mbox series

[wrynose,0/8] curl: Security fixes

Message ID 20260805083103.2633995-1-deeratho@cisco.com
Headers show
Series curl: Security fixes | expand

Message

Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 5, 2026, 8:30 a.m. UTC 
From: Deepak Rathore <deeratho@cisco.com>

This series addresses multiple curl security vulnerabilities affecting
the curl 8.19.0 version provided by the Wrynose branch.

Five changes backport upstream security fixes:

- CVE-2026-8286: Include TLS configuration when matching connections
  that may be upgraded using STARTTLS.
- CVE-2026-8927: Clear Digest authentication state when an
  environment-configured proxy changes.
- CVE-2026-8932: Include the complete mTLS client credential
  configuration in connection reuse and TLS session-cache matching.
- CVE-2026-8458: Include the SASL service name in connection reuse
  matching.
- CVE-2026-11856: Clear Digest authentication state when the origin,
  proxy, or credentials change.

Three changes add CVE_STATUS annotations for vulnerabilities whose
applicability depends on the Wrynose curl configuration:

- CVE-2026-8924 is not applicable because the recipe explicitly builds
    curl without Public Suffix List support using --without-libpsl.
- CVE-2026-9547 is not applicable because the vulnerable libssh backend
  is not available in the recipe. The supported libssh2 backend is not
  affected.
- CVE-2026-12064 is marked unpatched when the optional libssh2
  PACKAGECONFIG is enabled and not-applicable-config otherwise, because
  the affected SCP/SFTP support is provided through libssh2.

The manual adaptations required for curl 8.19.0 are documented in the
Backport Changes sections of the corresponding source patches.

Validation performed:

- All the curl patches are prepared on top of this upstream curl patch which is
under review: https://lists.openembedded.org/g/openembedded-core/topic/120530931
- All recipe changes apply using git am without three-way fallback.
- All existing Wrynose patches and the proposed source patches apply to
  the checksum-verified curl 8.19.0 source with no fuzz.
- A host build using the GnuTLS backend completed successfully.
- Regression tests 1686, 3303, and 3304 passed.

Deepak Rathore (8):
  curl: fix CVE-2026-8286
  curl: set CVE_STATUS for CVE-2026-8924
  curl: fix CVE-2026-8927
  curl: fix CVE-2026-8932
  curl: fix CVE-2026-8458
  curl: fix CVE-2026-11856
  curl: set CVE_STATUS for CVE-2026-9547
  curl: set CVE_STATUS for CVE-2026-12064

 .../curl/curl/CVE-2026-11856_p1.patch         |  372 ++++++
 .../curl/curl/CVE-2026-11856_p2.patch         |   72 ++
 .../curl/curl/CVE-2026-8286.patch             |   81 ++
 .../curl/curl/CVE-2026-8458.patch             |  202 +++
 .../curl/curl/CVE-2026-8927.patch             |  349 +++++
 .../curl/curl/CVE-2026-8932-dependent.patch   |   71 +
 .../curl/curl/CVE-2026-8932.patch             | 1148 +++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   11 +
 8 files changed, 2306 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11856_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11856_p2.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8458.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch