romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 05:27:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

ftp,imap,pop3,smtp: reject STARTTLS server response pipelining

Browse source 
If a server pipelines future responses within the STARTTLS response, the
former are preserved in the pingpong cache across TLS negotiation and
used as responses to the encrypted commands.

This fix detects pipelined STARTTLS responses and rejects them with an
error.

CVE-2021-22947

Bug: https://curl.se/docs/CVE-2021-22947.html
This commit is contained in:
Patrick Monnerat 2021-09-07 13:26:42 +02:00 • committed by Daniel Stenberg
parent 364f174724
commit 8ef147c436
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
9 changed files with 236 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/ftp.c
View file

@ -2743,6 +2743,9 @@ static CURLcode ftp_statemachine(struct Curl_easy *data,
case FTP_AUTH:
/* we have gotten the response to a previous AUTH command */
if(pp->cache_size)
return CURLE_WEIRD_SERVER_REPLY; /* Forbid pipelining in response. */
/* RFC2228 (page 5) says:
*
* If the server is willing to accept the named security mechanism,

4
lib/imap.c
View file

@ -963,6 +963,10 @@ static CURLcode imap_state_starttls_resp(struct Curl_easy *data,
(void)instate; /* no use for this yet */
/* Pipelining in response is forbidden. */
if(data->conn->proto.imapc.pp.cache_size)
return CURLE_WEIRD_SERVER_REPLY;
if(imapcode != IMAP_RESP_OK) {
if(data->set.use_ssl != CURLUSESSL_TRY) {
failf(data, "STARTTLS denied");

4
lib/pop3.c
View file

@ -771,6 +771,10 @@ static CURLcode pop3_state_starttls_resp(struct Curl_easy *data,
CURLcode result = CURLE_OK;
(void)instate; /* no use for this yet */
/* Pipelining in response is forbidden. */
if(data->conn->proto.pop3c.pp.cache_size)
return CURLE_WEIRD_SERVER_REPLY;
if(pop3code != '+') {
if(data->set.use_ssl != CURLUSESSL_TRY) {
failf(data, "STARTTLS denied");

4
lib/smtp.c
View file

@ -834,6 +834,10 @@ static CURLcode smtp_state_starttls_resp(struct Curl_easy *data,
CURLcode result = CURLE_OK;
(void)instate; /* no use for this yet */
/* Pipelining in response is forbidden. */
if(data->conn->proto.smtpc.pp.cache_size)
return CURLE_WEIRD_SERVER_REPLY;
if(smtpcode != 220) {
if(data->set.use_ssl != CURLUSESSL_TRY) {
failf(data, "STARTTLS denied, code %d", smtpcode);