diff options
author | Patrick Monnerat <patrick@monnerat.net> | 2021-09-08 11:56:22 +0200 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2021-09-13 16:51:31 +0200 |
commit | 364f174724ef115c63d5e5dc1d3342c8a43b1cca (patch) | |
tree | 9856fb764ee026d4c55c9525496b541a79af7800 /lib/imap.c | |
parent | 43157490a5054bd24256fe12876931e8abc9df49 (diff) | |
download | curl-364f174724ef115c63d5e5dc1d3342c8a43b1cca.tar.gz |
ftp,imap,pop3: do not ignore --ssl-reqd
In imap and pop3, check if TLS is required even when capabilities
request has failed.
In ftp, ignore preauthentication (230 status of server greeting) if TLS
is required.
Bug: https://curl.se/docs/CVE-2021-22946.html
CVE-2021-22946
Diffstat (limited to 'lib/imap.c')
-rw-r--r-- | lib/imap.c | 24 |
1 files changed, 10 insertions, 14 deletions
diff --git a/lib/imap.c b/lib/imap.c index 359fc692e..923b1d59b 100644 --- a/lib/imap.c +++ b/lib/imap.c @@ -934,22 +934,18 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data, line += wordlen; } } - else if(imapcode == IMAP_RESP_OK) { - if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) { - /* We don't have a SSL/TLS connection yet, but SSL is requested */ - if(imapc->tls_supported) - /* Switch to TLS connection now */ - result = imap_perform_starttls(data, conn); - else if(data->set.use_ssl == CURLUSESSL_TRY) - /* Fallback and carry on with authentication */ - result = imap_perform_authentication(data, conn); - else { - failf(data, "STARTTLS not supported."); - result = CURLE_USE_SSL_FAILED; - } + else if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) { + /* PREAUTH is not compatible with STARTTLS. */ + if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) { + /* Switch to TLS connection now */ + result = imap_perform_starttls(data, conn); } - else + else if(data->set.use_ssl <= CURLUSESSL_TRY) result = imap_perform_authentication(data, conn); + else { + failf(data, "STARTTLS not available."); + result = CURLE_USE_SSL_FAILED; + } } else result = imap_perform_authentication(data, conn); |