diff mbox series

[scarthgap,v2,1/5] curl: fix CVE-2026-4873

Message ID 20260804103305.1180770-1-deeratho@cisco.com
State New
Headers show
Series [scarthgap,v2,1/5] curl: fix CVE-2026-4873 | expand

Commit Message

Deepak Rathore Aug. 4, 2026, 10:33 a.m. UTC 
From: Deepak Rathore <deeratho@cisco.com>

This patch applies the upstream backport for CVE-2026-4873.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].

[1] https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865
[2] https://curl.se/docs/CVE-2026-4873.html

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Rebase the patches on top of scarthgap latest
fixes and updated the patch to include the fixed commit instead of
CVE_STATUS as per Paul's suggestion in Wrynose series.
 .../curl/curl/CVE-2026-4873.patch             | 58 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 59 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-4873.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-4873.patch b/meta/recipes-support/curl/curl/CVE-2026-4873.patch
new file mode 100644
index 0000000000..bc6268da7d
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-4873.patch
@@ -0,0 +1,58 @@ 
+From a7e6dd14ee3900226066819a0334defb58c52486 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 28 Jul 2026 04:35:55 -0700
+Subject: [PATCH] url: do not reuse a non-tls starttls connection if new
+ requires TLS
+
+Reported-by: Arkadi Vainbrand
+
+Closes #21082
+
+CVE: CVE-2026-4873
+Upstream-Status: Backport [https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865]
+
+Backport Changes:
+- Upstream adds req_tls to struct url_conn_match, sets match.req_tls in
+  url_attach_existing(), and enforces it in url_match_ssl_use() when a
+  clear-text requested scheme is matched with a candidate connection
+  that is not actually using TLS.
+- Scarthgap curl 8.7.1 does not have struct url_conn_match or the
+  url_attach_existing()/url_match_ssl_use() split. The equivalent reuse
+  matching still happens directly in ConnectionExists(), so this backport
+  keeps the same state in a local req_tls variable derived from
+  data->set.use_ssl.
+- The rejection check is placed after the general SSL compatibility
+  check and uses Curl_conn_is_ssl(check, FIRSTSOCKET). This preserves
+  valid implicit-TLS IMAPS/POP3S/SMTPS reuse while still rejecting a
+  clear-text STARTTLS-capable cached connection for a request that
+  requires TLS.
+
+(cherry picked from commit 507e7be573b0a76fca597b75ff7cb27a66e7d865)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/url.c b/lib/url.c
+index 30f215f..c4c5982 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,6 +935,7 @@ ConnectionExists(struct Curl_easy *data,
+   /* plain HTTP with upgrade */
+   bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
+     (needle->handler->protocol & CURLPROTO_HTTP);
++  bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
+ 
+   *usethis = NULL;
+   *force_reuse = FALSE;
+@@ -1052,6 +1053,10 @@ ConnectionExists(struct Curl_easy *data,
+         /* except protocols that have been upgraded via TLS */
+         continue;
+ 
++    if(!(needle->handler->flags & PROTOPT_SSL) &&
++       req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
++      continue;
++
+     if(needle->bits.conn_to_host != check->bits.conn_to_host)
+       /* don't mix connections that use the "connect to host" feature and
+        * connections that don't use this feature */
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 276526f01e..043143d30d 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -38,6 +38,7 @@  SRC_URI = " \
     file://CVE-2026-3784.patch \
     file://CVE-2026-5773.patch \
     file://CVE-2026-6276.patch \
+    file://CVE-2026-4873.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \