new file mode 100644
@@ -0,0 +1,56 @@
+From 3ee2cb707002f755e4bda3f75285caa0cb36c214 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Wed, 15 Apr 2026 15:35:59 +0200
+Subject: [PATCH] x509/email-verify: call fallback DN fallback
+
+A comment was inaccurately referring to DN email field fallback
+as CN fallback.
+Rename a few things as well to match x509/hostname-verify more closely.
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+CVE: CVE-2026-42013
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3ee2cb707002f755e4bda3f75285caa0cb36c214]
+
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/x509/email-verify.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/lib/x509/email-verify.c b/lib/x509/email-verify.c
+index dbef0bb86e..3c22ffed37 100644
+--- a/lib/x509/email-verify.c
++++ b/lib/x509/email-verify.c
+@@ -42,7 +42,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,
+ {
+ char rfc822name[MAX_CN];
+ size_t rfc822namesize;
+- int found_rfc822name = 0;
++ bool dn_fallback_allowed = true;
+ int ret = 0;
+ int i = 0;
+ char *a_email;
+@@ -76,7 +76,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,
+ cert, i, rfc822name, &rfc822namesize, NULL);
+
+ if (ret == GNUTLS_SAN_RFC822NAME) {
+- found_rfc822name = 1;
++ dn_fallback_allowed = false;
+
+ if (memchr(rfc822name, '\0', rfc822namesize)) {
+ _gnutls_debug_log(
+@@ -102,12 +102,10 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,
+ }
+ }
+
+- if (!found_rfc822name) {
+- /* did not get the necessary extension, use CN instead
+- */
++ if (dn_fallback_allowed) {
++ /* did not get the necessary extension, use DN email instead */
+
+- /* enforce the RFC6125 (ยง1.8) requirement that only
+- * a single CN must be present */
++ /* only a single one must be present */
+ rfc822namesize = sizeof(rfc822name);
+ ret = gnutls_x509_crt_get_dn_by_oid(cert,
+ GNUTLS_OID_PKCS9_EMAIL, 1,
new file mode 100644
@@ -0,0 +1,74 @@
+From 29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Wed, 15 Apr 2026 16:02:19 +0200
+Subject: [PATCH] x509: prevent fallback on oversized SAN
+
+Passing oversized SAN did not preclude CN (or DN email) fallback
+during verification, which is an RFC 6125 6.4.4 violation.
+
+Now oversized SAN are skipped over,
+but prevent the fallback from happening.
+
+Reported-by: Haruto Kimura (Stella)
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1825
+Fixes: #1849
+Fixes: CVE-2026-42013
+Fixes: GNUTLS-SA-2026-04-27-8
+CVSS: 6.5 Moderate CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+CVE: CVE-2026-42013
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4]
+
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/x509/email-verify.c | 14 ++++++++++++++
+ lib/x509/hostname-verify.c | 14 ++++++++++++++
+ 2 files changed, 28 insertions(+)
+
+--- a/lib/x509/email-verify.c
++++ b/lib/x509/email-verify.c
+@@ -75,6 +75,20 @@ unsigned gnutls_x509_crt_check_email(gnu
+ ret = gnutls_x509_crt_get_subject_alt_name(
+ cert, i, rfc822name, &rfc822namesize, NULL);
+
++ if (ret < 0) {
++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
++ /* oversized SAN; proceed without DN fallback */
++ _gnutls_debug_log("oversized SAN ignored, "
++ "disabling DN fallback\n");
++ dn_fallback_allowed = false;
++ ret = 0;
++ continue;
++ }
++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
++ gnutls_assert();
++ break;
++ }
++
+ if (ret == GNUTLS_SAN_RFC822NAME) {
+ dn_fallback_allowed = false;
+
+--- a/lib/x509/hostname-verify.c
++++ b/lib/x509/hostname-verify.c
+@@ -213,6 +213,20 @@ hostname_fallback:
+ ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname,
+ &dnsnamesize, NULL);
+
++ if (ret < 0) {
++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
++ /* oversized SAN; proceed without CN fallback */
++ _gnutls_debug_log("oversized SAN ignored, "
++ "disabling CN fallback\n");
++ cn_fallback_allowed = false;
++ ret = 0;
++ continue;
++ }
++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
++ gnutls_assert();
++ break;
++ }
++
+ if (PRECLUDES_CN_FALLBACK(ret))
+ cn_fallback_allowed = false;
+
@@ -50,6 +50,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://CVE-2026-42012-pre2.patch \
file://CVE-2026-42012-pre3.patch \
file://CVE-2026-42012.patch \
+ file://CVE-2026-42013-pre1.patch \
+ file://CVE-2026-42013.patch \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"
Backport patch to fix CVE-2026-42013. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42013 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Tested with ptest Pre patch taken from upstream so CVE fix will land cleanly Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com> --- .../gnutls/gnutls/CVE-2026-42013-pre1.patch | 56 ++++++++++++++ .../gnutls/gnutls/CVE-2026-42013.patch | 74 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 2 + 3 files changed, 132 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch