From patchwork Tue Aug 25 18:50:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 96303 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69384C61DBD for ; Tue, 25 Aug 2026 18:52:26 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29326.1787683943511595651 for ; Tue, 25 Aug 2026 11:52:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=EJdtYT0Z; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-20260825185221342274920b000207e6-y5amhb@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 20260825185221342274920b000207e6 for ; Tue, 25 Aug 2026 20:52:21 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=VFXjJgANS5ZHJTeRXFLc3x1wNAKAQnXiL8Imp9P8W10=; b=EJdtYT0Z26qwVwv1H8DjNZblG3aUQkZTh/mnt6+3s+iyKW8BbxQrtphqGaa/q2Xccklztj 8kgmkA75rdQovW1goo5VvSQafc4GqGK2FaccxAzXEU4yGIdAXXtPDNnpziIwT5nxlKxMJiPF 7tIDaLhd/+ukAQ8He5YxCW/3efQu2b0uxaSUsNSSaUkcujIMPdLsXIm+YWl4ok/ZLRG3wjP7 1ZEDaZlgVtAA6PREqVj4xiLxn20kRUwc/xQZTRiMkAzQGNCMDD9bNeWilhgrAwJtOLfsa1Ax X8lItVYZplK+kfm4MjrHnY+k7Rp5smquIXRTCTJxnbLfT2MJxXEuej8Q==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH v2 1/5] curl: patch CVE-2026-7009 Date: Tue, 25 Aug 2026 20:50:18 +0200 Message-ID: <20260825185022.1020129-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 25 Aug 2026 18:52:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244267 From: Peter Marko Pick patch per [1]. [1] https://curl.se/docs/CVE-2026-7009.html Signed-off-by: Peter Marko --- .../curl/curl/CVE-2026-7009.patch | 50 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7009.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-7009.patch b/meta/recipes-support/curl/curl/CVE-2026-7009.patch new file mode 100644 index 0000000000..ec124378ec --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-7009.patch @@ -0,0 +1,50 @@ +From 51905671e07f087e28e5741063646c379fe17d89 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Sat, 25 Apr 2026 10:34:06 +0200 +Subject: [PATCH] sectrust: fail on missing OCSP stapling + +When using Apple SecTrust, requiring the server to send +an OCSP response and does not, fail correctly. + +Reported-by: Carlos Carrillo +Closes #21444 + +CVE: CVE-2026-7009 +Upstream-Status: Backport [https://github.com/curl/curl/commit/51905671e07f087e28e5741063646c379fe17d89] +Signed-off-by: Peter Marko +--- + lib/vtls/openssl.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index c84ef8bc65..4629ca4444 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -4744,16 +4744,26 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf, + unsigned char *ocsp_data = NULL; + #endif + long ocsp_len = 0; ++ bool ocsp_missing = FALSE; + if(conn_config->verifystatus && !octx->reused_session) + ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data); + + /* SSL_get_tlsext_status_ocsp_resp() returns the length of the OCSP + response data or -1 if there is no OCSP response data. */ +- if(ocsp_len < 0) ++ if(ocsp_len < 0) { + ocsp_len = 0; /* no data available */ ++ ocsp_missing = TRUE; ++ } + result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs, + ossl_chain_get_der, &chain, + ocsp_data, ocsp_len); ++ if(!result && ocsp_missing && conn_config->verifystatus && ++ !octx->reused_session) { ++ /* verified, but OCSP stapling is required and server sent none */ ++ *pverified = TRUE; ++ failf(data, "No OCSP response received"); ++ return CURLE_SSL_INVALIDCERTSTATUS; ++ } + } + *pverified = !result; + return result; diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index bca7f35d06..ca01e35dcd 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -25,6 +25,7 @@ SRC_URI = " \ file://CVE-2026-4873.patch \ file://CVE-2026-11352.patch \ file://CVE-2026-11586.patch \ + file://CVE-2026-7009.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Tue Aug 25 18:50:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 96299 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1431EC61DBD for ; Tue, 25 Aug 2026 18:50:46 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29681.1787683837950727278 for ; Tue, 25 Aug 2026 11:50:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=BzbAPHRc; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20260825185034f97a125306000207c7-daeash@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20260825185034f97a125306000207c7 for ; Tue, 25 Aug 2026 20:50:34 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=lE85eNcoopGHw+Hr4Hkrnm9MKnxOukfBiCHfT5kHUB0=; b=BzbAPHRczTXiAgdp+qp8BMUWUzmJvHhEA/3sh5374p2Ntc4bkKXFysP2W4yAbsVrrZfhHn JQhKfOK1D9q9S9jEV8PON3epWL2J7q+IUE3AJGERvqRtDX4TvHtbiTGdzn3cKBCKuGjJN6qX Xui3OEKDmNFqFn2zwypn4HmtSlMv1tjcMCVkFudeQBmrKqWu82q/tXccv0X5QouugkrsUMr5 3/i0QwQQ1vfwrZ/uKX/sQ9kViaqSE55xhArWkTWVY0K411yhMU/MMFRbC5dN8+y2A3hNnkVl RwmLHVx0t+poYOYXKhZ83gMPlkgIiDI3GazWsGUNvJzTKT2ETKOjnp0g==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH v2 2/5] curl: patch CVE-2026-8925 Date: Tue, 25 Aug 2026 20:50:19 +0200 Message-ID: <20260825185022.1020129-2-peter.marko@siemens.com> In-Reply-To: <20260825185022.1020129-1-peter.marko@siemens.com> References: <20260825185022.1020129-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 25 Aug 2026 18:50:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244263 From: Peter Marko Pick patch per [1]. [1] https://curl.se/docs/CVE-2026-8925.html Signed-off-by: Peter Marko --- .../curl/curl/CVE-2026-8925.patch | 57 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 58 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8925.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8925.patch b/meta/recipes-support/curl/curl/CVE-2026-8925.patch new file mode 100644 index 0000000000..da486e6ac1 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8925.patch @@ -0,0 +1,57 @@ +From 3da249e1f0716c06644ed3522a37a8bf81808012 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Thu, 14 May 2026 14:35:21 +0200 +Subject: [PATCH] gsasl: fix potential double free + +Also: +- require libgsasl 1.6.0+ (2010-12-14) for a `gsasl_finish()` that + handles a NULL argument. + Ref: https://gitlab.com/gsasl/gsasl/-/commit/b550032df8488a9ceaa3cfd4c634947d8f219717 + +Reported-by: Joshua Rogers (Aisle Research) + +Closes #21609 + +CVE: CVE-2026-8925 +Upstream-Status: Backport [https://github.com/curl/curl/commit/3da249e1f0716c06644ed3522a37a8bf81808012] +Signed-off-by: Peter Marko +--- + docs/INTERNALS.md | 1 + + lib/vauth/gsasl.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md +index c145690a2c..77f2e43735 100644 +--- a/docs/INTERNALS.md ++++ b/docs/INTERNALS.md +@@ -30,6 +30,7 @@ We aim to support these or later versions. + - c-ares 1.6.0 (2008-12-09) + - GnuTLS 3.6.5 (2018-12-01) + - libidn2 2.0.0 (2017-03-29) ++- libgsasl 1.6.0 (2010-12-14) + - LibreSSL 2.9.1 (2019-04-22) + - libssh 0.9.0 (2019-06-28) + - libssh2 1.9.0 (2019-06-20) +diff --git a/lib/vauth/gsasl.c b/lib/vauth/gsasl.c +index 3ea77eecd1..10a83fdb09 100644 +--- a/lib/vauth/gsasl.c ++++ b/lib/vauth/gsasl.c +@@ -32,6 +32,10 @@ + + #include + ++#if GSASL_VERSION_NUMBER < 0x010600 ++#error "requires libgsasl 1.6.0+" ++#endif ++ + bool Curl_auth_gsasl_is_supported(struct Curl_easy *data, + const char *mech, + struct gsasldata *gsasl) +@@ -47,6 +51,7 @@ bool Curl_auth_gsasl_is_supported(struct Curl_easy *data, + res = gsasl_client_start(gsasl->ctx, mech, &gsasl->client); + if(res != GSASL_OK) { + gsasl_done(gsasl->ctx); ++ gsasl->ctx = NULL; + return FALSE; + } + diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index ca01e35dcd..6ad1bfe55f 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -26,6 +26,7 @@ SRC_URI = " \ file://CVE-2026-11352.patch \ file://CVE-2026-11586.patch \ file://CVE-2026-7009.patch \ + file://CVE-2026-8925.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Tue Aug 25 18:50:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 96300 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CA83C61DC2 for ; Tue, 25 Aug 2026 18:50:46 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29683.1787683840056014881 for ; Tue, 25 Aug 2026 11:50:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=VN+iMRjX; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-202608251850388e90f841e40002070f-v_7hk2@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 202608251850388e90f841e40002070f for ; Tue, 25 Aug 2026 20:50:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=wgb4hwgy0eZn5Sgw/OcDpPNmEy2sQhCIWNXWahzWT14=; b=VN+iMRjXQURgPSBAjiF0USqeGdFFfgY/Hz9yp5J/asEp2pCGffP0nYKHCC8i91a9zrISqQ sk4xMrDsfqM3tv6rTLyKgxy1AX2Igl/02HiTxZeU4OGfARidk0KgetWZExJF+ryf548MbUbG 5Lf0ZJaR05aeVTXlkNL3aobHcGx31bScmLI/TpkaYfuCCTS5D+fVzvgENX6KizijlWzVgQqF RdJp4KxSSuUfBYKpRKDqdBWKBNWK56ZVTfQZsFhDDMnfxlADZy1eJxiFjB5rzeLF1s24NPsK YS74AcsyIYwIdnrwjvHCK5p8nqGDVh7AU/riduQGb8ujn+f6Lnr87btw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH v2 3/5] curl: patch CVE-2026-9080 Date: Tue, 25 Aug 2026 20:50:20 +0200 Message-ID: <20260825185022.1020129-3-peter.marko@siemens.com> In-Reply-To: <20260825185022.1020129-1-peter.marko@siemens.com> References: <20260825185022.1020129-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 25 Aug 2026 18:50:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244264 From: Peter Marko Pick patch per [1]. [1] https://curl.se/docs/CVE-2026-9080.html Signed-off-by: Peter Marko --- .../curl/curl/CVE-2026-9080.patch | 95 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 96 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9080.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-9080.patch b/meta/recipes-support/curl/curl/CVE-2026-9080.patch new file mode 100644 index 0000000000..b1cf613f8a --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-9080.patch @@ -0,0 +1,95 @@ +From 5ab34cba42e4ee4282fe8bab43f311d51b9bf9bd Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 26 May 2026 09:52:19 +0200 +Subject: [PATCH] multi: handle pause in multi socket callback + +The mev_sh_entry object might be removed if curl_easy_pause() is called +from within the socket callback. + +Introduced a 'magic' struct field to to 'mev_sh_entry' to make it easier +to programmatically detect/assert if the pointer is bad - in debug +builds. + +Reported-by: Joshua Rogers +Closes #21748 + +CVE: CVE-2026-9080 +Upstream-Status: Backport [https://github.com/curl/curl/commit/5ab34cba42e4ee4282fe8bab43f311d51b9bf9bd] +Signed-off-by: Peter Marko +--- + lib/multi_ev.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/lib/multi_ev.c b/lib/multi_ev.c +index 478d5a48d5..7ea3b2827e 100644 +--- a/lib/multi_ev.c ++++ b/lib/multi_ev.c +@@ -40,6 +40,8 @@ static void mev_in_callback(struct Curl_multi *multi, bool value) + multi->in_callback = value; + } + ++#define SH_ENTRY_MAGIC 0x570091d ++ + /* Information about a socket for which we inform the libcurl application + * what to supervise (CURL_POLL_IN/CURL_POLL_OUT/CURL_POLL_REMOVE) + */ +@@ -51,6 +53,9 @@ struct mev_sh_entry { + * libcurl application to watch out for */ + unsigned int readers; /* this many transfers want to read */ + unsigned int writers; /* this many transfers want to write */ ++#ifdef DEBUGBUILD ++ unsigned int magic; ++#endif + BIT(announced); /* this socket has been passed to the socket + callback at least once */ + }; +@@ -75,6 +80,9 @@ static void mev_sh_entry_dtor(void *freethis) + { + struct mev_sh_entry *entry = (struct mev_sh_entry *)freethis; + Curl_uint32_spbset_destroy(&entry->xfers); ++#ifdef DEBUGBUILD ++ entry->magic = 0; ++#endif + curlx_free(entry); + } + +@@ -113,7 +121,9 @@ static struct mev_sh_entry *mev_sh_entry_add(struct Curl_hash *sh, + mev_sh_entry_dtor(check); + return NULL; /* major failure */ + } +- ++#ifdef DEBUGBUILD ++ check->magic = SH_ENTRY_MAGIC; ++#endif + return check; /* things are good in sockhash land */ + } + +@@ -223,6 +233,7 @@ static CURLMcode mev_sh_entry_update(struct Curl_multi *multi, + + /* we should only be called when the callback exists */ + DEBUGASSERT(multi->socket_cb); ++ DEBUGASSERT(entry->magic == SH_ENTRY_MAGIC); + if(!multi->socket_cb) + return CURLM_OK; + +@@ -272,12 +283,18 @@ static CURLMcode mev_sh_entry_update(struct Curl_multi *multi, + rc = multi->socket_cb(data, s, comboaction, multi->socket_userp, + entry->user_data); + mev_in_callback(multi, FALSE); +- entry->announced = TRUE; + if(rc == -1) { + multi->dead = TRUE; + return CURLM_ABORTED_BY_CALLBACK; + } +- entry->action = (unsigned int)comboaction; ++ /* curl_easy_pause() is documented as callable from any callback; it ++ * re-enters mev_assess() which may free this 'entry'. Re-fetch. */ ++ entry = mev_sh_entry_get(&multi->ev.sh_entries, s); ++ if(entry) { ++ DEBUGASSERT(entry->magic == SH_ENTRY_MAGIC); ++ entry->announced = TRUE; ++ entry->action = (unsigned int)comboaction; ++ } + return CURLM_OK; + } + diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 6ad1bfe55f..9de6b1c4dd 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -27,6 +27,7 @@ SRC_URI = " \ file://CVE-2026-11586.patch \ file://CVE-2026-7009.patch \ file://CVE-2026-8925.patch \ + file://CVE-2026-9080.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Tue Aug 25 18:50:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 96301 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C020C61DB9 for ; Tue, 25 Aug 2026 18:50:46 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29685.1787683841542538592 for ; Tue, 25 Aug 2026 11:50:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=aE5UzbPo; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20260825185039c8c3dfedc800020704-i4_aol@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20260825185039c8c3dfedc800020704 for ; Tue, 25 Aug 2026 20:50:39 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=5hDsqwAHHRrs9xy2dP9F+vnoTXVAtReA7Is4vTcif5A=; b=aE5UzbPor1t5KQG6yt37+T8Ea10cQ25UqoJOg/VkRMoEGJCik0ovDrDMVb8F6aGFOxP1J4 oyMV7QTFkqqaDg6WpNuQLEYb/1oYE+eCk55Cp3Z4wjd4FJMC3tk1LIGt22CMgfx+f34zfP1U Q+xk1lRvULh5zFKg8IwJ4Wi4nPOzQvw4tJk8XM3kEapBuvAW0b5uW/KF8gGG2bnCxYo4kLhr RzgmkslJFY2+iHEXB7mmiUJkh+g0eC7ou3d0GbhSlA1L1+Z1FvaMnKqqdnixryJAW/k7zGbG Rs+bcuyHTgkQCWYhbJHPyVKUPvQdJ3P/Qprfo3G0efYxcn2JqvDeQ+FQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH v2 4/5] curl: patch CVE-2026-9545 Date: Tue, 25 Aug 2026 20:50:21 +0200 Message-ID: <20260825185022.1020129-4-peter.marko@siemens.com> In-Reply-To: <20260825185022.1020129-1-peter.marko@siemens.com> References: <20260825185022.1020129-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 25 Aug 2026 18:50:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244265 From: Peter Marko Pick patch per [1]. Also pick additional patch for a clean cherry-pick. [1] https://curl.se/docs/CVE-2026-9545.html Signed-off-by: Peter Marko --- .../curl/curl/CVE-2026-9545-01.patch | 157 ++++++++++++++++++ .../curl/curl/CVE-2026-9545-02.patch | 67 ++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 2 + 3 files changed, 226 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9545-01.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9545-02.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-9545-01.patch b/meta/recipes-support/curl/curl/CVE-2026-9545-01.patch new file mode 100644 index 0000000000..5325c51e5e --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-9545-01.patch @@ -0,0 +1,157 @@ +From 41aaac61e215a827619b896d5b8588200cfdae28 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Wed, 18 Mar 2026 11:37:18 +0100 +Subject: [PATCH] lib: always use Curl_1st_fatal instead of Curl_1st_err + +Curl_1st_err() does not return the second error if the first result is +CURLE_AGAIN. This may cause errors to not become noticeable when they +should be. + +Replace all use of Curl_1st_err() with Curl_1st_fatal(), which handles +CURLE_AGAIN as a