mtk-20170518/package/network/utils/curl, branch v17.01.5

mbedtls: change libmbedcrypto.so soversion back to 0

2018-04-14T12:44:43+00:00

mbedtls changed in version 2.7.0 and 2.7.2 the soversion of the
libmbedcrypto.so library, use the old version again to be able to use
the new library with binaries compiled against the old mbedtls library.

Some binaries got rebuild to for the 2.7.0 release and are now using
libmbedcrypto.so.1, the older ones are still using libmbedcrypto.so.0.
Go back to libmbedcrypto.so.0 and make the system rebuild the binaries
which were rebuild for 2.7.0 again.

This should make the libmbedcrypto.so library be compatible with the old
version shipped with 17.01.

Fixes: 3ca1438ae0 ("mbedtls: update to version 2.7.2")
Fixes: f609913b5c ("mbedtls: update to version 2.7.0")
Signed-off-by: Hauke Mehrtens

mbedtls: update to version 2.7.0

2018-03-10T17:37:04+00:00

This fixes the following security problems:
* CVE-2018-0488: Risk of remote code execution when truncated HMAC is enabled
* CVE-2018-0487: Risk of remote code execution when verifying RSASSA-PSS signatures

This release is also ABI incompatible with the previous one, but it is
API compatible.

Some functions used by a lot of other software was renamed and the old
function names are provided as a static inline now, but they are only
active when deprecated functions are allowed, deactivate the removal of
deprecated functions for now.

Also increase the PKG_RELEASE version to force a rebuild and update of
packages depending on mbedtls to handle the changed ABI.

Signed-off-by: Hauke Mehrtens

curl: fix libcurl/mbedtls async interface

2018-01-24T08:25:32+00:00

When using mbedtls, curl's nonblocking interface will report a request
as done immediately after the socket is written to and never read from
the connection.  This will result in a HTTP status code of 0 and zero
length replies.  Cherry-pick the patch from curl 7.53.0 to fix this
(https://github.com/curl/curl/commit/b993d2cc).

Fixes https://bugs.openwrt.org/index.php?do=details&task_id=1285.

Signed-off-by: Darren Tucker

curl: apply CVE 2017-8816 and 2017-8817 security patches

2017-12-04T10:10:31+00:00

This commit adds the upstream patches for CVE 2017-8816 and 2017-8817 to the 17.01
Curl package.

Compile-tested on ar71xx, ramips and x86.

Signed-off-by: Stijn Segers

curl: fix security problems

2017-09-30T13:27:29+00:00

This fixes the following security problems:
 * CVE-2017-1000100 TFTP sends more than buffer size
 * CVE-2017-1000101 URL globbing out of bounds read

Signed-off-by: Hauke Mehrtens

curl: fix CVE-2017-7407 and CVE-2017-7468

2017-07-28T21:49:39+00:00

This fixes the following security problems:
* CVE-2017-7407: https://curl.haxx.se/docs/adv_20170403.html
* CVE-2017-7468: https://curl.haxx.se/docs/adv_20170419.html

Signed-off-by: Hauke Mehrtens

curl: fix CVE-2017-2629 SSL_VERIFYSTATUS ignored

2017-03-13T21:51:20+00:00

This fixes the following security problem:
https://curl.haxx.se/docs/adv_20170222.html

Signed-off-by: Hauke Mehrtens

curl: fix HTTPS network timeouts with OpenSSL

2017-01-16T18:41:08+00:00

Backport an upstream change to fix HTTPS timeouts with OpenSSL.
Upstream curl bug #1174.

Signed-off-by: Stijn Segers 
[Jo-Philipp Wich: reword commit message, rename patch to 001-*]
Signed-off-by: Jo-Philipp Wich

curl: Remove PolarSSL and adjust default to mbedTLS

2017-01-03T13:26:41+00:00

luci-ssl has already made the switch since mainline support for PolarSSL is
almost over (2016).

Signed-off-by: Rosen Penev

curl: update to version 7.52.1

2017-01-02T12:07:10+00:00

This fixes the folowing security problems:

CVE-2016-9586: printf floating point buffer overflow
CVE-2016-9952: Win CE schannel cert wildcard matches too much
CVE-2016-9953: Win CE schannel cert name out of buffer read
CVE-2016-9594: unititialized random

Signed-off-by: Hauke Mehrtens