More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2241933 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Use the following template to for the 'fedpkg update' request to submit an update for this issue as it contains the top-level parent bug(s) as well as this tracking bug. This will ensure that all associated bugs get updated when new packages are pushed to stable. ===== # bugfix, security, enhancement, newpackage (required) type=security # low, medium, high, urgent (required) severity=high # testing, stable request=testing # Bug numbers: 1234,9876 bugs=2241933,2243182 # Description of your update notes=Security fix for [PUT CVEs HERE] # Enable request automation based on the stable/unstable karma thresholds autokarma=True stable_karma=3 unstable_karma=-3 # Automatically close bugs when this marked as stable close_bugs=True # Suggest that users restart after update suggest_reboot=False ====== Additionally, you may opt to use the bodhi web interface to submit updates: https://bodhi.fedoraproject.org/updates/new
Proposed as a Blocker for 39-final by Fedora user pbrobinson using the blocker tracking app because: Curl 8.4.0 will hit at around 0600 UTC (0800 CEST, 0700 BST, 0200 EST, 2300 PDT) on October 11 and deal with CVE-2023-38545, which affects both libcurl and the curl tool, and CVE-2023-38546, which only affects libcurl. The release has no API or ABI changes, so the update should slot in without too much aggravation. CVE-2023-38545 is rated as a high-severity CVE. Stenberg did not disclose any information about either flaw other than to note that the normal development process had to be cut short to get the fixes out as quickly as possible.
+7 in https://pagure.io/fedora-qa/blocker-review/issue/1404 , marking accepted blocker (for F39).
Note, the current stable curl for F39 is 8.2.1, so pulling 8.4.0 involves pulling all the change in 8.3.0 and 8.4.0, which seems like kind of a lot during freeze: https://curl.se/changes.html so I'm hoping Jan can backport the critical CVE fixes to 8.2.1, rather than just ship 8.4.0 to F39. It seems we don't generally update curl to point releases within a stable release: F37 is on curl-7.85.0-11.fc37 and F38 is on curl-8.0.1-4.fc38.
FWIW we have generally bumped `curl` up to new point releases during the lifetime of Amazon Linux 2 and Amazon Linux 2023 without much negative impact. Recent memory has: 1. some package was looking for the literal number 7 in the `curl` version number in its configure script, easy fix. 2. A fix that restricted the size of cookies you could pass through by default meant that the one or two customers relying on that needed to make a change. 3. the recent change to have curl resolve localhost the same way it resolved other names meant that if you had localhost:PORT listening on both ipv4 and ipv6 but the ipv6 would always return HTTP error codes but ipv4 would work.... we found a place relying on that, they're fixing their bug. and while Amazon Linux isn't Fedora (or vice-versa), we haven't broken the internet by bumping curl, which is likely good input into it being a rather safe operation for Fedora to consider doing more regularly.
FEDORA-2023-0f8d1871d8 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-0f8d1871d8
Hello, Bodhi update for F39 contains backport for both curl CVEs: - fix cookie injection with none file (CVE-2023-38546) - fix SOCKS5 heap buffer overflow (CVE-2023-38545)
Stewart, I would say that you were either lucky or just not sufficiently informed about the outcome. We had to deal with a lot of regressions caused by curl upgrades in Fedora: - bug #1658574 - curl: does not return error when downloading file and file already exists - bug #1810989 - GS eats 100% cpu - bug #1697566 - [abrt] flatpak: multi_socket(): flatpak killed by SIGSEGV - bug #1956807 - dnf segfaults during kickstart (libcurl.so.4.7.0) with ssl repositories - bug #2063853 - curl fails with "out of memory" on python https server - bug #2173299 - Curl 7.85 compilation issue with curl_easy_header() function - bug #2144277 - curl: (92) HTTP/2 stream 0 was not closed cleanly: PROTOCOL_ERROR (err 1) - bug #2185433 - Regression: OSTree failed to pull remote repository via proxy - bug #2192665 - cargo downloads fail randomly in f38
FEDORA-2023-b855de5c0f has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-b855de5c0f
FEDORA-2023-fef2b8da32 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-fef2b8da32
I edited the F37 and F38 updates and marked them to not close bug reports when they go stable - we don't want an F39 blocker being closed by an F37/F38 update push. Now only the F39 update will close these bugs when it goes stable. (Personally for fedora-all bugs I prefer to have *no* update close the bugs and instead mark them closed manually when *all* the updates have been pushed, but that's up to the maintainer).
FEDORA-2023-0f8d1871d8 has been pushed to the Fedora 39 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-0f8d1871d8` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0f8d1871d8 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-fef2b8da32 has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-fef2b8da32` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-fef2b8da32 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-b855de5c0f has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-b855de5c0f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-b855de5c0f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-b855de5c0f has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-0f8d1871d8 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-fef2b8da32 has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report.