romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 17:53:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

ftp,imap,pop3: do not ignore --ssl-reqd

Browse source 
In imap and pop3, check if TLS is required even when capabilities
request has failed.

In ftp, ignore preauthentication (230 status of server greeting) if TLS
is required.

Bug: https://curl.se/docs/CVE-2021-22946.html

CVE-2021-22946
This commit is contained in:
Patrick Monnerat 2021-09-08 11:56:22 +02:00 • committed by Daniel Stenberg
parent 43157490a5
commit 364f174724
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 195 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

24
lib/imap.c
View file

@ -934,22 +934,18 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
line += wordlen;
}
}
else if(imapcode == IMAP_RESP_OK) {
if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
/* We don't have a SSL/TLS connection yet, but SSL is requested */
if(imapc->tls_supported)
/* Switch to TLS connection now */
result = imap_perform_starttls(data, conn);
else if(data->set.use_ssl == CURLUSESSL_TRY)
/* Fallback and carry on with authentication */
result = imap_perform_authentication(data, conn);
else {
failf(data, "STARTTLS not supported.");
result = CURLE_USE_SSL_FAILED;
}
else if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
/* PREAUTH is not compatible with STARTTLS. */
if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) {
/* Switch to TLS connection now */
result = imap_perform_starttls(data, conn);
}
else
else if(data->set.use_ssl <= CURLUSESSL_TRY)
result = imap_perform_authentication(data, conn);
else {
failf(data, "STARTTLS not available.");
result = CURLE_USE_SSL_FAILED;
}
}
else
result = imap_perform_authentication(data, conn);