diff --git a/meta/recipes-support/curl/curl/CVE-2026-8458.patch b/meta/recipes-support/curl/curl/CVE-2026-8458.patch new file mode 100644 index 0000000000..6340f5305f --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8458.patch @@ -0,0 +1,202 @@ +From 01ce94b67888e6efa4196247302e59cf68e77b2d Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Mon, 13 Jul 2026 23:13:37 -0700 +Subject: [PATCH] creds: add sasl service name + +The SASL service name, used in authentication, is part of curl's credentials +when authenticating to a server/proxy. Make it part of `struct Curl_creds`. + +Change code to use `creds` to obtain a service name. By tying creds used +to the connection, connection reuse is also only allowed when the service +name matches. + +Closes #21585 + +CVE: CVE-2026-8458 +Upstream-Status: Backport [https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d] + +Backport Changes: +- Wrynose curl 8.19.0 does not have upstream struct Curl_creds. + This backport stores the optional SASL service name on the existing + connectdata/proxy_info structures and compares it during connection + reuse for the same security behavior. +- Omitted the upstream unit1304 Curl_creds_create() signature + adjustment because Wrynose 8.19.0 does not contain Curl_creds. + +(cherry picked from commit 5e99b73cf441d9c369768b9cd48b5389b9a2503d) +Signed-off-by: Deepak Rathore +--- + lib/url.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++----- + lib/urldata.h | 2 ++ + 2 files changed, 58 insertions(+), 5 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +index 6c1375f8e3..35f467daf2 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -535,12 +535,15 @@ void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn) + Curl_safefree(conn->socks_proxy.user); + Curl_safefree(conn->http_proxy.passwd); + Curl_safefree(conn->socks_proxy.passwd); ++ Curl_safefree(conn->http_proxy.sasl_service_name); ++ Curl_safefree(conn->socks_proxy.sasl_service_name); + Curl_safefree(conn->http_proxy.host.rawalloc); /* http proxy name buffer */ + Curl_safefree(conn->socks_proxy.host.rawalloc); /* socks proxy name buffer */ + #endif + Curl_safefree(conn->user); + Curl_safefree(conn->passwd); + Curl_safefree(conn->sasl_authzid); ++ Curl_safefree(conn->sasl_service_name); + Curl_safefree(conn->options); + Curl_safefree(conn->oauth_bearer); + Curl_safefree(conn->host.rawalloc); /* hostname buffer */ +@@ -593,7 +596,9 @@ static bool proxy_info_matches(const struct proxy_info *data, + curl_strequal(data->host.name, needle->host.name)) { + + if(Curl_timestrcmp(data->user, needle->user) || +- Curl_timestrcmp(data->passwd, needle->passwd)) ++ Curl_timestrcmp(data->passwd, needle->passwd) || ++ Curl_timestrcmp(data->sasl_service_name, ++ needle->sasl_service_name)) + return FALSE; + return TRUE; + } +@@ -1035,6 +1040,8 @@ static bool url_match_auth(struct connectdata *conn, + if(Curl_timestrcmp(m->needle->user, conn->user) || + Curl_timestrcmp(m->needle->passwd, conn->passwd) || + Curl_timestrcmp(m->needle->sasl_authzid, conn->sasl_authzid) || ++ Curl_timestrcmp(m->needle->sasl_service_name, ++ conn->sasl_service_name) || + Curl_timestrcmp(m->needle->oauth_bearer, conn->oauth_bearer)) { + /* one of them was different */ + return FALSE; +@@ -1116,7 +1123,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn, + partway through a handshake!) */ + if(m->want_ntlm_http) { + if(Curl_timestrcmp(m->needle->user, conn->user) || +- Curl_timestrcmp(m->needle->passwd, conn->passwd)) { ++ Curl_timestrcmp(m->needle->passwd, conn->passwd) || ++ Curl_timestrcmp(m->needle->sasl_service_name, ++ conn->sasl_service_name)) { + /* we prefer a credential match, but this is at least a connection + that can be reused and "upgraded" to NTLM if it does + not have any auth ongoing. */ +@@ -1147,7 +1156,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn, + if(Curl_timestrcmp(m->needle->http_proxy.user, + conn->http_proxy.user) || + Curl_timestrcmp(m->needle->http_proxy.passwd, +- conn->http_proxy.passwd)) ++ conn->http_proxy.passwd) || ++ Curl_timestrcmp(m->needle->http_proxy.sasl_service_name, ++ conn->http_proxy.sasl_service_name)) + return FALSE; + } + else if(conn->proxy_ntlm_state != NTLMSTATE_NONE) { +@@ -1188,7 +1199,9 @@ static bool url_match_auth_nego(struct connectdata *conn, + so that we can reuse Negotiate connections if possible. */ + if(m->want_nego_http) { + if(Curl_timestrcmp(m->needle->user, conn->user) || +- Curl_timestrcmp(m->needle->passwd, conn->passwd)) ++ Curl_timestrcmp(m->needle->passwd, conn->passwd) || ++ Curl_timestrcmp(m->needle->sasl_service_name, ++ conn->sasl_service_name)) + return FALSE; + } + else if(conn->http_negotiate_state != GSS_AUTHNONE) { +@@ -1207,7 +1220,9 @@ static bool url_match_auth_nego(struct connectdata *conn, + if(Curl_timestrcmp(m->needle->http_proxy.user, + conn->http_proxy.user) || + Curl_timestrcmp(m->needle->http_proxy.passwd, +- conn->http_proxy.passwd)) ++ conn->http_proxy.passwd) || ++ Curl_timestrcmp(m->needle->http_proxy.sasl_service_name, ++ conn->http_proxy.sasl_service_name)) + return FALSE; + } + else if(conn->proxy_negotiate_state != GSS_AUTHNONE) { +@@ -3196,6 +3211,11 @@ static void url_conn_reuse_adjust(struct Curl_easy *data, + needle->user = NULL; + needle->passwd = NULL; + } ++ if(needle->sasl_service_name) { ++ curlx_free(conn->sasl_service_name); ++ conn->sasl_service_name = needle->sasl_service_name; ++ needle->sasl_service_name = NULL; ++ } + + #ifndef CURL_DISABLE_PROXY + conn->bits.proxy_user_passwd = needle->bits.proxy_user_passwd; +@@ -3214,6 +3234,17 @@ static void url_conn_reuse_adjust(struct Curl_easy *data, + needle->http_proxy.passwd = NULL; + needle->socks_proxy.passwd = NULL; + } ++ if(needle->http_proxy.sasl_service_name || ++ needle->socks_proxy.sasl_service_name) { ++ curlx_free(conn->http_proxy.sasl_service_name); ++ curlx_free(conn->socks_proxy.sasl_service_name); ++ conn->http_proxy.sasl_service_name = ++ needle->http_proxy.sasl_service_name; ++ conn->socks_proxy.sasl_service_name = ++ needle->socks_proxy.sasl_service_name; ++ needle->http_proxy.sasl_service_name = NULL; ++ needle->socks_proxy.sasl_service_name = NULL; ++ } + #endif + + /* Finding a connection for reuse in the cpool matches, among other +@@ -3283,6 +3314,15 @@ static CURLcode url_create_needle(struct Curl_easy *data, + } + } + ++ if(data->set.str[STRING_SERVICE_NAME]) { ++ needle->sasl_service_name = ++ curlx_strdup(data->set.str[STRING_SERVICE_NAME]); ++ if(!needle->sasl_service_name) { ++ result = CURLE_OUT_OF_MEMORY; ++ goto out; ++ } ++ } ++ + if(data->set.str[STRING_BEARER]) { + needle->oauth_bearer = curlx_strdup(data->set.str[STRING_BEARER]); + if(!needle->oauth_bearer) { +@@ -3310,6 +3350,17 @@ static CURLcode url_create_needle(struct Curl_easy *data, + if(result) + goto out; + ++ if(data->set.str[STRING_PROXY_SERVICE_NAME]) { ++ result = Curl_setstropt(&needle->http_proxy.sasl_service_name, ++ data->set.str[STRING_PROXY_SERVICE_NAME]); ++ if(result) ++ goto out; ++ result = Curl_setstropt(&needle->socks_proxy.sasl_service_name, ++ data->set.str[STRING_PROXY_SERVICE_NAME]); ++ if(result) ++ goto out; ++ } ++ + /************************************************************* + * If the protocol is using SSL and HTTP proxy is used, we set + * the tunnel_proxy bit. +diff --git a/lib/urldata.h b/lib/urldata.h +index 6c6c83969c..1c369a54f2 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -586,6 +586,7 @@ struct proxy_info { + uint8_t proxytype; /* what kind of proxy that is in use */ + char *user; /* proxy username string, allocated */ + char *passwd; /* proxy password string, allocated */ ++ char *sasl_service_name; /* SASL service name, allocated */ + }; + + /* +@@ -628,6 +629,7 @@ struct connectdata { + char *passwd; /* password string, allocated */ + char *options; /* options string, allocated */ + char *sasl_authzid; /* authorization identity string, allocated */ ++ char *sasl_service_name; /* SASL service name, allocated */ + char *oauth_bearer; /* OAUTH2 bearer, allocated */ + struct curltime created; /* creation time */ + struct curltime lastused; /* when returned to the connection poolas idle */ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 994b1cff28..33ccb73eb3 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -27,6 +27,7 @@ SRC_URI = " \ file://CVE-2026-8927.patch \ file://CVE-2026-8932-dependent.patch \ file://CVE-2026-8932.patch \ + file://CVE-2026-8458.patch \ " SRC_URI:append:class-nativesdk = " \