diff mbox series

[wrynose,3/6] curl: Security Fix for CVE-2026-80229

Message ID 20260909203324.765094-3-sdoshi@mvista.com
State New
Headers show
Series [wrynose,1/6] curl: Security Fix for CVE-2026-13608 | expand

Commit Message

Siddharth Sept. 9, 2026, 8:33 p.m. UTC 
From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

[1] https://curl.se/docs/CVE-2026-80229.html
[2] https://security-tracker.debian.org/tracker/CVE-2026-80229

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../curl/curl/CVE-2026-80229.patch            | 35 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 36 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80229.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-80229.patch b/meta/recipes-support/curl/curl/CVE-2026-80229.patch
new file mode 100644
index 0000000000..74be963fa4
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80229.patch
@@ -0,0 +1,35 @@ 
+From 272d5928188bc2171fdeba81027b24145a033fb2 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 25 Aug 2026 11:14:30 +0200
+Subject: [PATCH 3/5] openssl: avoid conn reuse if provider is used
+
+Reported-by: Stanislav Fort
+
+Closes #22665
+
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb]
+CVE: CVE-2026-80229
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ lib/vtls/openssl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 9cbab14..1d0f7b7 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -3753,6 +3753,11 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
+           ossl_strerror(ERR_peek_error(), error_buffer, sizeof(error_buffer)));
+     return CURLE_OUT_OF_MEMORY;
+   }
++#ifdef OPENSSL_HAS_PROVIDERS
++  if(data->state.libctx)
++    /* forbid connection reuse with provider/engine use */
++    connclose(data->conn, "forbid connection reuse with provider/engine use");
++#endif
+ 
+   if(cb_setup) {
+     result = cb_setup(cf, data, cb_user_data);
+-- 
+2.34.1
+
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index c466132ca4..a55cea4e31 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -29,6 +29,7 @@  SRC_URI = " \
     file://CVE-2026-8932.patch \
     file://CVE-2026-13608.patch \
     file://CVE-2026-18924.patch \
+    file://CVE-2026-80229.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \