curl: CVE-2022-32207: Unpreserved file permissions

Summary: Curl fails to preserve file permissions when writing: - CURLOPT_COOKIEJAR database - CURLOPT_ALTSVC database - CURLOPT_HSTS database Instead the permissions is always reset to 0666 & ~umask if the file is updated. As a result a file that was before protected against read access by other users becomes other user readable (as long as umask doesn't have bit 2 set). Out of these files only the CURLOPT_COOKIEJAR is likely to contain sensitive information. In addition curl will replace softlink to the database with locally written database, or if the application is run privileged, specifying "/dev/null" as a file name can lead to system overwriting the special file and result in inoperable system. This is CWE-281: Improper Preservation of Permissions Steps To Reproduce: umask 022 install -m 600 /dev/null cookie.db curl -b cookie.db -c cookie.db https://google.com ls -l cookie.db At least for CURLOPT_COOKIEJAR this vulnerability was introduced in https://github.com/curl/curl/commit/b834890a3fa3f525cd8ef4e99554cdb4558d7e1b - this change was introduced to fix a issue https://github.com/curl/curl/issues/4914 Fix recommendations If a file file is created and moved over a the old one, only do this if the file is regular file. Anything else is likely going to end up causing unexpected behaviour, outright failing, or if the user has high enough permissions, damage to the operating system. Safe cloning of file permissions can only be achieved if the owner / group of the file...