diff mbox series

[scarthgap,1/3] curl: set CVE_STATUS for CVE-2026-19931

Message ID 20261104105645.2523473-2-dkelaiya@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series curl: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 10:56 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- The advisory [1] names [2] as its fixed-in commit. It moves
  connection maintenance to admin handles, preserving the identity
  used by authentication reuse checks.
- Earlier, [4] added Negotiate/NTLM connection reuse checks,
  including an SSPI ambient-user check using recent_conn_id.
  Later, [5] removed that SSPI check; the other checks remain.
- Curl 8.7.1 predates [4]. Applying [2] alone would not reproduce
  the later upstream behavior; a source fix needs backport analysis.
- The advisory describes Negotiate reuse with empty credentials and
  lists curl 8.7.1 within the affected range [1].
- On Linux, this requires krb5 and negotiate-auth. Scarthgap enables
  negotiate-auth but leaves krb5 disabled by default.
- Follow the merged GSS-API configuration check in [3]. Set
  not-applicable-config if either option is absent; otherwise keep
  unpatched while the source backport is deferred.
- Record the CVE as not-applicable-config unless both required
  PACKAGECONFIG options are enabled; otherwise retain unpatched status.
  The CVE_STATUS decision is conditional, not hardcoded.

Reference:
[1] https://curl.se/docs/CVE-2026-19931.html
[2] https://github.com/curl/curl/commit/7103a93b05bc69ea98ed9d05d02fa9eeba533f2f
[3] https://github.com/openembedded/openembedded-core/commit/93c410c455b92a2b1fe3b77347e57d02f344056b
[4] https://github.com/curl/curl/commit/1a17959fc7a80864c9c9b37097856bdb4a465cf8
[5] https://github.com/curl/curl/commit/1c58877705b172da892cb9c18c5edb572f2d1d73

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 meta/recipes-support/curl/curl_8.7.1.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index ab33d4aa77..b308aa1e3f 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -64,6 +64,7 @@  CVE_STATUS[CVE-2026-8458] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotia
 CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is not enabled by the recipe"
 CVE_STATUS[CVE-2026-82209] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl"
 CVE_STATUS[CVE-2026-12064] = "${@bb.utils.contains('PACKAGECONFIG', 'libssh2', 'unpatched', 'not-applicable-config: SCP/SFTP support is not enabled in PACKAGECONFIG', d)}"
+CVE_STATUS[CVE-2026-19931] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: GSS-API Negotiate is disabled', d)}"
 
 inherit autotools pkgconfig binconfig multilib_header ptest