mirror of
https://github.com/curl/curl.git
synced 2024-12-15 06:40:09 +08:00
364f174724
In imap and pop3, check if TLS is required even when capabilities request has failed. In ftp, ignore preauthentication (230 status of server greeting) if TLS is required. Bug: https://curl.se/docs/CVE-2021-22946.html CVE-2021-22946
57 lines
932 B
Plaintext
57 lines
932 B
Plaintext
<testcase>
|
|
<info>
|
|
<keywords>
|
|
IMAP
|
|
STARTTLS
|
|
</keywords>
|
|
</info>
|
|
|
|
#
|
|
# Server-side
|
|
<reply>
|
|
<servercmd>
|
|
REPLY CAPABILITY A001 BAD Not implemented
|
|
</servercmd>
|
|
</reply>
|
|
|
|
#
|
|
# Client-side
|
|
<client>
|
|
<features>
|
|
SSL
|
|
</features>
|
|
<server>
|
|
imap
|
|
</server>
|
|
<name>
|
|
IMAP require STARTTLS with failing capabilities
|
|
</name>
|
|
<command>
|
|
imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T log/upload%TESTNUMBER -u user:secret --ssl-reqd
|
|
</command>
|
|
<file name="log/upload%TESTNUMBER">
|
|
Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
|
|
From: Fred Foobar <foobar@example.COM>
|
|
Subject: afternoon meeting
|
|
To: joe@example.com
|
|
Message-Id: <B27397-0100000@example.COM>
|
|
MIME-Version: 1.0
|
|
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
|
|
|
|
Hello Joe, do you think we can meet at 3:30 tomorrow?
|
|
</file>
|
|
</client>
|
|
|
|
#
|
|
# Verify data after the test has been "shot"
|
|
<verify>
|
|
# 64 is CURLE_USE_SSL_FAILED
|
|
<errorcode>
|
|
64
|
|
</errorcode>
|
|
<protocol>
|
|
A001 CAPABILITY
|
|
</protocol>
|
|
</verify>
|
|
</testcase>
|