diff mbox series

[wrynose,v2,1/5] curl: patch CVE-2026-7009

Message ID 20260825185022.1020129-1-peter.marko@siemens.com
State New
Headers show
Series [wrynose,v2,1/5] curl: patch CVE-2026-7009 | expand

Commit Message

Peter Marko Aug. 25, 2026, 6:50 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Pick patch per [1].

[1] https://curl.se/docs/CVE-2026-7009.html

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../curl/curl/CVE-2026-7009.patch             | 50 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 51 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7009.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-7009.patch b/meta/recipes-support/curl/curl/CVE-2026-7009.patch
new file mode 100644
index 0000000000..ec124378ec
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-7009.patch
@@ -0,0 +1,50 @@ 
+From 51905671e07f087e28e5741063646c379fe17d89 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Sat, 25 Apr 2026 10:34:06 +0200
+Subject: [PATCH] sectrust: fail on missing OCSP stapling
+
+When using Apple SecTrust, requiring the server to send
+an OCSP response and does not, fail correctly.
+
+Reported-by: Carlos Carrillo
+Closes #21444
+
+CVE: CVE-2026-7009
+Upstream-Status: Backport [https://github.com/curl/curl/commit/51905671e07f087e28e5741063646c379fe17d89]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/vtls/openssl.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index c84ef8bc65..4629ca4444 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -4744,16 +4744,26 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
+     unsigned char *ocsp_data = NULL;
+ #endif
+     long ocsp_len = 0;
++    bool ocsp_missing = FALSE;
+     if(conn_config->verifystatus && !octx->reused_session)
+       ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
+ 
+     /* SSL_get_tlsext_status_ocsp_resp() returns the length of the OCSP
+        response data or -1 if there is no OCSP response data. */
+-    if(ocsp_len < 0)
++    if(ocsp_len < 0) {
+       ocsp_len = 0; /* no data available */
++      ocsp_missing = TRUE;
++    }
+     result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
+                                     ossl_chain_get_der, &chain,
+                                     ocsp_data, ocsp_len);
++    if(!result && ocsp_missing && conn_config->verifystatus &&
++       !octx->reused_session) {
++      /* verified, but OCSP stapling is required and server sent none */
++      *pverified = TRUE;
++      failf(data, "No OCSP response received");
++      return CURLE_SSL_INVALIDCERTSTATUS;
++    }
+   }
+   *pverified = !result;
+   return result;
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index bca7f35d06..ca01e35dcd 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -25,6 +25,7 @@  SRC_URI = " \
     file://CVE-2026-4873.patch \
     file://CVE-2026-11352.patch \
     file://CVE-2026-11586.patch \
+    file://CVE-2026-7009.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \