diff mbox series

[scarthgap,3/3] curl: set CVE_STATUS for CVE-2026-80231

Message ID 20261104105645.2523473-4-dkelaiya@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series curl: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 10:56 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- Select the native CA connection-reuse fix in [2], identified by
  the advisory [1]. It compares the effective native CA setting.
- The advisory limits the issue to Windows and macOS [1]. Scarthgap
  builds curl, curl-native and nativesdk-curl for Linux.
- In curl 8.7.1, native_ca_store is derived from CURLSSLOPT_NATIVE_CA.
  The same flag is retained in ssl_primary_config.ssl_options,
  which is cloned and compared for connection reuse.
- The later implicit native CA selection in [3] is absent from the
  Scarthgap source. Do not import the Wrynose TLS configuration patch.
- Hence ignoring the CVE using not-applicable-platform for Linux.
  Reassess if the SDK platform or native CA configuration changes.

Reference:
[1] https://curl.se/docs/CVE-2026-80231.html
[2] https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42
[3] https://github.com/curl/curl/commit/eefd03c572996e5de4dec4fe295ad6f103e0eefc

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 meta/recipes-support/curl/curl_8.7.1.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 33265f0f25..28d834abb2 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -66,6 +66,7 @@  CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is
 CVE_STATUS[CVE-2026-82209] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl"
 CVE_STATUS[CVE-2026-12064] = "${@bb.utils.contains('PACKAGECONFIG', 'libssh2', 'unpatched', 'not-applicable-config: SCP/SFTP support is not enabled in PACKAGECONFIG', d)}"
 CVE_STATUS[CVE-2026-19931] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: GSS-API Negotiate is disabled', d)}"
+CVE_STATUS[CVE-2026-80231] = "not-applicable-platform: native CA reuse issue affects Windows and macOS, not Linux"
 
 inherit autotools pkgconfig binconfig multilib_header ptest