mtk-20170518/package/network/utils/curl/Makefile, branch v17.01.2 MTK 20170518 : Mediatek SDK based on OpenWRT Barrier Breaker curl: fix CVE-2017-2629 SSL_VERIFYSTATUS ignored 2017-03-13T21:51:20+00:00 Hauke Mehrtens hauke@hauke-m.de 2017-03-13T21:51:20+00:00 111cf1b9f37b902dbc4ac2934f38ee6418600f69 This fixes the following security problem: https://curl.haxx.se/docs/adv_20170222.html Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 
This fixes the following security problem:
https://curl.haxx.se/docs/adv_20170222.html

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
curl: Remove PolarSSL and adjust default to mbedTLS 2017-01-03T13:26:41+00:00 Rosen Penev rosenp@gmail.com 2016-12-30T02:53:03+00:00 558680012dd79de0289aeeb74a72163916cd9f33 luci-ssl has already made the switch since mainline support for PolarSSL is almost over (2016). Signed-off-by: Rosen Penev <rosenp@gmail.com> 
luci-ssl has already made the switch since mainline support for PolarSSL is
almost over (2016).

Signed-off-by: Rosen Penev <rosenp@gmail.com>
curl: update to version 7.52.1 2017-01-02T12:07:10+00:00 Hauke Mehrtens hauke@hauke-m.de 2017-01-02T12:07:10+00:00 1436e1548881a8e196eeb25c7c807e2c3d65caf1 This fixes the folowing security problems: CVE-2016-9586: printf floating point buffer overflow CVE-2016-9952: Win CE schannel cert wildcard matches too much CVE-2016-9953: Win CE schannel cert name out of buffer read CVE-2016-9594: unititialized random Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 
This fixes the folowing security problems:

CVE-2016-9586: printf floating point buffer overflow
CVE-2016-9952: Win CE schannel cert wildcard matches too much
CVE-2016-9953: Win CE schannel cert name out of buffer read
CVE-2016-9594: unititialized random

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
treewide: clean up download hashes 2016-12-16T21:39:22+00:00 Felix Fietkau nbd@nbd.name 2016-12-16T16:32:10+00:00 720b99215da295a2e7b4acdef30b58bec6acedc2 Replace *MD5SUM with *HASH, replace MD5 hashes with SHA256 Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Replace *MD5SUM with *HASH, replace MD5 hashes with SHA256

Signed-off-by: Felix Fietkau <nbd@nbd.name>
curl: update to version 7.51.0 2016-12-03T15:38:44+00:00 Hauke Mehrtens hauke@hauke-m.de 2016-12-03T15:07:47+00:00 4e07167eff3992150c6c2f414a0f3a88d5c42013 This fixes the following security problems: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curl_maprintf CVE-2016-8619: double-free in krb5 code CVE-2016-8620: glob parser write/read out of bounds CVE-2016-8621: curl_getdate read out of bounds CVE-2016-8622: URL unescape heap overflow via integer truncation CVE-2016-8623: Use-after-free via shared cookies CVE-2016-8624: invalid URL parsing with '#' CVE-2016-8625: IDNA 2003 makes curl use wrong host Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 
This fixes the following security problems:
CVE-2016-8615: cookie injection for other servers
CVE-2016-8616: case insensitive password comparison
CVE-2016-8617: OOB write via unchecked multiplication
CVE-2016-8618: double-free in curl_maprintf
CVE-2016-8619: double-free in krb5 code
CVE-2016-8620: glob parser write/read out of bounds
CVE-2016-8621: curl_getdate read out of bounds
CVE-2016-8622: URL unescape heap overflow via integer truncation
CVE-2016-8623: Use-after-free via shared cookies
CVE-2016-8624: invalid URL parsing with '#'
CVE-2016-8625: IDNA 2003 makes curl use wrong host

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
curl: update to version 7.50.3 2016-09-24T11:48:05+00:00 Hauke Mehrtens hauke@hauke-m.de 2016-09-24T11:48:05+00:00 df9efc94970ccc1e43915839ec3f49d54729cc3d This fixes the following security problems: 7.50.1: CVE-2016-5419 TLS session resumption client cert bypass CVE-2016-5420 Re-using connections with wrong client cert CVE-2016-5421 use of connection struct after free 7.50.2: CVE-2016-7141 Incorrect reuse of client certificates 7.50.3: CVE-2016-7167 curl escape and unescape integer overflows Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 
This fixes the following security problems:
7.50.1:
 CVE-2016-5419 TLS session resumption client cert bypass
 CVE-2016-5420 Re-using connections with wrong client cert
 CVE-2016-5421 use of connection struct after free
7.50.2:
 CVE-2016-7141 Incorrect reuse of client certificates
7.50.3:
 CVE-2016-7167 curl escape and unescape integer overflows

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
curl: update to version 7.50.0 2016-07-24T13:04:13+00:00 Hauke Mehrtens hauke@hauke-m.de 2016-07-24T11:23:02+00:00 7d38128f6a58ab7b6612fe31cbbea9e0a10b0d5e Changelog: https://curl.haxx.se/changes.html old sizes: libcurl_7.49.0-1_mips_34kc_dsp.ipk 97569 curl_7.49.0-1_mips_34kc_dsp.ipk 37925 new sizes: libcurl_7.50.0-1_mips_34kc_dsp.ipk 97578 curl_7.50.0-1_mips_34kc_dsp.ipk 38017 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 
Changelog: https://curl.haxx.se/changes.html

old sizes:
libcurl_7.49.0-1_mips_34kc_dsp.ipk      97569
curl_7.49.0-1_mips_34kc_dsp.ipk         37925

new sizes:
libcurl_7.50.0-1_mips_34kc_dsp.ipk      97578
curl_7.50.0-1_mips_34kc_dsp.ipk         38017

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
curl: remove axtls config option, the library does not exist in our tree 2016-05-19T14:56:34+00:00 Felix Fietkau nbd@nbd.name 2016-05-19T13:02:30+00:00 1d0d5ddb0771deba3e321fbe388e1e3587d4629f Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Signed-off-by: Felix Fietkau <nbd@nbd.name>
curl: update to 7.49 2016-05-19T14:56:34+00:00 Dirk Neukirchen dirkneukirchen@web.de 2016-05-19T11:27:41+00:00 6aebc6b16b3e2e7058b8b5ab1ffa7f65920541ff fixes: CVE-2016-3739: TLS certificate check bypass with mbedTLS/PolarSSL - remove crypto auth compile fix curl changelog of 7.46 states its fixed - fix mbedtls and cyassl usability #19621 : add path to certificate file (from Mozilla via curl) and provide this in a new package tested on ar71xx w. curl/mbedtls/wolfssl Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de> 
fixes:
 CVE-2016-3739: TLS certificate check bypass with mbedTLS/PolarSSL

- remove crypto auth compile fix
curl changelog of 7.46 states its fixed

- fix mbedtls and cyassl usability #19621 :
add path to certificate file (from Mozilla via curl) and
provide this in a new package

tested on ar71xx w. curl/mbedtls/wolfssl

Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
curl: add flags to allow gc-sections to strip out unused code 2016-04-17T12:51:57+00:00 Hauke Mehrtens hauke@hauke-m.de 2016-04-17T12:51:57+00:00 ba97a03d7d08bfd2a26ab2e7a83ef93dbf102cfe Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> SVN-Revision: 49184 
Signed-off-by: Dirk Feytons <dirk.feytons@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 49184