From patchwork Wed Mar 31 17:15:52 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Baruch Siach X-Patchwork-Id: 1460655 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=busybox.net (client-ip=2605:bc80:3010::137; helo=smtp4.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4F9Xz52lKQz9sVq for ; Thu, 1 Apr 2021 04:16:16 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id B452240E93; Wed, 31 Mar 2021 17:16:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H2ROvYQUTkHg; Wed, 31 Mar 2021 17:16:08 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by smtp4.osuosl.org (Postfix) with ESMTP id D7F6540E8B; Wed, 31 Mar 2021 17:16:07 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id 4DED01BF3F2 for ; Wed, 31 Mar 2021 17:16:06 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 3DF2D84240 for ; Wed, 31 Mar 2021 17:16:06 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zB3r6IBs0WOL for ; Wed, 31 Mar 2021 17:16:05 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.8.0 Received: from mx.tkos.co.il (guitar.tcltek.co.il [192.115.133.116]) by smtp1.osuosl.org (Postfix) with ESMTPS id E1948841D2 for ; Wed, 31 Mar 2021 17:16:04 +0000 (UTC) Received: from tarshish.tkos.co.il (unknown [10.0.8.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx.tkos.co.il (Postfix) with ESMTPS id A696E440E49; Wed, 31 Mar 2021 20:15:59 +0300 (IDT) From: Baruch Siach To: buildroot@busybox.net Date: Wed, 31 Mar 2021 20:15:52 +0300 Message-Id: X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Subject: [Buildroot] [PATCH] package/libcurl: security bump to version 7.76.0 X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Matt Weber Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" CVE-2021-22890: TLS 1.3 session ticket proxy host mixup (since 7.63.0) CVE-2021-22876: Automatic referer leaks credentials (since 7.1.1) This version adds optional dependency on libgsasl. Cc: Matt Weber Signed-off-by: Baruch Siach --- package/libcurl/libcurl.hash | 4 ++-- package/libcurl/libcurl.mk | 9 ++++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/package/libcurl/libcurl.hash b/package/libcurl/libcurl.hash index 368b8f67f13e..1906834e7a31 100644 --- a/package/libcurl/libcurl.hash +++ b/package/libcurl/libcurl.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -# https://curl.haxx.se/download/curl-7.75.0.tar.xz.asc +# https://curl.haxx.se/download/curl-7.76.0.tar.xz.asc # signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2 -sha256 fe0c49d8468249000bda75bcfdf9e30ff7e9a86d35f1a21f428d79c389d55675 curl-7.75.0.tar.xz +sha256 6302e2d75c59cdc6b35ce3fbe716481dd4301841bbb5fd71854653652a014fc8 curl-7.76.0.tar.xz sha256 6fd1a1c008b5ef4c4741dd188c3f8af6944c14c25afa881eb064f98fb98358e7 COPYING diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index 6a9a5a3d3e6a..b02a9263512a 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBCURL_VERSION = 7.75.0 +LIBCURL_VERSION = 7.76.0 LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz LIBCURL_SITE = https://curl.haxx.se/download LIBCURL_DEPENDENCIES = host-pkgconf \ @@ -126,6 +126,13 @@ else LIBCURL_CONF_OPTS += --without-nghttp2 endif +ifeq ($(BR2_PACKAGE_LIBGSASL),y) +LIBCURL_DEPENDENCIES += libgsasl +LIBCURL_CONF_OPTS += --with-gsasl +else +LIBCURL_CONF_OPTS += --without-gsasl +endif + ifeq ($(BR2_PACKAGE_LIBCURL_COOKIES_SUPPORT),y) LIBCURL_CONF_OPTS += --enable-cookies else