Synopsis

curl bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

An updated curl package that fixes multiple bugs and adds two enhancements is
now available for Red Hat Enterprise Linux 5.

Description

The curl package provides the libcurl library and the cURL command line tool for
transferring data using various protocols, including FTP, HTTP, Gopher, Telnet,
and DICT. Both, libcurl and cURL, support many useful capabilities, such as user
authentication, proxy support, FTP uploading, HTTP POST and PUT methods, SSL
certificates, and file transfer resume.

This update fixes the following bugs:

• In the FTP implementation, libcurl incorrectly called the accept() function
  from a system library, which caused a stack overflow under certain
  circumstances. This update applies a backported upstream patch that corrects
  this bug, and the stack overflow no longer occurs. (BZ#652557)
  
• Previously, an attempt to send an LDAP request through an HTTP proxy tunnel
  ended up with cURL trying to connect to the LDAP server directly using a wrong
  port number. With this update, the underlying source code has been modified to
  fix this problem, and cURL now works as expected. (BZ#655073)
  
• Previously, the "multi" interface of libcurl was broken, which caused the "git
  push" command to work incorrectly over the Web Distributed Authoring and
  Versioning (WebDAV) protocol. This update applies an upstream patch, which
  corrects counting of active connections in the "multi" interface. The "git push"
  command now works as expected over WebDAV. (BZ#688871)
  
• As a solution to a security issue, GSSAPI credential delegation was disabled,
  which broke the functionality of the applications that were relying on
  delegation, which was incorrectly enabled by libcurl. To fix this problem, the
  CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable
  delegation explicitly when applications need it. All applications using GSSAPI
  credential delegation can now use this new libcurl option to be able to run
  properly. (BZ#723643)
  

In addition, this update adds the following enhancements:

• Previously, curl did not support proxy authentication using Kerberos. With
  this update, underlying code has been modified and curl now allows Kerberos
  proxy authentication by using the "--proxy-negotiate" option. (BZ#657396)
  
• The cURL utility did not allow Kerberos credential delegation although the
  libcurl library provided appropriate support for this functionality. This update
  introduces a new option, "--delegation", which enables Kerberos credential
  delegation in cURL. (BZ#746849)
  

All users of curl are advised to upgrade to this updated package, which fixes
these bugs and adds these enhancements. All running applications that use
libcurl have to be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 652557 - Tests 253 and 255 FAIL: stack smashing detected
• BZ - 655073 - proxy tunnel support for LDAP requests is broken
• BZ - 657396 - [RFE] backport of --proxy-negotiate code to allow use of kerberos auth proxy
• BZ - 688871 - update running_handles counter properly in curl_multi_remove_handle()
• BZ - 746849 - curl does not support --delegation even though it was added to libcurl

CVEs

(none)

References

(none)

Red Hat Enterprise Linux Server 5

SRPM
curl-7.15.5-15.el5.src.rpm	SHA-256: 898359b0b831656364d40eec61038302ccfec53c0c0ead14b0bffdd69769d784
x86_64
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-7.15.5-15.el5.x86_64.rpm	SHA-256: 9beb77415986f94edfecf0de0cf56f18c9322f128342961e774141e5051cfcc2
curl-devel-7.15.5-15.el5.i386.rpm	SHA-256: e3165173bd6101ad52a088c2f2088bab50503a3aeef5a11d4a00a90ee7c26188
curl-devel-7.15.5-15.el5.x86_64.rpm	SHA-256: fdce7b4f7e95ac9332494aac4e5baf63e632572b572dbee3564b000b3896217d
ia64
curl-7.15.5-15.el5.ia64.rpm	SHA-256: 085667dea31bd558fbcf5c31fc0821b6a24a61d28a1d5fabbcbc07e0b4072128
curl-devel-7.15.5-15.el5.ia64.rpm	SHA-256: 26064f01fba1285530bbd2f12fd2b2390ce9377cde9df18e24698409c40fceb9
i386
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-devel-7.15.5-15.el5.i386.rpm	SHA-256: e3165173bd6101ad52a088c2f2088bab50503a3aeef5a11d4a00a90ee7c26188

