source: trunk/server/fedora/specs/curl.spec.patch @ 1922

tmp/t/curl.spec

@@ -1 +1 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 7.20.1
-Release: 5%{?dist}
+Release: 5.scripts.%{scriptsversion}%{?dist}
 License: MIT
 Group: Applications/Internet
 Source: http://curl.haxx.se/download/%{name}-%{version}.tar.lzma
@@ -90 +90 @@
 # workaround for broken applications using curl multi (#599340)
 Patch108: 0108-curl-7.20.1-threaded-dns-multi.patch
 
+# disable credential delegation over Negotiate (CVE-2011-2192)
+Patch1000: curl-gssapi-delegation.patch
+
 Provides: webclient
 URL: http://curl.haxx.se/
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -190 +193 @@
 %patch105 -p1
 %patch106 -p1
 %patch108 -p1
+%patch1000 -p1
 
 # other patches
 %patch15 -p1
@@ -289 +293 @@
 %{_datadir}/aclocal/libcurl.m4
 
 %changelog
+* Fri Jul 01 2011 Geoffrey Thomas <geofft@mit.edu> 7.20.1-5.scripts.r1922
+- disable credential delegation over Negotiate (CVE-2011-2192)
+  Patch from upstream: http://curl.haxx.se/docs/adv_20110623.html
+
 * Fri Nov 26 2010 Kamil Dudka <kdudka@redhat.com> 7.20.1-5
 - do not send QUIT to a dead FTP control connection (#650255)
 - prevent FTP client from hanging on unrecognized ABOR response (#649347)