diff mbox series

[scarthgap,20/37] curl: fix CVE-2026-5545

Message ID 476e5ee5af648083fbf642e3c8218c55bd79ce7b.1787154074.git.fabien.thomas@smile.fr
State New
Headers show
Series [scarthgap,01/37] python3-pyopenssl: set CVE_PRODUCT | expand

Commit Message

Fabien Thomas Aug. 19, 2026, 3:56 p.m. UTC 
From: Deepak Rathore <deeratho@cisco.com>

This patch applies the upstream backport for CVE-2026-5545.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].

[1] https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd
[2] https://curl.se/docs/CVE-2026-5545.html

(From OE-Core rev: dfb61bf303fc32257e32719df36344286b1a80e6)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
 .../curl/curl/CVE-2026-5545.patch             | 42 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 43 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-5545.patch b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
new file mode 100644
index 00000000000..d012f39b079
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
@@ -0,0 +1,42 @@ 
+From ab96b09b1163659b83b0716abe42662d1e1630ea Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 5 Jun 2026 01:17:44 -0700
+Subject: [PATCH] url: improve connection reuse on negotiate
+
+Check state of negotiate to allow proper connection reuse.
+
+Closes #21203
+
+CVE: CVE-2026-5545
+Upstream-Status: Backport [https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd]
+
+Backport Changes:
+- curl-8.7.1 still performs the NTLM/Negotiate reuse logic inline in
+  ConnectionExists(), so the upstream guard was adapted there.
+
+(cherry picked from commit 33e43985b8f3b9e66691d06e70be0395849856cd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 30f215fd48..1d6e3309f5 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1219,8 +1219,14 @@ ConnectionExists(struct Curl_easy *data,
+          Curl_timestrcmp(needle->passwd, check->passwd)) {
+
+         /* we prefer a credential match, but this is at least a connection
+-           that can be reused and "upgraded" to NTLM */
++           that can be reused and "upgraded" to NTLM if it does
++           not have any auth ongoing. */
++#ifdef USE_SPNEGO
++        if((check->http_ntlm_state == NTLMSTATE_NONE) &&
++           (check->http_negotiate_state == GSS_AUTHNONE))
++#else
+         if(check->http_ntlm_state == NTLMSTATE_NONE)
++#endif
+           chosen = check;
+         continue;
+       }
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 3e48c58fa78..7ea5723de07 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -38,6 +38,7 @@  SRC_URI = " \
     file://CVE-2026-3784.patch \
     file://CVE-2026-5773.patch \
     file://CVE-2026-6276.patch \
+    file://CVE-2026-5545.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \