diff mbox series

[wrynose,03/12] curl: fix CVE-2026-87862

Message ID 20261104073627.302002-4-dkelaiya@cisco.com
State New
Headers show
Series curl: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 7:36 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

Use an exact-host lookup when importing HSTS entries so a parent
policy cannot suppress a child policy with a later expiry. Adapt the
fix to hsts_add()/Curl_hsts() and register upstream test3109.

[1] https://github.com/curl/curl/commit/a1614c3bcf1593eb524b37792124357d97a5429c
[2] https://curl.se/docs/CVE-2026-87862.html

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../curl/curl/CVE-2026-87862.patch            | 147 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
 2 files changed, 148 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87862.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-87862.patch b/meta/recipes-support/curl/curl/CVE-2026-87862.patch
new file mode 100644
index 00000000000..313b767ea86
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-87862.patch
@@ -0,0 +1,147 @@ 
+From a1614c3bcf1593eb524b37792124357d97a5429c Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 8 Sep 2026 09:07:13 +0200
+Subject: [PATCH] hsts: on load, only remove exact duplicates
+
+Added test3109: verify HSTS when parent+subdomain expires before child
+
+Reported-by: Stanislav Fort
+Closes #22869
+
+CVE: CVE-2026-87862
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a1614c3bcf1593eb524b37792124357d97a5429c]
+
+Backport Changes:
+- Apply the exact-host lookup in curl 8.19.0's hsts_add() using
+  Curl_hsts(); upstream uses hsts_add_host_expire() and hsts_check().
+- Register test3109 in the older grouped tests/data/Makefile.am list.
+
+(cherry picked from commit a1614c3bcf1593eb524b37792124357d97a5429c)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/hsts.c             |  2 +-
+ tests/data/Makefile.am |  2 +-
+ tests/data/test3109    | 86 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 88 insertions(+), 2 deletions(-)
+ create mode 100644 tests/data/test3109
+
+diff --git a/lib/hsts.c b/lib/hsts.c
+index 03f51f8..5ad5bd4 100644
+--- a/lib/hsts.c
++++ b/lib/hsts.c
+@@ -423,7 +423,7 @@ static CURLcode hsts_add(struct hsts *h, const char *line)
+       subdomain = TRUE;
+     }
+     /* only add it if not already present */
+-    e = Curl_hsts(h, curlx_str(&host), curlx_strlen(&host), subdomain);
++    e = Curl_hsts(h, curlx_str(&host), curlx_strlen(&host), FALSE);
+     if(!e)
+       result = hsts_create(h, curlx_str(&host), curlx_strlen(&host),
+                            subdomain, expires);
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index e157596..f39d613 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -279,7 +279,7 @@ test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \
+ test3024 test3025 test3026 test3027 test3028 test3029 test3030 test3031 \
+ test3032 test3033 test3034 test3035 \
+ \
+-test3100 test3101 test3102 test3103 test3104 test3105 \
++test3100 test3101 test3102 test3103 test3104 test3105 test3109 \
+ \
+ test3200 test3201 test3202 test3203 test3204 test3205 test3206 test3207 test3208 \
+ test3209 test3210 test3211 test3212 test3213 test3214 test3215 test3216 \
+diff --git a/tests/data/test3109 b/tests/data/test3109
+new file mode 100644
+index 0000000..d256a40
+--- /dev/null
++++ b/tests/data/test3109
+@@ -0,0 +1,86 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++HSTS
++</keywords>
++</info>
++
++<reply>
++
++# we use this as response to a CONNECT
++<connect crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Server: fake
++
++</connect>
++
++<data nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Type: text/html
++Content-Length: 0
++
++</data>
++</reply>
++
++<client>
++<server>
++http
++http-proxy
++https
++</server>
++<features>
++HSTS
++proxy
++https
++Debug
++</features>
++
++# October 1, 2024
++<setenv>
++CURL_HSTS_HTTP=yes
++CURL_TIME=1727733600
++</setenv>
++
++# the child name has a later expiury than the parent so it must not be removed
++# before
++<file name="%LOGDIR/input%TESTNUMBER">
++.example.test "20241010 09:42:27"
++.child.example.test "20251010 09:42:27"
++</file>
++
++<name>
++HSTS parent expires before child
++</name>
++<command>
++-x http://%HOSTIP:%PROXYPORT http://child.example.test:%HTTPSPORT/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER --insecure
++</command>
++<disable>
++test-duphandle
++</disable>
++</client>
++
++<verify>
++
++<stdout>
++HTTP/1.1 200 OK%CR
++Server: fake%CR
++%CR
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Type: text/html
++Content-Length: 0
++
++</stdout>
++
++<file name="%LOGDIR/input%TESTNUMBER" mode="text">
++# Your HSTS cache. https://curl.se/docs/hsts.html
++# This file was generated by libcurl! Edit at your own risk.
++.example.test "20241010 09:42:27"
++.child.example.test "20251010 09:42:27"
++</file>
++</verify>
++</testcase>
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index be140ccc485..3828c26f507 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -50,6 +50,7 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-80231.patch \
            file://CVE-2026-86414.patch \
            file://CVE-2026-86409.patch \
+           file://CVE-2026-87862.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \