Curl & Libcurl Package updates

[RADRaze2KX]

I wound up rolling back curl to match libcurl's version (7.61.1) to resolve the issue. Thank you for your assistance

[bogdan.sh]

Hmm, is it curl installed with a system or one provided by DirectAdmin? Checking the lab servers and cannot reproduce. Here are some command I would like to see from your server:

# which curl
/usr/bin/curl
​
# rpm -qf /usr/bin/curl
curl-7.29.0-59.el7_9.2.x86_64​

# ldd /usr/bin/curl | grep libcurl.so.4
  libcurl.so.4 => /lib64/libcurl.so.4 (0x00007fb013909000)

# rpm -ql alt-libcurlssl11-7.87.0-2.el7.x86_64
/opt/alt/curlssl11/usr/lib64/libcurl.so.4
/opt/alt/curlssl11/usr/lib64/libcurl.so.4.8.0​

# ldd /opt/alt/curl/usr/bin/curl | grep libcurl.so.4
  libcurl.so.4 => /opt/alt/curl/usr/lib64/libcurl.so.4 (0x00007f70a0cac000)​

[RADRaze2KX]

After performing the curl update, I can't seem to build or update any packages. DirectAdmin's CustomBuild is telling me there's an update available for MariaDB from 8.0.32 to 10.6.16. When I try to update MariaDB, I get the following:

download_cached: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/cache/MariaDB-client-10.6.16-1.el8.x86_64.rpm'

curl: (48) An unknown option was passed in to libcurl

safe_download: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (0/3)

curl: (48) An unknown option was passed in to libcurl

safe_download: downloading 'https://files.directadmin.com/services/all/mariadb/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (0/3)

curl: (48) An unknown option was passed in to libcurl

safe_download: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (1/3)

curl: (48) An unknown option was passed in to libcurl

safe_download: downloading 'https://files.directadmin.com/services/all/mariadb/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (1/3)

curl: (48) An unknown option was passed in to libcurl

safe_download: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (2/3)

curl: (48) An unknown option was passed in to libcurl

safe_download: downloading 'https://files.directadmin.com/services/all/mariadb/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (2/3)




curl --version gives:

curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/7.61.1 (additional stuff here)

Release-Date: 2023-12-06

Features: (bunch of stuff here)

WARNING: curl and libcurl versions do not match. Functionality may be affected.

===

I assume I'm experiencing part of the "functionality may be affected" warning.

Currently running CloudLinux 8.9

Updated Curl using "yum update alt-libcurlssl11 --enablerepo=cloudlinux-updates-testing"

Updated due to this post: https://forum.cloudlinux.com/forum/c...ackage-updates

running "yum update curl*" reports there's "nothing to do".

I'm seeing this Curl 48 error on anything I try to update, not just building MariaDB.

Any assistance is greatly appreciated.

[bogdan.sh]

Hello,

I am writing to update that the package has been released and is available from the beta repository:

yum update alt-libcurlssl11 --enablerepo=cloudlinux-updates-testing

Otherwise you might want to wait 2 weeks to have it available in stable.

ALTPHP-1634: Fixes for CVE-2023-38545 and CVE-2023-38546.

[bogdan.sh]

Will clarify the information and get back to you.

[Fazz25]

Thank you for responding and confirming. I now have another.

We've stated getting reports for the below which is provided by the same package provided as part of Imunify360.

The remote libcurl install is affected by a cookie injection vulnerability.
libcurl 7.9.1 < 8.4.0 Cookie Injection


The version of libcurl installed on the remote host is affected by a cookie injection vulnerability. This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates 'easy handles' that are the individual handles for single transfers.

libcurl provides a function call that duplicates an easy handle called curl_easy_duphandle.

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Path : /opt/alt/curl/usr/lib64/libcurl.so.4.5.0
Installed version : 7.64.0
Fixed version : 8.4.0

This issue does appear to have been marked as outside of support scope by Redhat at https://access.redhat.com/security/cve/cve-2023-38546. Could you please confirm if this is going to be reviewed within your provided package or not addressed?

Thanks in advance.

[bogdan.sh]

Hi,

We have got a confirmation from our developers that CentOS7 servers are not affected.

[Fazz25]

Hi Team,

We have started to recieve a large number of reports from PCI scans in relation to the below packages which are provided as part of the Imunify360 Installation from your repository.

alt-curlssl11-7.87.0-1.el7.x86_64
alt-libcurlssl11-7.87.0-1.el7.x86_64

The vulnerability appears to be in relation to the below.

VULNERABILITY

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.

Upon investigation it appears this is likely related to the below CVE

https://curl.se/docs/CVE-2023-38545.html#:~:text=VULNERABILITY,can%20be%20is%20255%20bytes

https://access.redhat.com/security/cve/cve-2023-38545

The servers in question are largely running CentOS7 and not Cloud Linux so may not be vulnerable based on the Redhat post.

Could you please review and confirm if they are vulnerable and is so will a patch be be in development

Thanks in advance.