Release: 8%{?dist}
+Release: 9%{?dist}
License: curl
Source0: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz
Source1: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz.asc
@@ -52,6 +52,9 @@ Patch011: 0011-curl-8.15.0-CVE-2026-9547.patch
# fix trailing dot domain super cookie (CVE-2026-8924)
Patch012: 0012-curl-8.15.0-CVE-2026-8924.patch
+# fix proto-default skips SSH verification (CVE-2026-12064)
+Patch013: 0013-curl-8.15.0-CVE-2026-12064.patch
+
# patch making libcurl multilib ready
Patch101: 0101-curl-7.32.0-multilib.patch
@@ -451,6 +454,9 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
%{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
%changelog
+* Wed Aug 26 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-9
+- fix proto-default skips SSH verification (CVE-2026-12064)
+
* Mon Aug 03 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-8
- fix cross-proxy Digest auth state leak (CVE-2026-7168)
- fix cross-origin Digest auth state leak (CVE-2026-11856)
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-27 15:01 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-27 15:01 [rpms/curl] f43: Resolves: CVE-2026-12064 - proto-default skips SSH verification Jan Macku
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox