From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 10 Dec 2025 10:40:47 +0000 (+0100)
Subject: [PATCH] curl_sasl: if redirected, require permission to use bearer
X-Git-Tag: archive/raspbian/7.88.1-10+rpi1+deb12u15^2~12
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=47e36cfbe1151972715b014a4f658b405b60d660;p=curl.git

[PATCH] curl_sasl: if redirected, require permission to use bearer

Closes #19933

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/curl_sasl.c

Backported by: Samuel Henrique <samueloph@debian.org>
 * Refresh line numbers for bookworm 7.88.1: same functions
   (Curl_sasl_start and Curl_sasl_continue), -7 line offset.

Gbp-Pq: Name CVE-2025-14524.patch
---

diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
index 119fb9b2..2dd6b00b 100644
--- a/lib/curl_sasl.c
+++ b/lib/curl_sasl.c
@@ -349,7 +349,10 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
 #endif
-  const char *oauth_bearer = data->set.str[STRING_BEARER];
+  const char *oauth_bearer =
+    (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
+    data->set.str[STRING_BEARER] : NULL;
+
   struct bufref nullmsg;
 
   Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
@@ -536,7 +539,10 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
 #endif
-  const char *oauth_bearer = data->set.str[STRING_BEARER];
+  const char *oauth_bearer =
+    (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
+    data->set.str[STRING_BEARER] : NULL;
+
   struct bufref serverdata;
 
   Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);