diff mbox series

[wrynose,v2,2/5] curl: patch CVE-2026-8925

Message ID 20260825185022.1020129-2-peter.marko@siemens.com
State New
Headers show
Series [wrynose,v2,1/5] curl: patch CVE-2026-7009 | expand

Commit Message

Peter Marko Aug. 25, 2026, 6:50 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Pick patch per [1].

[1] https://curl.se/docs/CVE-2026-8925.html

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../curl/curl/CVE-2026-8925.patch             | 57 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 58 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8925.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8925.patch b/meta/recipes-support/curl/curl/CVE-2026-8925.patch
new file mode 100644
index 0000000000..da486e6ac1
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8925.patch
@@ -0,0 +1,57 @@ 
+From 3da249e1f0716c06644ed3522a37a8bf81808012 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Thu, 14 May 2026 14:35:21 +0200
+Subject: [PATCH] gsasl: fix potential double free
+
+Also:
+- require libgsasl 1.6.0+ (2010-12-14) for a `gsasl_finish()` that
+  handles a NULL argument.
+  Ref: https://gitlab.com/gsasl/gsasl/-/commit/b550032df8488a9ceaa3cfd4c634947d8f219717
+
+Reported-by: Joshua Rogers (Aisle Research)
+
+Closes #21609
+
+CVE: CVE-2026-8925
+Upstream-Status: Backport [https://github.com/curl/curl/commit/3da249e1f0716c06644ed3522a37a8bf81808012]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ docs/INTERNALS.md | 1 +
+ lib/vauth/gsasl.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md
+index c145690a2c..77f2e43735 100644
+--- a/docs/INTERNALS.md
++++ b/docs/INTERNALS.md
+@@ -30,6 +30,7 @@ We aim to support these or later versions.
+ - c-ares       1.6.0 (2008-12-09)
+ - GnuTLS       3.6.5 (2018-12-01)
+ - libidn2      2.0.0 (2017-03-29)
++- libgsasl     1.6.0 (2010-12-14)
+ - LibreSSL     2.9.1 (2019-04-22)
+ - libssh       0.9.0 (2019-06-28)
+ - libssh2      1.9.0 (2019-06-20)
+diff --git a/lib/vauth/gsasl.c b/lib/vauth/gsasl.c
+index 3ea77eecd1..10a83fdb09 100644
+--- a/lib/vauth/gsasl.c
++++ b/lib/vauth/gsasl.c
+@@ -32,6 +32,10 @@
+ 
+ #include <gsasl.h>
+ 
++#if GSASL_VERSION_NUMBER < 0x010600
++#error "requires libgsasl 1.6.0+"
++#endif
++
+ bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
+                                   const char *mech,
+                                   struct gsasldata *gsasl)
+@@ -47,6 +51,7 @@ bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
+   res = gsasl_client_start(gsasl->ctx, mech, &gsasl->client);
+   if(res != GSASL_OK) {
+     gsasl_done(gsasl->ctx);
++    gsasl->ctx = NULL;
+     return FALSE;
+   }
+ 
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index ca01e35dcd..6ad1bfe55f 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -26,6 +26,7 @@  SRC_URI = " \
     file://CVE-2026-11352.patch \
     file://CVE-2026-11586.patch \
     file://CVE-2026-7009.patch \
+    file://CVE-2026-8925.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \