diff mbox series

[wrynose,2/5] curl: fix CVE-2026-11564

Message ID 20261019064320.3978613-3-dkelaiya@cisco.com
State Under Review
Delegated to: Yoann Congal
Headers show
Series curl: backport security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 19, 2026, 6:43 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

Restore the upstream native CA and proxy-origin comments while
retaining the curl 8.19.0 option-completion API.

[1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891
[2] https://curl.se/docs/CVE-2026-11564.html

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../curl/curl/CVE-2026-11564.patch            | 132 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
 2 files changed, 133 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
new file mode 100644
index 0000000000..539236228c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
@@ -0,0 +1,132 @@ 
+From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 8 Jun 2026 10:11:30 +0200
+Subject: [PATCH] ssl native_ca_store: always reinit
+
+Add bit `native_ca_store_opt` to keep the setting of
+CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy
+transfer if a native CA store shall be used or not.
+
+This avoids `native_ca_store` getting stuck on TRUE after being set
+once.
+
+Closes #21902
+
+CVE: CVE-2026-11564
+Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891]
+
+Backport Changes:
+- Applied the option-completion helper to lib/vtls/vtls.c because curl
+  8.19.0 does not have lib/vtls/vtls_config.c.
+- Retained the curl 8.19.0 auto-client-certificate behavior because the
+  later initial-origin tracking API is not available.
+
+(cherry picked from commit d69bfad3fa3daf5e72331f6870667607828d5891)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/doh.c       |  3 ++-
+ lib/setopt.c    | 20 ++------------------
+ lib/vtls/vtls.c | 21 +++++++++++++++++++++
+ 3 files changed, 25 insertions(+), 19 deletions(-)
+
+diff --git a/lib/doh.c b/lib/doh.c
+index 4488d42..80da94b 100644
+--- a/lib/doh.c
++++ b/lib/doh.c
+@@ -397,7 +397,8 @@ static CURLcode doh_probe_run(struct Curl_easy *data,
+   }
+ 
+   (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS,
+-                         (long)data->set.ssl.primary.ssl_options);
++                         ((long)data->set.ssl.primary.ssl_options &
++                           ~CURLSSLOPT_AUTO_CLIENT_CERT));
+ 
+   doh->state.internal = TRUE;
+   doh->master_mid = data->mid; /* master transfer of this one */
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 7e6960c..3603912 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -407,22 +407,6 @@ static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg)
+ }
+ #endif /* !CURL_DISABLE_RTSP */
+ 
+-#ifdef USE_SSL
+-static void set_ssl_options(struct ssl_config_data *ssl,
+-                            struct ssl_primary_config *config,
+-                            long arg)
+-{
+-  config->ssl_options = (unsigned char)(arg & 0xff);
+-  ssl->enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST);
+-  ssl->no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
+-  ssl->no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
+-  ssl->revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT);
+-  ssl->native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA);
+-  ssl->auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT);
+-  ssl->earlydata = !!(arg & CURLSSLOPT_EARLYDATA);
+-}
+-#endif
+-
+ static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option,
+                                  long arg)
+ {
+@@ -1002,11 +986,11 @@ static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option,
+       s->use_ssl = (unsigned char)arg;
+     break;
+   case CURLOPT_SSL_OPTIONS:
+-    set_ssl_options(&s->ssl, &s->ssl.primary, arg);
++    s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+     break;
+ #ifndef CURL_DISABLE_PROXY
+   case CURLOPT_PROXY_SSL_OPTIONS:
+-    set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg);
++    s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+     break;
+ #endif
+   case CURLOPT_SSL_ENABLE_NPN:
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index 6dcc67d..35cb4f0 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -306,6 +306,22 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc)
+ #endif
+ }
+ 
++static void ssl_easy_config_compl_options(struct ssl_config_data *sslc)
++{
++  uint8_t options = sslc->primary.ssl_options;
++  /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
++   * If not, we switch it on for supported backends if no custom
++   * ca settings exist. */
++  sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
++  sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
++  sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
++  sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
++  sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT);
++  sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA);
++
++  sslc->auto_client_cert = !!(options & CURLSSLOPT_AUTO_CLIENT_CERT);
++}
++
+ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ {
+   struct ssl_config_data *sslc = &data->set.ssl;
+@@ -314,6 +330,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+   CURLcode result;
+ #endif
+ 
++  ssl_easy_config_compl_options(sslc);
++
+   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+     if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+@@ -360,6 +378,9 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ 
+ #ifndef CURL_DISABLE_PROXY
+   sslc = &data->set.proxy_ssl;
++  /* no initial origin for proxy, it is not changed for redirects */
++  ssl_easy_config_compl_options(sslc);
++
+   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+     if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index af76f5d53b..322304f47d 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -41,6 +41,7 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-8926-dependent.patch \
            file://CVE-2026-8926_p1.patch \
            file://CVE-2026-8926_p2.patch \
+           file://CVE-2026-11564.patch \
            file://CVE-2026-80230.patch \
            "