diff mbox series

[wrynose] curl: fix CVE-2026-80230

Message ID 20261016134019.52968-1-jaipaul.cheernam@est.tech
State New
Headers show
Series [wrynose] curl: fix CVE-2026-80230 | expand

Commit Message

Jaipaul Cheernam Oct. 16, 2026, 1:40 p.m. UTC 
Backport the upstream fix [1] as mentioned in [2]

[1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
[2] https://curl.se/docs/CVE-2026-80230.html

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
Note: SRC_URI indentation is corrected by devtool

 .../curl/curl/CVE-2026-80230.patch            | 68 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      | 62 ++++++++---------
 2 files changed, 99 insertions(+), 31 deletions(-)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
new file mode 100644
index 0000000000..5a6bb35986
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
@@ -0,0 +1,68 @@ 
+From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 24 Aug 2026 23:37:49 +0200
+Subject: [PATCH] openssl: no server cert is only okay if also not pinned
+
+Reported-by: Stanislav Fort
+Closes #22660
+
+CVE: CVE-2026-80230
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef]
+
+Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned()
+accesses data->set.str[] directly instead.
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ lib/vtls/openssl.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 1cf357c..cb6fcc4 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -4607,21 +4607,24 @@ out:
+   return result;
+ }
+ 
+-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
+-                                      struct Curl_easy *data,
+-                                      X509 *server_cert)
++static const char *pinned(struct Curl_cfilter *cf,
++                          struct Curl_easy *data)
+ {
+-  const char *ptr;
+-  CURLcode result = CURLE_OK;
+-
+   (void)cf;
++  return
+ #ifndef CURL_DISABLE_PROXY
+-  ptr = Curl_ssl_cf_is_proxy(cf) ?
++    Curl_ssl_cf_is_proxy(cf) ?
+     data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
+-    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+-#else
+-  ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+ #endif
++    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
++}
++
++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
++                                      struct Curl_easy *data,
++                                      X509 *server_cert)
++{
++  CURLcode result = CURLE_OK;
++  const char *ptr = pinned(cf, data);
+   if(ptr) {
+     result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
+     if(result)
+@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+   server_cert = SSL_get1_peer_certificate(octx->ssl);
+   if(!server_cert) {
+     /* no verification at all, this maybe acceptable */
+-    if(!(conn_config->verifypeer || conn_config->verifyhost))
++    if(!(conn_config->verifypeer || conn_config->verifyhost) &&
++       !pinned(cf, data))
+       goto out;
+ 
+     failf(data, "SSL: could not get peer certificate");
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 0573e08ea4..c2697d6dd8 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -9,37 +9,37 @@  SECTION = "console/network"
 LICENSE = "curl"
 LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc"
 
-SRC_URI = " \
-    https://curl.se/download/${BP}.tar.xz \
-    file://run-ptest \
-    file://disable-tests \
-    file://no-test-timeout.patch \
-    file://CVE-2026-6276.patch \
-    file://CVE-2026-5773.patch \
-    file://mbedtls.patch \
-    file://CVE-2026-5545.patch \
-    file://CVE-2026-6253.patch \
-    file://CVE-2026-6429-dependent.patch \
-    file://CVE-2026-6429.patch \
-    file://CVE-2026-7168.patch \
-    file://CVE-2026-4873.patch \
-    file://CVE-2026-8286.patch \
-    file://CVE-2026-8927.patch \
-    file://CVE-2026-8932-dependent.patch \
-    file://CVE-2026-8932.patch \
-    file://CVE-2026-11352.patch \
-    file://CVE-2026-11586.patch \
-    file://CVE-2026-7009.patch \
-    file://CVE-2026-8925.patch \
-    file://CVE-2026-9080.patch \
-    file://CVE-2026-9545-01.patch \
-    file://CVE-2026-9545-02.patch \
-    file://CVE-2026-9079.patch \
-    file://CVE-2026-13608.patch \
-    file://CVE-2026-80229.patch \
-    file://CVE-2026-9546-01.patch \
-    file://CVE-2026-9546-02.patch \
-"
+SRC_URI = "https://curl.se/download/${BP}.tar.xz \
+           file://run-ptest \
+           file://disable-tests \
+           file://no-test-timeout.patch \
+           file://CVE-2026-6276.patch \
+           file://CVE-2026-5773.patch \
+           file://mbedtls.patch \
+           file://CVE-2026-5545.patch \
+           file://CVE-2026-6253.patch \
+           file://CVE-2026-6429-dependent.patch \
+           file://CVE-2026-6429.patch \
+           file://CVE-2026-7168.patch \
+           file://CVE-2026-4873.patch \
+           file://CVE-2026-8286.patch \
+           file://CVE-2026-8927.patch \
+           file://CVE-2026-8932-dependent.patch \
+           file://CVE-2026-8932.patch \
+           file://CVE-2026-11352.patch \
+           file://CVE-2026-11586.patch \
+           file://CVE-2026-7009.patch \
+           file://CVE-2026-8925.patch \
+           file://CVE-2026-9080.patch \
+           file://CVE-2026-9545-01.patch \
+           file://CVE-2026-9545-02.patch \
+           file://CVE-2026-9079.patch \
+           file://CVE-2026-13608.patch \
+           file://CVE-2026-80229.patch \
+           file://CVE-2026-9546-01.patch \
+           file://CVE-2026-9546-02.patch \
+           file://CVE-2026-80230.patch \
+           "
 
 SRC_URI:append:class-nativesdk = " \
     file://environment.d-curl.sh \