From patchwork Fri Aug 21 09:00:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 95972 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A65BC5DF8C for ; Fri, 21 Aug 2026 09:00:22 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.4]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3558.1787302814836216801 for ; Fri, 21 Aug 2026 02:00:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=HO7X6TMS; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.159.4, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=r706fF5KciH9nluulq/aU9Y0nONtZYCKXD6eOeP8V/ZVxdqoFd8AJNYDtYAcsif+00CC+IN5qbhWpCVFcGMCCT24ank69QxgDAdPXE+9Eknxmpe4Kas9h7sytw2nVn5dWJD91t2ecQHMlY9L6f5ZsQ3UNaOGLPye1olAokVmV218O7jYr1EAkd2WPOTd/35QwXaKBz0GQHUzHSvJKh5UdDdwhVLF/2Xrzt2L7tGzvzIDONN3ThhUSXVonyJi8zwjBQHykymRrzRkbdjDtgZPU3O3h/8wfFwwdk+1pQKnkVOYLFYKr6Y4pL9t0hjYbNTse6uD6k56asIMGsuoQjk4aw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rrR4duZ6JZa9YM/HpR+Bmt3drKbwavrW7RQys711mhg=; b=IiwyFXJIF3UKUUb621JUjjoCvXduCJCrGk9/0cBOVcicngS0WOLcbipyBsqms5pOAcU/KKXBlg+im63OmLE6DgWMlsX1eX1QkA2trfFaNTlQzf0mp6oy9h9tXZMMi/p76b/VRh3IfQJ0lzA21ra9KEmpr7HOIjhYZTzuP1SUW3qPPIJrluuu3YRsBY4b90eQmjPhirYulsziGyI3tLCRowGHj+1MgaEISHo61dd38ryMLyB7pUZAue/MPWFfKz1E63fUn4R+dx+7VRKXS89IqqZEWhg1ORo4mwO8mXOPt10azJVlZoh6jraYOviuqltps56slL/bEwYDS7xEeeOx4Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rrR4duZ6JZa9YM/HpR+Bmt3drKbwavrW7RQys711mhg=; b=HO7X6TMSeQi27GlSopiIh5fYBWpbdJ1Pq+sPzDNDmgNVJtMQ6qAsHy4Bvne/o9uV8oB05pQDk73d5yKTvgs+e/aL1U4vgQf30neOBmn787WXCEP7O+a9rCAxoKA7I30d0g+SjPBWL8NHxVNcYROQxGSfW9PQWgb8YQq9ZUQbAURK8y1JrqSpHLVS2u/Y6C6EWw1up38HTRCcn4nwdq5lKFz8V0S0DWNv5tGuEXdpFf/mjyAV5SBERGJlyE+3wXCBkkwXEzj3p6+8dl1mhuKwXrH4Z3kRR2ss06lZLvDEh91xPs57R2P66vrcknTj9YxdSDlrurpFCDwTM/L1AKgjAQ== Received: from FRWPR07MB10660.eurprd07.prod.outlook.com (2603:10a6:d10:183::9) by VI0PR07MB11397.eurprd07.prod.outlook.com (2603:10a6:800:30a::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.3; Fri, 21 Aug 2026 09:00:10 +0000 Received: from FRWPR07MB10660.eurprd07.prod.outlook.com ([fe80::9105:401:e0a2:a997]) by FRWPR07MB10660.eurprd07.prod.outlook.com ([fe80::9105:401:e0a2:a997%4]) with mapi id 15.21.0360.003; Fri, 21 Aug 2026 09:00:10 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH] gnutls: fix for CVE-2026-42011 Thread-Topic: [wrynose][PATCH] gnutls: fix for CVE-2026-42011 Thread-Index: AQHdMUt4JsuVybQi0EicTlOn8Grmfg== Date: Fri, 21 Aug 2026 09:00:09 +0000 Message-ID: <20260821085945.92887-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: FRWPR07MB10660:EE_|VI0PR07MB11397:EE_ x-ms-office365-filtering-correlation-id: 622497af-1ffd-49d4-8ebc-08deff629aa9 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|23010399003|366016|56012099006|3023799007|12006099003|38070700021|11063799006|10067099003|13003099007|18002099003; x-microsoft-antispam-message-info: HWzm7Tdy9tfV+L91tAyul0YbREOQ/OIP02sqyiSZlR39F9PwmBfYhrcsR8tjNFSkaUKn55nKsBHw1e09I7/N/IEMl/Lqzcry+73tYqTwlSJOYRX8lps6JZsTvCk7My54XugtGufsZjjiKHmYhKnWKbkRUue3NcUOeHe/5sBTXGWb7y1QKueN6qrVvBTb5K1m7TCk2c+/H23UgjW6cPjBSCyjPcAdw7nROhBzkR7CqPPR4YuNeiDncYZSCKsO1/qpDNY3xE8AwswNWbBGPaeJATjgFf8icjxbVDv/a5W+AgzFKkxt05tUhNIt4FNSgaHChgIum5IDIeCwM7BP+dhK7npIqWA9lbG3NHaOW+IfWj8mOInDUCMNAoFzdYE/MB8zeG8Uo8dH2v9ecKBkUxam/u+t2GJTHumG+SkCIxjNBjIvu5rsWdJ+a8bYzIG0c14CNn1TftgL1Atafi9BfF0E+C5w9KlDAG3yi8ZGgwSJXUJgqBo6cmlHc16SxxsV2p6GwTTl3NFrnkokmNeK6iIoPuTx2rtyJU3KFQTZqlpbn5yBWIl57KwSPecUWvAFfoMb7kc44TKaUjeC3FnGURoYAZjIdaJIxhmwRoW7CtUM3Ujt15rbw+IrxJusr2/lMIPpiJ41JFFKKuQr2rjwU97bvGmWzjjXmCtuJ3ySAU1FT81nIvfhqCAZqvqltz5C/Vvf2C0/bViF7qY9YGiWKy0n9dqccjW2XQr+gFXnDl0pnOU= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:FRWPR07MB10660.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(23010399003)(366016)(56012099006)(3023799007)(12006099003)(38070700021)(11063799006)(10067099003)(13003099007)(18002099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?s6Wpj9RZU5lwmm6ZBG4YmZx5d4JF?= =?utf-8?q?wNM6+Lh3bV65XZ+P4z2T4RHWu4rPoyjBiYDYtC3Fm18AIivvIkjLTZhk45m4SblAC?= =?utf-8?q?KJbcTDokVHLPzIQWnCNanboxQUz/kM4RU7SA6SnmO0IoYXd9UZjgATH4ZI3nuSZLl?= =?utf-8?q?GO0pUqWaw4Js8SGzIb2MwD3kRYU90pSwKRFGUaPedI6DfcCYwbk417wQVRBHvqVEn?= =?utf-8?q?EPqLMb/MfqZIcpDNCxUblG7cMGBJWTn43NPjDoQSoebEPk1vUIimMYXvhCle13zdE?= =?utf-8?q?p41RtMnWfpTGr7PXJ7PZQkdFeYBXgXDRAxNB1DNpULAUzbP8NyBZX91xVacREhZPF?= =?utf-8?q?afic+nKJqqlqBFFpJyMRNYwl44d060HpRy9rFIulVm3YY2/haCIOV/GxJKWpcbgT5?= =?utf-8?q?UVZJ47kBEPiUnNjPm3H/9enF2CsQ5yoyCfssrB5PS2CcEC3pCPrsoYLpRpIniQikZ?= =?utf-8?q?T0CnwBqUXP1bh3VxRZpo/OaLG8zunrp/yBiILuY7JVO1QOvJvjY/XLC8WZO1vuKK3?= =?utf-8?q?rcVOp1BoLYMt4JF45P1FuHBMKp7G8pRDOyIIgSaJ7jRs5WspAgNo25ZRj9zEgaTkh?= =?utf-8?q?NaJF3BKaue2t9Phsuz7a9mG7daLAI1DV67Pl8hefsVFJer5SGC/lw3FZcOgjGsO/1?= =?utf-8?q?sxUJE6wNIIKuU/ukWXRqXhXtnlT+5v/twnZMMw6HVSpABOpyH98g6uZuWb4MK3jee?= =?utf-8?q?xkVttBWcJNLe+Ef4dnnNAld+lW2CzxO6DQyUmFD2hGtNuoUyCTY68nA4WFPk4RdB6?= =?utf-8?q?ZcVVYrFvTsdifvR98irCzib1G1V3oAKrlg+0B25fLELJoqXQU7VvieWDBPyiA4n4C?= =?utf-8?q?JV6HWK8FFpfKhmjspxU5wmfJSYVCN0uKs9duRpXDbRGo03jzvZ718uJnDjwUPerYy?= =?utf-8?q?L+blQMIFkMbLK44ex/EmvtbyUM4lNpVosf5OpwJDoM9FHp0Zjkzsaaj46x6gu1+Kg?= =?utf-8?q?mWSj5Zc7vlKFiXDJZp+GT2VAnbOWpDXn3wD1jKTczgl7VYUAJXwmXglmnMtO5vAfz?= =?utf-8?q?Simk5Y1eyaQmK7h6MZKNFqNnPzdZjyyZcC2MFhlqeIvdjsmzOepyNCqgdaIpyLimw?= =?utf-8?q?XxTftgd5/CyrAZRKRuZXm67ronDCwRztauCM1io74irP3EKz4Qq0JDkHEIENEuF77?= =?utf-8?q?9ejrPW+WB70FCyx/xEYmvhprmk2n7ljg2gtGVVmsi3wMoeMSqH8V5Q415jpneK8yr?= =?utf-8?q?aMqp2rFK1Ffw60MPUOcR0x7oM8FyzSjZxJ/3cqPICrt4YoeSPKqKcfG61KyM0XYnn?= =?utf-8?q?IZaweRdx9yN1KqLYAdlmRLi0y0vMQaHMUjJXtL586NTaYsgZfEd7gNo1IxbnxMsnU?= =?utf-8?q?os1AquWyZF9btmS5OE+qb0LgWKbBd9bWuRkJwoHMPaeqh5GMjLGCHxCCrilRz0fAm?= =?utf-8?q?ibTbQASxjhj+EcmXSxMzLvGQqJTLnnrJ+nfu+UCqakdnJoUSWWOonTjp7HchlsES1?= =?utf-8?q?CNpCDeGYEfgMbJ3UxZllsJOtFZlqkynkqk4z94tt1kjRTiauY1DSr3NDc3Lx/f4ha?= =?utf-8?q?3flkxCbhtwK0OLWAZSir+SPwOQBdD1UI5oOFecjLIFIKLeGuzF/ihLmckmlbA6Y8J?= =?utf-8?q?7tYeQH6/JaTixiSOOtiZgO2+WIeminscVyMK0kGUKd3Kgonrsv/XESy0feqhlqPPO?= =?utf-8?q?wgd4H6SYkbzfzLKqTNjKRijv5y0qVGlQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: FRWPR07MB10660.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 622497af-1ffd-49d4-8ebc-08deff629aa9 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2026 09:00:09.9266 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: VDwU/UaVbpOP6mmIgLKm91hHe1I58THb+88P12FgZ1HKOHz+amH8VD6FxBkiQe4Okw4dQDHKa2KNQH2HCJsYC4/JhyPDzi24xRlI3pP+EHA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR07MB11397 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 21 Aug 2026 09:00:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243906 Backport patches to fix CVE-2026-42011 and extend test for it References: https://nvd.nist.gov/vuln/detail/CVE-2026-42011 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/1dead2faec6320aaba321eb56f20d442df192b83 https://gitlab.com/gnutls/gnutls/-/commit/24713b8c63137ce0665b495d22ccce4f5ce05c84 Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42011_p1.patch | 43 ++++++ .../gnutls/gnutls/CVE-2026-42011_p2.patch | 141 ++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 + 3 files changed, 186 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch new file mode 100644 index 0000000000..62a9714c6c --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch @@ -0,0 +1,43 @@ +From 1dead2faec6320aaba321eb56f20d442df192b83 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Tue, 14 Apr 2026 17:41:30 +0200 +Subject: [PATCH 1/2] x509/name_constraints: fix intersecting empty constraints + +Permitted name constraints were wrongfully ignored +when prior CAs only had excluded name constraints, +resulting in a name constraint bypass. + +With this change, they are taken into account and propagate. + +CVE: CVE-2026-42011 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/1dead2faec6320aaba321eb56f20d442df192b83] + +Reported-by: Haruto Kimura (Stella) +Fixes: #1824 +Fixes: CVE-2026-42011 +Fixes: GNUTLS-SA-2026-04-29-6 +CVSS: 4.8 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N + +Signed-off-by: Alexander Sosedkin +Signed-off-by: Jakub Szczudlo +--- + lib/x509/name_constraints.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 04722bdf4..232d466c4 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -723,9 +723,6 @@ static int name_constraints_node_list_intersect( + type_bitmask_t types_in_p1 = 0, types_in_p2 = 0; + static const unsigned char universal_ip[32] = { 0 }; + +- if (permitted->size == 0 || permitted2->size == 0) +- return GNUTLS_E_SUCCESS; +- + /* make sorted views of the arrays */ + ret = ensure_sorted(permitted); + if (ret < 0) { +-- +2.53.0 + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch new file mode 100644 index 0000000000..29eb6bda43 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch @@ -0,0 +1,141 @@ +From 24713b8c63137ce0665b495d22ccce4f5ce05c84 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Tue, 14 Apr 2026 17:49:50 +0200 +Subject: [PATCH 2/2] tests/name-constraints-merge: extend to cover #1824 + +CVE: CVE-2026-42011 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/24713b8c63137ce0665b495d22ccce4f5ce05c84] + +Signed-off-by: Alexander Sosedkin +Signed-off-by: Jakub Szczudlo +--- + tests/name-constraints-merge.c | 113 +++++++++++++++++++++++++++++++++ + 1 file changed, 113 insertions(+) + +diff --git a/tests/name-constraints-merge.c b/tests/name-constraints-merge.c +index 70376aaa7..3ff8d6c60 100644 +--- a/tests/name-constraints-merge.c ++++ b/tests/name-constraints-merge.c +@@ -473,6 +473,119 @@ void doit(void) + gnutls_x509_name_constraints_deinit(nc1); + gnutls_x509_name_constraints_deinit(nc2); + ++ /* 6: test intersecting empty permitted with non-empty permitted ++ * NC1: excluded DNS excluded.example.org (empty permitted) ++ * NC2: permitted DNS permitted.example.org ++ * Expected result: ++ * permitted=[permitted.example.org], excluded=[excluded.example.org] ++ * unrelated.example.com is rejected ++ */ ++ suite = 6; ++ ++ ret = gnutls_x509_name_constraints_init(&nc1); ++ check_for_error(ret); ++ ++ ret = gnutls_x509_name_constraints_init(&nc2); ++ check_for_error(ret); ++ ++ set_name("excluded.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_excluded(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_for_error(ret); ++ ++ set_name("permitted.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc2, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ ret = _gnutls_x509_name_constraints_merge(nc1, nc2); ++ check_for_error(ret); ++ ++ set_name("unrelated.example.com", &name); /* entirely unrelated */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* #1814 */ ++ ++ set_name("permitted.example.org", &name); /* permitted, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("sub.permitted.example.org", &name); /* permitted, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("excluded.example.org", &name); /* excluded, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ set_name("sub.excluded.example.org", &name); /* excluded, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ gnutls_x509_name_constraints_deinit(nc1); ++ gnutls_x509_name_constraints_deinit(nc2); ++ ++ /* 7: test intersecting non-empty permitted with empty permitted ++ * (same as 6, but swapped to ensure order doesn't matter) ++ * NC1: permitted DNS permitted.example.org ++ * NC2: excluded DNS excluded.example.org (empty permitted) ++ * Expected result: ++ * permitted=[permitted.example.org], excluded=[excluded.example.org] ++ * unrelated.example.com is rejected ++ */ ++ suite = 7; ++ ++ ret = gnutls_x509_name_constraints_init(&nc1); ++ check_for_error(ret); ++ ++ ret = gnutls_x509_name_constraints_init(&nc2); ++ check_for_error(ret); ++ ++ set_name("permitted.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc1, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ set_name("excluded.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_excluded(nc2, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_for_error(ret); ++ ++ ret = _gnutls_x509_name_constraints_merge(nc1, nc2); ++ check_for_error(ret); ++ ++ set_name("unrelated.example.com", &name); /* entirely unrelated */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* #1814 */ ++ ++ set_name("permitted.example.org", &name); /* permitted, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("sub.permitted.example.org", &name); /* permitted, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("excluded.example.org", &name); /* excluded, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ set_name("sub.excluded.example.org", &name); /* excluded, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ gnutls_x509_name_constraints_deinit(nc1); ++ gnutls_x509_name_constraints_deinit(nc2); ++ + /* Test footer */ + + if (debug) +-- +2.53.0 + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb index 3ad011742e..e9059a4bc1 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb @@ -37,6 +37,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42009_p1.patch \ file://CVE-2026-42009_p2.patch \ file://CVE-2026-3833.patch \ + file://CVE-2026-42011_p1.patch \ + file://CVE-2026-42011_p2.patch \ " SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"