diff mbox series

[scarthgap] curl: fix CVE-2026-80230

Message ID 20261016134059.53065-1-jaipaul.cheernam@est.tech
State New
Headers show
Series [scarthgap] curl: fix CVE-2026-80230 | expand

Commit Message

Jaipaul Cheernam Oct. 16, 2026, 1:40 p.m. UTC 
Backport the upstream fix [1] as mentioned in [2]

[1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
[2] https://curl.se/docs/CVE-2026-80230.html

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
Note: SRC_URI indentation is corrected by devtool

 .../curl/curl/CVE-2026-80230.patch            | 63 +++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       | 68 +++++++++----------
 2 files changed, 97 insertions(+), 34 deletions(-)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
new file mode 100644
index 0000000000..0473c0922d
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
@@ -0,0 +1,63 @@ 
+From c14852aaf58042b71f98cf5aebea8d7821f6e5e1 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 24 Aug 2026 23:37:49 +0200
+Subject: [PATCH] openssl: no server cert is only okay if also not pinned
+
+Reported-by: Stanislav Fort
+Closes #22660
+
+CVE: CVE-2026-80230
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5267ed859d545534d0c21]
+
+Note: logic lives in servercert() in 8.7.1, not in ossl_check_pinned_key
+Macro CURL_EASY_STR is not available in 8.7.1 used direct data struct
+strict is set based on verifypeer and verifyhost by calling function
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ lib/vtls/openssl.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 3e130c5..481528b 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -4202,6 +4202,18 @@ static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
+ #define infof_certstack(data, ssl)
+ #endif
+ 
++static const char *pinned(struct Curl_cfilter *cf,
++                          struct Curl_easy *data)
++{
++  (void)cf;
++  return
++#ifndef CURL_DISABLE_PROXY
++    Curl_ssl_cf_is_proxy(cf) ?
++    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
++#endif
++    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
++}
++
+ /*
+  * Get the server cert, verify it and show it, etc., only call failf() if the
+  * 'strict' argument is TRUE as otherwise all this is for informational
+@@ -4248,7 +4260,7 @@ static CURLcode servercert(struct Curl_cfilter *cf,
+   backend->server_cert = SSL_get1_peer_certificate(backend->handle);
+   if(!backend->server_cert) {
+     BIO_free(mem);
+-    if(!strict)
++    if(!strict && !pinned(cf, data))
+       return CURLE_OK;
+ 
+     failf(data, "SSL: couldn't get peer certificate");
+@@ -4424,9 +4436,7 @@ static CURLcode servercert(struct Curl_cfilter *cf,
+     /* when not strict, we don't bother about the verify cert problems */
+     result = CURLE_OK;
+ 
+-  ptr = Curl_ssl_cf_is_proxy(cf)?
+-    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
+-    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
++  ptr = pinned(cf, data);
+   if(!result && ptr) {
+     result = ossl_pkp_pin_peer_pubkey(data, backend->server_cert, ptr);
+     if(result)
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index ade637adf3..dac2da3c25 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -9,40 +9,40 @@  SECTION = "console/network"
 LICENSE = "curl"
 LIC_FILES_CHKSUM = "file://COPYING;md5=eed2e5088e1ac619c9a1c747da291d75"
 
-SRC_URI = " \
-    https://curl.se/download/${BP}.tar.xz \
-    file://721941aadf4adf4f6aeb3f4c0ab489bb89610c36.patch \
-    file://run-ptest \
-    file://disable-tests \
-    file://no-test-timeout.patch \
-    file://CVE-2024-6197.patch \
-    file://CVE-2024-7264-1.patch \
-    file://CVE-2024-7264-2.patch \
-    file://CVE-2024-8096.patch \
-    file://CVE-2024-9681.patch \
-    file://CVE-2024-11053-0001.patch \
-    file://CVE-2024-11053-0002.patch \
-    file://CVE-2024-11053-0003.patch \
-    file://CVE-2025-0167.patch \
-    file://CVE-2025-9086.patch \
-    file://CVE-2025-10148.patch \
-    file://CVE-2025-14017.patch \
-    file://CVE-2025-14524.patch \
-    file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
-    file://CVE-2025-14819.patch \
-    file://CVE-2025-15079.patch \
-    file://CVE-2025-15224.patch \
-    file://CVE-2026-1965-1.patch \
-    file://CVE-2026-1965-2.patch \
-    file://CVE-2026-3783.patch \
-    file://CVE-2026-3784.patch \
-    file://CVE-2026-5773.patch \
-    file://CVE-2026-6276.patch \
-    file://CVE-2026-5545.patch \
-    file://CVE-2026-6253.patch \
-    file://CVE-2026-4873.patch \
-    file://CVE-2026-13608.patch \
-"
+SRC_URI = "https://curl.se/download/${BP}.tar.xz \
+           file://721941aadf4adf4f6aeb3f4c0ab489bb89610c36.patch \
+           file://run-ptest \
+           file://disable-tests \
+           file://no-test-timeout.patch \
+           file://CVE-2024-6197.patch \
+           file://CVE-2024-7264-1.patch \
+           file://CVE-2024-7264-2.patch \
+           file://CVE-2024-8096.patch \
+           file://CVE-2024-9681.patch \
+           file://CVE-2024-11053-0001.patch \
+           file://CVE-2024-11053-0002.patch \
+           file://CVE-2024-11053-0003.patch \
+           file://CVE-2025-0167.patch \
+           file://CVE-2025-9086.patch \
+           file://CVE-2025-10148.patch \
+           file://CVE-2025-14017.patch \
+           file://CVE-2025-14524.patch \
+           file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
+           file://CVE-2025-14819.patch \
+           file://CVE-2025-15079.patch \
+           file://CVE-2025-15224.patch \
+           file://CVE-2026-1965-1.patch \
+           file://CVE-2026-1965-2.patch \
+           file://CVE-2026-3783.patch \
+           file://CVE-2026-3784.patch \
+           file://CVE-2026-5773.patch \
+           file://CVE-2026-6276.patch \
+           file://CVE-2026-5545.patch \
+           file://CVE-2026-6253.patch \
+           file://CVE-2026-4873.patch \
+           file://CVE-2026-13608.patch \
+           file://CVE-2026-80230.patch \
+           "
 
 SRC_URI:append:class-nativesdk = " \
            file://environment.d-curl.sh \