manually backported the patch

Author: BinduSri-6522866

SPECS/cmake/CVE-2025-14017.patch

@@ -8,32 +8,30 @@ Closes #19830
 Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
 Upstream-reference: AI Backport of https://github.com/curl/curl/commit/39d1976b7f709a516e324333.patch
 ---
- Utilities/cmcurl/lib/ldap.c | 35 +++++++++++++++++++++--------------
- 1 file changed, 21 insertions(+), 14 deletions(-)
+ Utilities/cmcurl/lib/ldap.c | 49 ++++++++++++++-----------------------
+ 1 file changed, 19 insertions(+), 30 deletions(-)
 
 diff --git a/Utilities/cmcurl/lib/ldap.c b/Utilities/cmcurl/lib/ldap.c
-index 678b4d5a..7c0f69c1 100644
+index 678b4d5a..b664e991 100644
 --- a/Utilities/cmcurl/lib/ldap.c
 +++ b/Utilities/cmcurl/lib/ldap.c
-@@ -364,16 +364,31 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
+@@ -364,16 +364,29 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
      passwd = conn->passwd;
    }
 
-+#if defined(USE_WIN32_LDAP)
++#ifdef USE_WIN32_LDAP
 +  if(ldap_ssl)
 +    server = ldap_sslinit(host, conn->primary.remote_port, 1);
 +  else
-+    server = ldap_init(host, conn->primary.remote_port);
 +#else
-+  server = ldap_init(host, conn->primary.remote_port);
++    server = ldap_init(host, conn->primary.remote_port);
 +#endif
 +  if(!server) {
-+    failf(data, "LDAP local: Cannot connect to %s:%u",
++    failf(data, "LDAP: cannot setup connect to %s:%u",
 +          conn->host.dispname, conn->primary.remote_port);
 +    result = CURLE_COULDNT_CONNECT;
 +    goto quit;
 +  }
-+
 +
  #ifdef LDAP_OPT_NETWORK_TIMEOUT
 -  ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
@@ -50,7 +48,7 @@ index 678b4d5a..7c0f69c1 100644
      ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
  #else
      int ldap_option;
-@@ -441,7 +456,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
+@@ -441,7 +454,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
          goto quit;
        }
        infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
@@ -59,7 +57,7 @@ index 678b4d5a..7c0f69c1 100644
        if(rc != LDAP_SUCCESS) {
          failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
                  ldap_err2string(rc));
-@@ -453,7 +468,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
+@@ -453,20 +466,13 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
      else
        ldap_option = LDAP_OPT_X_TLS_NEVER;
 
@@ -68,7 +66,36 @@ index 678b4d5a..7c0f69c1 100644
      if(rc != LDAP_SUCCESS) {
        failf(data, "LDAP local: ERROR setting cert verify mode: %s",
                ldap_err2string(rc));
-@@ -502,15 +517,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
+       result = CURLE_SSL_CERTPROBLEM;
+       goto quit;
+     }
+-    server = ldap_init(host, conn->primary.remote_port);
+-    if(!server) {
+-      failf(data, "LDAP local: Cannot connect to %s:%u",
+-            conn->host.dispname, conn->primary.remote_port);
+-      result = CURLE_COULDNT_CONNECT;
+-      goto quit;
+-    }
+     ldap_option = LDAP_OPT_X_TLS_HARD;
+     rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
+     if(rc != LDAP_SUCCESS) {
+@@ -475,15 +481,6 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
+       result = CURLE_SSL_CERTPROBLEM;
+       goto quit;
+     }
+-/*
+-    rc = ldap_start_tls_s(server, NULL, NULL);
+-    if(rc != LDAP_SUCCESS) {
+-      failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
+-              ldap_err2string(rc));
+-      result = CURLE_SSL_CERTPROBLEM;
+-      goto quit;
+-    }
+-*/
+ #else
+     (void)ldap_option;
+     (void)ldap_ca;
+@@ -502,15 +499,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
      result = CURLE_NOT_BUILT_IN;
      goto quit;
    }
@@ -81,7 +108,7 @@ index 678b4d5a..7c0f69c1 100644
 -      goto quit;
 -    }
 -  }
-+  
++
  #ifdef USE_WIN32_LDAP
    ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
    rc = ldap_win_bind(data, server, user, passwd);