Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
117 changes: 117 additions & 0 deletions SPECS/curl/CVE-2025-14017.patch
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
From 477745dc74450c96f10afdacdcfecac67b50f138 Mon Sep 17 00:00:00 2001
From: AllSpark <allspark@microsoft.com>
Date: Fri, 9 Jan 2026 03:55:08 +0000
Subject: [PATCH] ldap: call ldap_init() before setting the options; set
options on server; adjust CACERTFILE and REQUIRE_CERT; move init earlier and
remove duplicate init; update error message; consistent with upstream patch

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: AI Backport of https://github.com/curl/curl/commit/39d1976b7f709a516e324333.patch
---
lib/ldap.c | 49 +++++++++++++++++++------------------------------
1 file changed, 19 insertions(+), 30 deletions(-)

diff --git a/lib/ldap.c b/lib/ldap.c
index 2cbdb9c..a1e60b0 100644
--- a/lib/ldap.c
+++ b/lib/ldap.c
@@ -367,16 +367,29 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
passwd = conn->passwd;
}

+#ifdef USE_WIN32_LDAP
+ if(ldap_ssl)
+ server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1);
+ else
+#else
+ server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t upstream

+#endif
+ if(!server) {
+ failf(data, "LDAP: cannot setup connect to %s:%u",
+ conn->host.dispname, conn->primary.remote_port);
+ result = CURLE_COULDNT_CONNECT;
+ goto quit;
+ }
+
#ifdef LDAP_OPT_NETWORK_TIMEOUT
- ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
+ ldap_set_option(server, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
#endif
- ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
+ ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);

if(ldap_ssl) {
#ifdef HAVE_LDAP_SSL
#ifdef USE_WIN32_LDAP
/* Win32 LDAP SDK does not support insecure mode without CA! */
- server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1);
ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
#else
int ldap_option;
@@ -444,7 +457,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
goto quit;
}
infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
ldap_err2string(rc));
@@ -456,20 +469,13 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
else
ldap_option = LDAP_OPT_X_TLS_NEVER;

- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting cert verify mode: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
- server = ldap_init(host, conn->primary.remote_port);
- if(!server) {
- failf(data, "LDAP local: Cannot connect to %s:%u",
- conn->host.dispname, conn->primary.remote_port);
- result = CURLE_COULDNT_CONNECT;
- goto quit;
- }
ldap_option = LDAP_OPT_X_TLS_HARD;
rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
if(rc != LDAP_SUCCESS) {
@@ -478,15 +484,6 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
-/*
- rc = ldap_start_tls_s(server, NULL, NULL);
- if(rc != LDAP_SUCCESS) {
- failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
- ldap_err2string(rc));
- result = CURLE_SSL_CERTPROBLEM;
- goto quit;
- }
-*/
#else
(void)ldap_option;
(void)ldap_ca;
@@ -505,15 +502,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
result = CURLE_NOT_BUILT_IN;
goto quit;
}
- else {
- server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port);
- if(!server) {
- failf(data, "LDAP local: Cannot connect to %s:%u",
- conn->host.dispname, conn->primary.remote_port);
- result = CURLE_COULDNT_CONNECT;
- goto quit;
- }
- }
+
#ifdef USE_WIN32_LDAP
ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
rc = ldap_win_bind(data, server, user, passwd);
--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/curl/curl.spec
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: An URL retrieval utility and library
Name: curl
Version: 8.11.1
Release: 4%{?dist}
Release: 5%{?dist}
License: curl
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -12,6 +12,7 @@ Patch0: CVE-2025-0665.patch
Patch1: CVE-2025-0167.patch
Patch2: CVE-2025-0725.patch
Patch3: CVE-2025-10148.patch
Patch4: CVE-2025-14017.patch
BuildRequires: cmake
BuildRequires: krb5-devel
BuildRequires: libnghttp2-devel
Expand Down Expand Up @@ -102,6 +103,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
%{_libdir}/libcurl.so.*

%changelog
* Fri Jan 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.11.1-5
- Patch for CVE-2025-14017

* Thu Sep 11 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.11.1-4
- Patch for CVE-2025-10148

Expand Down
6 changes: 3 additions & 3 deletions toolkit/resources/manifests/package/pkggen_core_aarch64.txt
Original file line number Diff line number Diff line change
Expand Up @@ -199,9 +199,9 @@ krb5-1.21.3-2.azl3.aarch64.rpm
krb5-devel-1.21.3-2.azl3.aarch64.rpm
nghttp2-1.61.0-2.azl3.aarch64.rpm
nghttp2-devel-1.61.0-2.azl3.aarch64.rpm
curl-8.11.1-4.azl3.aarch64.rpm
curl-devel-8.11.1-4.azl3.aarch64.rpm
curl-libs-8.11.1-4.azl3.aarch64.rpm
curl-8.11.1-5.azl3.aarch64.rpm
curl-devel-8.11.1-5.azl3.aarch64.rpm
curl-libs-8.11.1-5.azl3.aarch64.rpm
createrepo_c-1.0.3-1.azl3.aarch64.rpm
libxml2-2.11.5-8.azl3.aarch64.rpm
libxml2-devel-2.11.5-8.azl3.aarch64.rpm
Expand Down
6 changes: 3 additions & 3 deletions toolkit/resources/manifests/package/pkggen_core_x86_64.txt
Original file line number Diff line number Diff line change
Expand Up @@ -199,9 +199,9 @@ krb5-1.21.3-2.azl3.x86_64.rpm
krb5-devel-1.21.3-2.azl3.x86_64.rpm
nghttp2-1.61.0-2.azl3.x86_64.rpm
nghttp2-devel-1.61.0-2.azl3.x86_64.rpm
curl-8.11.1-4.azl3.x86_64.rpm
curl-devel-8.11.1-4.azl3.x86_64.rpm
curl-libs-8.11.1-4.azl3.x86_64.rpm
curl-8.11.1-5.azl3.x86_64.rpm
curl-devel-8.11.1-5.azl3.x86_64.rpm
curl-libs-8.11.1-5.azl3.x86_64.rpm
createrepo_c-1.0.3-1.azl3.x86_64.rpm
libxml2-2.11.5-8.azl3.x86_64.rpm
libxml2-devel-2.11.5-8.azl3.x86_64.rpm
Expand Down
8 changes: 4 additions & 4 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,10 @@ cracklib-lang-2.9.11-1.azl3.aarch64.rpm
createrepo_c-1.0.3-1.azl3.aarch64.rpm
createrepo_c-debuginfo-1.0.3-1.azl3.aarch64.rpm
createrepo_c-devel-1.0.3-1.azl3.aarch64.rpm
curl-8.11.1-4.azl3.aarch64.rpm
curl-debuginfo-8.11.1-4.azl3.aarch64.rpm
curl-devel-8.11.1-4.azl3.aarch64.rpm
curl-libs-8.11.1-4.azl3.aarch64.rpm
curl-8.11.1-5.azl3.aarch64.rpm
curl-debuginfo-8.11.1-5.azl3.aarch64.rpm
curl-devel-8.11.1-5.azl3.aarch64.rpm
curl-libs-8.11.1-5.azl3.aarch64.rpm
Cython-debuginfo-3.0.5-2.azl3.aarch64.rpm
debugedit-5.0-2.azl3.aarch64.rpm
debugedit-debuginfo-5.0-2.azl3.aarch64.rpm
Expand Down
8 changes: 4 additions & 4 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,10 @@ createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
cross-binutils-common-2.41-10.azl3.noarch.rpm
cross-gcc-common-13.2.0-7.azl3.noarch.rpm
curl-8.11.1-4.azl3.x86_64.rpm
curl-debuginfo-8.11.1-4.azl3.x86_64.rpm
curl-devel-8.11.1-4.azl3.x86_64.rpm
curl-libs-8.11.1-4.azl3.x86_64.rpm
curl-8.11.1-5.azl3.x86_64.rpm
curl-debuginfo-8.11.1-5.azl3.x86_64.rpm
curl-devel-8.11.1-5.azl3.x86_64.rpm
curl-libs-8.11.1-5.azl3.x86_64.rpm
Cython-debuginfo-3.0.5-2.azl3.x86_64.rpm
debugedit-5.0-2.azl3.x86_64.rpm
debugedit-debuginfo-5.0-2.azl3.x86_64.rpm
Expand Down
Loading