Red Hat Enterprise Linux Workstation 5

SRPM
curl-7.15.5-15.el5.src.rpm	SHA-256: 898359b0b831656364d40eec61038302ccfec53c0c0ead14b0bffdd69769d784
x86_64
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-7.15.5-15.el5.x86_64.rpm	SHA-256: 9beb77415986f94edfecf0de0cf56f18c9322f128342961e774141e5051cfcc2
curl-devel-7.15.5-15.el5.i386.rpm	SHA-256: e3165173bd6101ad52a088c2f2088bab50503a3aeef5a11d4a00a90ee7c26188
curl-devel-7.15.5-15.el5.x86_64.rpm	SHA-256: fdce7b4f7e95ac9332494aac4e5baf63e632572b572dbee3564b000b3896217d
i386
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-devel-7.15.5-15.el5.i386.rpm	SHA-256: e3165173bd6101ad52a088c2f2088bab50503a3aeef5a11d4a00a90ee7c26188

Red Hat Enterprise Linux Desktop 5

SRPM
curl-7.15.5-15.el5.src.rpm	SHA-256: 898359b0b831656364d40eec61038302ccfec53c0c0ead14b0bffdd69769d784
x86_64
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-7.15.5-15.el5.x86_64.rpm	SHA-256: 9beb77415986f94edfecf0de0cf56f18c9322f128342961e774141e5051cfcc2
i386
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
curl-7.15.5-15.el5.src.rpm	SHA-256: 898359b0b831656364d40eec61038302ccfec53c0c0ead14b0bffdd69769d784
s390x
curl-7.15.5-15.el5.s390.rpm	SHA-256: d4783eabebd37acd870a49a689643530f1603d9c7cc14952c69754487bc51cbc
curl-7.15.5-15.el5.s390x.rpm	SHA-256: add67671d76a004536e39baab5b88ac6fdbf468baffa4446dbd550fc1d8e2321
curl-devel-7.15.5-15.el5.s390.rpm	SHA-256: 61a9a4138560663d06cc0af8468b98b76d9445d7951bce92cde2da24d292ce20
curl-devel-7.15.5-15.el5.s390x.rpm	SHA-256: 73a14255f12a4459b99e3ecf92393db257afff3c634f3aac1e480d56de4b72db

Red Hat Enterprise Linux for Power, big endian 5

SRPM
curl-7.15.5-15.el5.src.rpm	SHA-256: 898359b0b831656364d40eec61038302ccfec53c0c0ead14b0bffdd69769d784
ppc
curl-7.15.5-15.el5.ppc.rpm	SHA-256: 359fff5043ba4a54633694ab2aff94984d7bbde222f22de845bc3be548124adc
curl-7.15.5-15.el5.ppc64.rpm	SHA-256: 21d5e9418b2e3d9fd1015d74a342792b7b32c00a0e4519500bbb4bc5f499b435
curl-devel-7.15.5-15.el5.ppc.rpm	SHA-256: 483636c405e95d067df8ec728f1a36cd182c9a8bd02c48d07fbc9dc7d4eb880e
curl-devel-7.15.5-15.el5.ppc64.rpm	SHA-256: 48c562694b654a7c48e94548b7b37cea8e7b962ebecf9137682157e495879d89

Red Hat Enterprise Linux Server from RHUI 5

SRPM
curl-7.15.5-15.el5.src.rpm	SHA-256: 898359b0b831656364d40eec61038302ccfec53c0c0ead14b0bffdd69769d784
x86_64
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-7.15.5-15.el5.x86_64.rpm	SHA-256: 9beb77415986f94edfecf0de0cf56f18c9322f128342961e774141e5051cfcc2
curl-devel-7.15.5-15.el5.i386.rpm	SHA-256: e3165173bd6101ad52a088c2f2088bab50503a3aeef5a11d4a00a90ee7c26188
curl-devel-7.15.5-15.el5.x86_64.rpm	SHA-256: fdce7b4f7e95ac9332494aac4e5baf63e632572b572dbee3564b000b3896217d
i386
curl-7.15.5-15.el5.i386.rpm	SHA-256: c46679a7a2cbba1edf3f1790d25e86b3deff311ad8a98d399e745069d60b6a39
curl-devel-7.15.5-15.el5.i386.rpm	SHA-256: e3165173bd6101ad52a088c2f2088bab50503a3aeef5a11d4a00a90ee7c26188