curl / Mailing Lists / curl-users / Single Mail

curl-users

[RELEASE] curl 7.62.0

From: Daniel Stenberg <daniel_at_haxx.se>
Date: Wed, 31 Oct 2018 07:55:33 +0100 (CET)

Hi friends!

I'm thrilled and happy to announce this extra feature-packed version of curl.
More changes and bug-fixes than usual and with no less than three security
vulnerabilities addressed. As always, get it from:

https://curl.haxx.se/

Curl and libcurl 7.62.0

  Public curl releases: 177
  Command line options: 219
  curl_easy_setopt() options: 261
  Public functions in libcurl: 80
  Contributors: 1808

This release includes the following changes:

  o multiplex: enable by default [4]
  o url: default to CURL_HTTP_VERSION_2TLS if built h2-enabled [4]
  o setopt: add CURLOPT_DOH_URL [7]
  o curl: --doh-url added [7]
  o setopt: add CURLOPT_UPLOAD_BUFFERSIZE: set upload buffer size [8]
  o imap: change from "FETCH" to "UID FETCH" [9]
  o configure: add option to disable automatic OpenSSL config loading [10]
  o upkeep: add a connection upkeep API: curl_easy_upkeep() [11]
  o URL-API: added five new functions [12]
  o vtls: MesaLink is a new TLS backend [23]

This release includes the following bugfixes:

  o CVE-2018-16839: SASL password overflow via integer overflow [107]
  o CVE-2018-16840: use-after-free in handle close [108]
  o CVE-2018-16842: warning message out-of-buffer read [114]
  o CURLOPT_DNS_USE_GLOBAL_CACHE: deprecated [5]
  o Curl_dedotdotify(): always nul terminate returned string [46]
  o Curl_follow: Always free the passed new URL [87]
  o Curl_http2_done: fix memleak in error path [51]
  o Curl_retry_request: fix memory leak [49]
  o Curl_saferealloc: Fixed typo in docblock [40]
  o FILE: fix CURLOPT_NOBODY and CURLOPT_HEADER output [78]
  o GnutTLS: TLS 1.3 support [39]
  o SECURITY-PROCESS: mention the bountygraph program [42]
  o VS projects: add USE_IPV6: [91]
  o Windows: fixes for MinGW targeting Windows Vista [82]
  o anyauthput: fix compiler warning on 64-bit Windows [21]
  o appveyor: add WinSSL builds [81]
  o appveyor: run test suite (on Windows!) [65]
  o certs: generate tests certs with sha256 digest algorithm [37]
  o checksrc: enable strict mode and warnings [63]
  o checksrc: handle zero scoped ignore commands [62]
  o cmake: Backport to work with CMake 3.0 again [55]
  o cmake: Improve config installation [60]
  o cmake: add support for transitive ZLIB target [113]
  o cmake: disable -Wpedantic-ms-format [84]
  o cmake: don't require OpenSSL if USE_OPENSSL=OFF [35]
  o cmake: fixed path used in generation of docs/tests [56]
  o cmake: remove unused *SOCKLEN_T variables [102]
  o cmake: suppress MSVC warning C4127 for libtest
  o cmake: test and set missed defines during configuration [64]
  o comment: Fix multiple typos in function parameters [69]
  o config: Remove unused SIZEOF_VOIDP [104]
  o config_win32: enable LDAPS [92]
  o configure: force-use -lpthreads on HPUX [41]
  o configure: remove CURL_CONFIGURE_CURL_SOCKLEN_T [101]
  o configure: s/AC_RUN_IFELSE/CURL_RUN_IFELSE [53]
  o cookies: Remove redundant expired check [14]
  o cookies: fix leak when writing cookies to file [15]
  o curl-config.in: remove dependency on bc [99]
  o curl.1: --ipv6 mutexes ipv4 (fixed typo) [98]
  o curl: enabled Windows VT Support and UTF-8 output [57]
  o curl: update the documentation of --tlsv1.0 [17]
  o curl_multi_wait: call getsock before figuring out timeout [34]
  o curl_ntlm_wb: check aprintf() return codes [75]
  o curl_threads: fix classic MinGW compile break [54]
  o darwinssl: Fix realloc memleak [32]
  o darwinssl: more specific and unified error codes [6]
  o data-binary.d: clarify default content-type is x-www-form-urlencoded [71]
  o docs/BUG-BOUNTY: explain the bounty program [76]
  o docs/CIPHERS: Mention the options used to set TLS 1.3 ciphers [89]
  o docs/CIPHERS: fix the TLS 1.3 cipher names [95]
  o docs/CIPHERS: mention the colon separation for OpenSSL [73]
  o docs/examples: URL updates [45]
  o docs: add "see also" links for SSL options [85]
  o example/asiohiper: insert warning comment about its status [18]
  o example/htmltidy: fix include paths of tidy libraries [52]
  o examples/Makefile.m32: sync with core [44]
  o examples/http2-pushinmemory: receive HTTP/2 pushed files in memory [33]
  o examples/parseurl.c: show off the URL API [43]
  o examples: Fix memory leaks from realloc errors [31]
  o examples: do not wait when no transfers are running [16]
  o ftp: include command in Curl_ftpsend sendbuffer [25]
  o gskit: make sure to terminate version string [79]
  o gtls: Values stored to but never read [97]
  o hostip: fix check on Curl_shuffle_addr return value [77]
  o http2: fix memory leaks on error-path [29]
  o http: fix memleak in rewind error path [50]
  o krb5: fix memory leak in krb_auth [25]
  o ldap: show precise LDAP call in error message on Windows [83]
  o lib: fix gcc8 warning on Windows [20]
  o memory: add missing curl_printf header [30]
  o memory: ensure to check allocation results [68]
  o multi: Fix error handling in the SENDPROTOCONNECT state [112]
  o multi: fix memory leak in content encoding related error path [59]
  o multi: make the closure handle "inherit" CURLOPT_NOSIGNAL [90]
  o netrc: free temporary strings if memory allocation fails [103]
  o nss: fix nssckbi module loading on Windows [70]
  o nss: try to connect even if libnssckbi.so fails to load [36]
  o ntlm_wb: Fix memory leaks in ntlm_wb_response [24]
  o ntlm_wb: bail out if the response gets overly large [13]
  o openssl: assume engine support in 0.9.8 or later [27]
  o openssl: enable TLS 1.3 post-handshake auth [47]
  o openssl: fix gcc8 warning [19]
  o openssl: load built-in engines too [48]
  o openssl: make 'done' a proper boolean [97]
  o openssl: output the correct cipher list on TLS 1.3 error [95]
  o openssl: return CURLE_PEER_FAILED_VERIFICATION on failure to parse issuer [6]
  o openssl: show "proper" version number for libressl builds [28]
  o pipelining: deprecated [1]
  o rand: add comment to skip a clang-tidy false positive
  o rtmp: fix for compiling with lwIP [100]
  o runtests: ignore disabled even when ranges are given [74]
  o runtests: skip ld_preload tests on macOS [80]
  o runtests: use Windows paths for Windows curl
  o schannel: unified error code handling [6]
  o sendf: Fix whitespace in infof/failf concatenation [26]
  o ssh: free the session on init failures [96]
  o ssl: deprecate CURLE_SSL_CACERT in favour of a unified error code [6]
  o system.h: use proper setting with Sun C++ as well [109]
  o test1299: use single quotes around asterisk [72]
  o test1452: mark as flaky [2]
  o test1651: unit test Curl_extract_certinfo() [110]
  o test320: strip out more HTML when comparing [66]
  o tests/negtelnetserver.py: fix Python2-ism in neg TELNET server [67]
  o tests: add unit tests for url.c [3]
  o timeval: fix use of weak symbol clock_gettime() on Apple platforms [61]
  o tool_cb_hdr: handle failure of rename() [94]
  o travis: add a "make tidy" build that runs clang-tidy [105]
  o travis: add build for "configure --disable-verbose" [93]
  o travis: bump the Secure Transport build to use xcode [58]
  o travis: make distcheck scan for BOM markers [86]
  o unit1300: fix stack-use-after-scope AddressSanitizer warning [106]
  o urldata: Fix "connecting" comment
  o urlglob: improve error message on bad globs [22]
  o vtls: fix ssl version "or later" behavior change for many backends [38]
  o x509asn1: Fix SAN IP address verification [88]
  o x509asn1: always check return code from getASN1Element() [110]
  o x509asn1: return CURLE_PEER_FAILED_VERIFICATION on failure to parse cert [6]
  o x509asn1: suppress left shift on signed value [111]

