Re: [OE-core] [dunfell][PATCH] curl: Fix CVE-2021-22924 and CVE-2021-22925

["Mike Crowe" <yocto@mac.mcrowe.com>]

On Wednesday 04 August 2021 at 06:44:51 -1000, Steve Sakoman wrote:
> On Tue, Aug 3, 2021 at 10:11 PM Mike Crowe via lists.openembedded.org
> <yocto=mac.mcrowe.com@lists.openembedded.org> wrote:
> >
> > curl v7.78 contained fixes for five CVEs:
> >
> > CVE-2021-22922 and CVE-2021-22923 are only present when support for
> > metalink is enabled. EXTRA_OECONF contains "--without-libmetalink" so
> > these fixes are unnecessary.
> >
> > CVE-2021-22926 only affects builds for MacOS.
> >
> > CVE-2021-22924 and CVE-2021-22925 are both applicable. Take the patches
> > from Ubuntu 20.04 curl_7.68.0-1ubuntu2.6 package which is close enough
> > that the patch for CVE-2021-22924 applies without conflicts. The
> > CVE-2021-22925 patch required only a small tweak to apply.
> 
> Being curious why none of these are showing up in the reports I
> checked the CPE database and it seems none of them are present!  So
> that explains why.
> 
> Do you know why they are missing?  Perhaps a status of RESERVED?  See:
> 
> https://nvd.nist.gov/vuln/detail/CVE-2021-22923

I'm afraid that I have no idea. :( I just watch curl release announcements
to assess the security impact on our products and spotted these.

> Since they seem to be real issues though I can take the patch once you
> send a V2 with the issue below fixed.

> [ Need to have a CVE tag and your signed-off-by in both patch files. ]

v2 should have arrived. I must have sneaked my previous CVE fixes through
without them somehow. :)

> It might make sense to whitelist the CVE's that don't apply to us so
> that once the entries hit the database we will already have dealt with
> them.

Hopefully done.

Thanks.

Mike.