Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(PA-6962) update curl to address CVE-2024-8096 #921

Merged
merged 1 commit into from
Oct 14, 2024
Merged

(PA-6962) update curl to address CVE-2024-8096 #921

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions configs/components/curl.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@
case version
when '7.88.1'
pkg.sha256sum 'cdb38b72e36bc5d33d5b8810f8018ece1baa29a8f215b4495e495ded82bbf3c7'
when '8.9.1'
pkg.sha256sum '291124a007ee5111997825940b3876b3048f7d31e73e9caa681b80fe48b2dcd5'
when '8.10.1'
pkg.sha256sum 'd15ebab765d793e2e96db090f0e172d127859d78ca6f6391d7eafecfd894bbc0'
else
raise "curl version #{version} has not been configured; Cannot continue."
end
Expand Down Expand Up @@ -53,7 +53,7 @@
end

configure_options = []
configure_options << "--with-ssl=#{settings[:prefix]}"
configure_options << "--with-ssl=#{settings[:prefix]} --without-libpsl"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the context for adding in --without-libpsl? Is this required for every platform we're building on? Does the Curl 7.88.1 package support building with that flag?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

while building, curl 8.10.1 libpsl was expected to be installed which was never the case for prior versions. One was was to add libpsl was to either install it as a package while building or bypass using --without-libpsl.
I checked with the flag and there were no failures or dependency as such for puppet while building.

I checked building for curl-7.88.1 with --without-libpsl flag and the build was successful. As earlier also there were no such dependency hence it passed.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@amitkarsale we went over this PR in standup and have some suggestions.

Did a bit of research, there is a good article by the developer of Curl on PSL and their use in Curl: https://daniel.haxx.se/blog/2024/01/10/psl-in-curl/

The short of this is PSL support was added a bit ago in the 8.x stream of Curl, previous it used to just warn and looks like in the recent past it started to fail the configure action if the required libraries were not found.

Reading the blog post I think short term it really doesn't change anything to include the flag as is, but we should for sure ticket and make this a known issue.

So if you could make a small change to this PR, pull out the --without-libpsl from the commit with the Curl bump and make that its own commit with its own message.

Then would you mind filing a Jira ticket to cover the work of adding libpsl support to puppet-runtime?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've created a new ticket to address the libpsl installation. Maybe post release I can take it to unblock the release.


# OpenSSL version 3.0 & up no longer ships by default the insecure algorithms
# that curl's ntlm module depends on (md4 & des).
Expand Down
2 changes: 1 addition & 1 deletion configs/projects/agent-runtime-main.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
proj.setting :augeas_version, '1.14.1'
end

proj.setting :curl_version, '8.9.1'
proj.setting :curl_version, '8.10.1'

########
# Load shared agent settings
Expand Down