This release includes the following known bugs:

o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html)

This release would not have looked like this without help, code, reports and
advice from friends like these:

   Alexey Eremikhin, Brad King, Brian Carpenter, Christian Heimes, Colin Hogben,
   Daniel Gustafsson, Daniel Shahaf, Daniel Stenberg, Dario Wei�er,
   Dave Reisner, Dima Pasechnik, Dmitry Kostjuchenko, Doron Behar,
   Eason-Yu on github, Erik Minekus, Even Rouault, Gisle Vanem, Han Han,
   Harry Sintonen, jakirkham on github, Jean Fabrice, Jim Fuller, Kamil Dudka,
   Loganaden Velvindron, Marcel Raad, Marc H�rsken, Martin Ankerl,
   Matthew Whitehead, Max Dymond, Maxime Legros, Michael Kaufmann, Nate Prewitt,
   Nicklas Av�n, Nick Zitzmann, Patrick Monnerat, Philipp Waehnert, Rainer Jung,
   Ray Satiro, Rich Turner, Rick Deist, Ricky-Tigg on github, Rikard Falkeborn,
   Ruslan Baratov, Sergei Nikulov, Shaun Jackman, Thomas Glanzmann, Tuomo Rinne,
   Viktor Szakats, Yiming Jing,
   (49 contributors)

Thanks! (and sorry if I forgot to mention someone)

References to bug reports and discussions on issues:

-- 
  / daniel.haxx.se

-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2018-10-31

This message: [ Message body ]
Next message: Daniel Stenberg: "[SECURITY ADVISORY] curl - SASL password overflow via integer overflow"
Previous message: 王岩: "curl get stuck when connect to and from the same ip/port"

Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]