summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/curl
AgeCommit message (Collapse)Author
2021-08-09curl: fix CVESMingli Yu
Backport patches to fix below CVEs: CVE-2021-22901 CVE-2021-22924 CVE-2021-22926 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-08-09curl: fix CVE-2021-22925Mingli Yu
CVE-2021-22925 Reported-by: Red Hat Product Security Bug: https://curl.se/docs/CVE-2021-22925.html Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-13curl: Fix CVE-2021-22897Khairul Rohaizzat Jamaluddin
CVE: CVE-2021-22897 Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-13curl: Fix CVE-2021-22898Khairul Rohaizzat Jamaluddin
CVE: CVE-2021-22898 Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-06-30curl: fix build when proxy is not enabled in PACKAGECONFIGAnuj Mittal
Backport upstream patches to fix issues introduced by a backported CVE patch. Fixes: | ../../curl-7.75.0/lib/vtls/vtls.c: In function ‘Curl_ssl_addsessionid’: | ../../curl-7.75.0/lib/vtls/vtls.c:508:14: error: ‘isProxy’ redeclared as different kind of symbol | 508 | const bool isProxy = FALSE; | | ^~~~~~~ | ../../curl-7.75.0/lib/vtls/vtls.c:488:37: note: previous definition of ‘isProxy’ with type ‘_Bool’ | 488 | bool isProxy, | | ^ Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-06-18curl: cleanup CVE patches for hardknottTrevor Gamblin
The patch backported to address CVE-2021-22890 was missing a bracket to properly close out the logic in lib/vtls/wolfssl.c. Fix this so to avoid any surprise failures when using curl with hardknott. Also fix the CVE designation in the patch descriptions for CVEs CVE-2021-22890 and CVE-2021-22876 so that CVE checks run with bitbake correctly detect that they are patched. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-06-02curl: fix CVE-2021-22876Trevor Gamblin
Backport and modify the patch for CVE-2021-22876 from curl 7.76 to make it apply cleanly on 7.75. CVE: CVE-2021-22876 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-06-02curl: fix CVE-2021-22890Trevor Gamblin
Backport and modify the patch for CVE-2021-22890 from curl 7.76 to make it apply cleanly on 7.75. CVE: CVE-2021-22890 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-02recipes-support: Add missing HOMEPAGE and DESCRIPTION for recipesMeh Mbeh Ida Delphine
Fixes: [YOCTO #13471] Signed-off-by: Ida Delphine <idadelm@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-02-19curl: upgrade 7.74.0 -> 7.75.0Anuj Mittal
License-Update: copyright years changed Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-12-24curl: Update 7.73.0 -> 7.74.0Khairul Rohaizzat Jamaluddin
update to version 7.74.0 curl 7.74.0 hsts: add experimental support for Strict-Transport-Security with various bug fixes Reference: https://curl.se/changes.html#7_74_0 update includes fix for CVE: CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-11-03curl: upgrade 7.72.0 -> 7.73.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-23curl: Change SRC_URI from http to httpsRandy MacLeod
The official links on: https://curl.haxx.se/download.html use https now and we're seeing this warning: WARNING: curl-native-7.72.0-r0 do_fetch: Failed to fetch URL http://curl.haxx.se/download/curl-7.72.0.tar.bz2, attempting MIRRORS if available Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-08curl: add vendors to CVE_PRODUCT to exclude false positivesRoss Burton
To avoid false positives (such as CVE-2010-0734, rubygems:curl), expand the CVE_PRODUCT list to include all the vendors that have been used. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-08-21curl: Upgrade to 7.72.0Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-02curl: upgrade 7.71.0 -> 7.71.1Pierre-Jean Texier
This release includes the following bugfixes: - cirrus-ci: disable FreeBSD 13 (again) - Curl_inet_ntop: always check the return code - CURLOPT_READFUNCTION.3: provide the upload data size up front - DYNBUF.md: fix a typo: trail => tail - escape: make the URL decode able to reject only %00-bytes - escape: zero length input should return a zero length output - examples/multithread.c: call curl_global_cleanup() - http2: set the correct URL in pushed transfers - http: fix proxy auth with blank password - mbedtls: fix build with disabled proxy support - ngtcp2: sync with current master - openssl: Fix compilation on Windows when ngtcp2 is enabled - Revert "multi: implement wait using winsock events" - sendf: improve the message on client write errors - terminology: call them null-terminated strings - tool_cb_hdr: Fix etag warning output and return code - url: allow user + password to contain "control codes" for HTTP(S) - vtls: compare cert blob when finding a connection to reuse Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-06-25curl: upgrade 7.70.0 -> 7.71.0Pierre-Jean Texier
This release includes the following changes: - CURLOPT_SSL_OPTIONS: optional use of Windows' CA store (with openssl) [10] - setopt: add CURLOPT_PROXY_ISSUERCERT(_BLOB) for coherency [31] - setopt: support certificate options in memory with struct curl_blob [41] - tool: Add option --retry-all-errors to retry on any error [27] This release includes the following bugfixes: - CVE-2020-8177: curl overwrite local file with -J [111] - CVE-2020-8169: Partial password leak over DNS on HTTP redirect [48] - *_sspi: fix bad uses of CURLE_NOT_BUILT_IN [21] - all: fix codespell errors [75] - altsvc: bump to h3-29 [114] ... See full changelog: https://curl.haxx.se/changes.html#7_71_0 Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-06-17curl: add debug infoRasmus Villemoes
Currently, curl (and libcurl) is built without debug info, making the curl-dbg package rather useless. Since debug symbols are automatically stripped and put in that package by the build system, making sure that curl is built with -g shouldn't hurt anything, but will help those that try to debug a libcurl-using application and hence explicitly include curl-dbg in their rootfs. Unfortunately, setting --enable-debug then changes the default value of the optimize option from (assume yes) to (assume no), while also changing the default value of the curldebug option [which is a separate thing that actually changes generated code to add some memory tracking] from (assume no) to (assume yes). So explicitly pass the appropriate options that make those two have the same value as they used to have by default. Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-03curl: support mqtt in PACKAGECONFIGPierre-Jean Texier
The version 7.70.0 of curl add experimental support for this protocol. So, add PACKAGECONFIG for mqtt. See [1] for more informations. [1] - https://github.com/curl/curl/blob/master/docs/MQTT.md Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-03curl: upgrade 7.69.1 -> 7.70.0Pierre-Jean Texier
See full changelog https://curl.haxx.se/changes.html#7_70_0 Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-12curl: upgrade 7.69.0 -> 7.69.1Pierre-Jean Texier
Contains a number of fixes for issues discovered post-7.69.0. For details, see full changelog: https://curl.haxx.se/changes.html#7_69_1 Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-11glew/curl: specify exclusive package configsKai Kang
Specify exclusive package configs for glew and curl to make sure that conflict package configs will NOT set at same time. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-07curl: upgrade 7.68.0 -> 7.69.0Pierre-Jean Texier
Bugfix release. For details, see full changelog - https://curl.haxx.se/changes.html#7_69_0 Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-16curl: upgrade 7.67.0 -> 7.68.0Pierre-Jean Texier
See full changelog https://curl.haxx.se/changes.html#7_68_0 The hash of the license is updated because the copyright year was updated in COPYING file: -Copyright (c) 1996 - 2019, Daniel Stenberg, <daniel@haxx.se>, and many +Copyright (c) 1996 - 2020, Daniel Stenberg, <daniel@haxx.se>, and many Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-14curl:upgrade 7.66.0 -> 7.67.0Zang Ruochen
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-16curl: update to 7.66.0Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-26curl: upgrade 7.65.2 -> 7.65.3Zang Ruochen
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-18curl: upgrade 7.65.1 -> 7.65.2Anuj Mittal
Changelog: https://curl.haxx.se/changes.html#7_65_2 Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-19curl:upgrade 7.64.1 -> 7.65.1Zang Ruochen
-Upgrade from curl_7.64.1.bb to curl_7.65.1.bb. Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-04-12curl: update to 7.64.1Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-25curl: upgrade 7.63.0 -> 7.64.0Richard Purdie
The license checksum changed as the copyright years changed. Fixes: - CVE-2018-16890: NTLM type-2 out-of-bounds buffer read - CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow - CVE-2019-3823: SMTP end-of-response out-of-bounds read Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-01-03curl: update to 7.63Armin Kuster
Changes: curl: add %{stderr} and %{stdout} for --write-out curl: add undocumented option --dump-module-paths for win32 setopt: add CURLOPT_CURLU For full list of changes see: https://curl.haxx.se/changes.html Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-12-13curl: Add PACKAGECONFIG to enable NSS supportOtavio Salvador
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-20curl: update to 7.62.0Armin Kuster
Drop all CVE patches now included in update. For details see: https://curl.haxx.se/changes.html Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-09curl: actually apply latest CVE patchesRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-06curl: fix for CVE-2018-16839/CVE-2018-16840/CVE-2018-16842Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-29curl: extend CVE_PRODUCTGrygorii Tertychnyi
There are both "curl" and "libcurl" CPEs in NVD. All "curl" CVEs are now missed in the reports. Hence, switch "CVE_PRODUCT" to a space separated list of the items. Signed-off-by: Grygorii Tertychnyi <gtertych@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-09curl: Include the complete license informationPeter Kjellerstedt
For some reason, the copyright part was left out of the license information included in LIC_FILES_CHKSUM, preventing it from being used in, e.g., documentation to satisfy the requirements of the license. License-Update: Include the complete license information Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-20curl: CVE-2018-14618Zhixiong Chi
Backport the CVE patch from the upstream https://github.com/curl/curl/commit/57d299a499155d4b327e341c6024e293b0418243.patch https://curl.haxx.se/docs/CVE-2018-14618.html https://nvd.nist.gov/vuln/detail/CVE-2018-14618 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-08-14curl: support multilib installation of curl-configChangqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-30curl: enable libidnRoss Burton
Now that oe-core has libidn2 we can enable it by default in target curl builds. Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26curl: disable C source code generatorAndre McCurdy
The --libcurl command line option causes curl to generate C source code which, when compiled and linked with libcurl, creates a binary which behaves in the same way as curl when run with the other options passed on the curl command line. https://curl.haxx.se/docs/manpage.html#--libcurl It's a development tool and not generally useful on the target, especially if the target doesn't contain a toolchain etc. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-18curl: add PACKAGECONFIG options for brotli, built-in manpages, etcAndre McCurdy
- Add PACKAGECONFIG option for brotli (disable by default) - Add PACKAGECONFIG option for built-in manpages (disabled by default). Embedding a copy of the manpages within the curl binary adds approx 60k of gzipped data and duplicates the contents of the curl-doc package. - Add PACKAGECONFIG option for verbose error messages (enabled by default) - Disable legacy NTLM http authentication via delegation to the external winbind ntlm_auth helper (which isn't going to work without a runtime dependency on samba). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-18curl: update 7.60.0 -> 7.61.0Andre McCurdy
https://curl.haxx.se/changes.html#7_61_0 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-06curl: support mbedtls in PACKAGECONFIGBinghua Guan
Signed-off-by: Binghua Guan <freebendy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-05-29curl: update 7.59.0 -> 7.60.0Andre McCurdy
https://curl.haxx.se/changes.html#7_60_0 Also refresh 0001-replace-krb5-config-with-pkg-config.patch and drop configure_ac.patch, which we've apparently been dragging along unnecessarily for the past 5 years: https://github.com/curl/curl/commit/c277bd6ce7069819484eb3dc30b5858735fde377 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-05-04curl: update to 7.59.0Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-06curl: DEPENDS on libidn2 (not libidn)André Draszik
Since v7.51.0, libidn2 is the only available option, libidn support was dropped. The configure option was renamed as of v7.53.0 Therefore, curl unconditionally tries to build against libidn2, which in particular is a problem for curl-native, as that might or might not build against the build-machine's libidn2 now, which furthermore causes problems when trying to share sstate between multiple build machines. We therefore see the following in the config log: ... checking whether to build with libidn2... (assumed) yes ... checking for libidn2 options with pkg-config... no configure: IDN_LIBS: "-lidn2" configure: IDN_LDFLAGS: "" configure: IDN_CPPFLAGS: "" configure: IDN_DIR: "" checking if idn2_lookup_ul can be linked... yes checking idn2.h usability... yes checking idn2.h presence... yes checking for idn2.h... yes ... IDN support: enabled (libidn2) ... even though this recipe tries to disable that. While libidn2 isn't available in OE, this change at least: * prevents curl-native to silently build against libidn2 if that is installed on build machine, even if not requested * alerts people who use the PACKAGECONFIG option that it's not actually doing what they intend to do Signed-off-by: André Draszik <andre.draszik@jci.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-02-24curl: upgrade to 7.58.0Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-01-26curl: 7.54.1 -> 7.57.0Huang Qiyu
1.Upgrade curl from 7.54.1 to 7.57.0. 2.Delete CVE-2017-1000099.patch, CVE-2017-1000100.patch, CVE-2017-1000101.patch, CVE-2017-1000254.patch, reproducible-mkhelp.patch, since it is integrated upstream. 3.Remove "do_install_append()" from curl_7.57.0.bb, since curl/curlbuild.h has been removed. Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-19 02:47:50 +0000