not-a-real-error case. + +Closes #20980 + +CVE: CVE-2026-9545 +Upstream-Status: Backport [https://github.com/curl/curl/commit/41aaac61e215a827619b896d5b8588200cfdae28] +Signed-off-by: Peter Marko +--- + lib/easy.c | 6 ++++-- + lib/http.c | 2 +- + lib/multi.c | 2 +- + lib/url.c | 5 ----- + lib/url.h | 7 ------- + lib/vquic/curl_ngtcp2.c | 6 +++--- + lib/vquic/curl_quiche.c | 4 ++-- + 7 files changed, 11 insertions(+), 21 deletions(-) + +diff --git a/lib/easy.c b/lib/easy.c +index 2c653b00e9..5a5dac4f56 100644 +--- a/lib/easy.c ++++ b/lib/easy.c +@@ -1157,12 +1157,14 @@ CURLcode curl_easy_pause(CURL *d, int action) + if((send_paused != send_paused_new) || + (send_paused_new != Curl_creader_is_paused(data))) { + changed = TRUE; +- result = Curl_1st_err(result, Curl_xfer_pause_send(data, send_paused_new)); ++ result = Curl_1st_fatal( ++ result, Curl_xfer_pause_send(data, send_paused_new)); + } + + if(recv_paused != recv_paused_new) { + changed = TRUE; +- result = Curl_1st_err(result, Curl_xfer_pause_recv(data, recv_paused_new)); ++ result = Curl_1st_fatal( ++ result, Curl_xfer_pause_recv(data, recv_paused_new)); + } + + /* If not completely pausing both directions now, run again in any case. */ +diff --git a/lib/http.c b/lib/http.c +index aa34b5d14f..96e7b0de0c 100644 +--- a/lib/http.c ++++ b/lib/http.c +@@ -4135,7 +4135,7 @@ static CURLcode http_on_response(struct Curl_easy *data, + out: + if(last_hd) { + /* if not written yet, write it now */ +- result = Curl_1st_err( ++ result = Curl_1st_fatal( + result, http_write_header(data, last_hd, last_hd_len)); + } + if(conn_changed) { +diff --git a/lib/multi.c b/lib/multi.c +index 482c160fde..685bb01f0c 100644 +--- a/lib/multi.c ++++ b/lib/multi.c +@@ -718,7 +718,7 @@ static CURLcode multi_done(struct Curl_easy *data, + } + + /* Make sure that transfer client writes are really done now. */ +- result = Curl_1st_err(result, Curl_xfer_write_done(data, premature)); ++ result = Curl_1st_fatal(result, Curl_xfer_write_done(data, premature)); + + /* Inform connection filters that this transfer is done */ + Curl_conn_ev_data_done(data, premature); +diff --git a/lib/url.c b/lib/url.c +index a9ef60709a..cd06d6c626 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -3875,11 +3875,6 @@ void *Curl_conn_meta_get(struct connectdata *conn, const char *key) + return Curl_hash_pick(&conn->meta_hash, CURL_UNCONST(key), strlen(key) + 1); + } + +-CURLcode Curl_1st_err(CURLcode r1, CURLcode r2) +-{ +- return r1 ? r1 : r2; +-} +- + CURLcode Curl_1st_fatal(CURLcode r1, CURLcode r2) + { + if(r1 && (r1 != CURLE_AGAIN)) +diff --git a/lib/url.h b/lib/url.h +index 09bc33390f..0afa7eb26e 100644 +--- a/lib/url.h ++++ b/lib/url.h +@@ -92,16 +92,9 @@ bool Curl_conn_seems_dead(struct connectdata *conn, + CURLcode Curl_conn_upkeep(struct Curl_easy *data, + struct connectdata *conn); + +-/** +- * Always eval all arguments, return the first result != CURLE_OK. +- * A non-short-circuit evaluation. +- */ +-CURLcode Curl_1st_err(CURLcode r1, CURLcode r2); +- + /** + * Always eval all arguments, return the first + * result != (CURLE_OK|CURLE_AGAIN) or `r1`. +- * A non-short-circuit evaluation. + */ + CURLcode Curl_1st_fatal(CURLcode r1, CURLcode r2); + +diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c +index ea79eaf747..04f660ac63 100644 +--- a/lib/vquic/curl_ngtcp2.c ++++ b/lib/vquic/curl_ngtcp2.c +@@ -1461,8 +1461,8 @@ static CURLcode cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data, + result = CURLE_AGAIN; + + out: +- result = Curl_1st_err(result, cf_progress_egress(cf, data, &pktx)); +- result = Curl_1st_err(result, check_and_set_expiry(cf, data, &pktx)); ++ result = Curl_1st_fatal(result, cf_progress_egress(cf, data, &pktx)); ++ result = Curl_1st_fatal(result, check_and_set_expiry(cf, data, &pktx)); + denied: + CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv(blen=%zu) -> %d, %zu", + stream ? stream->id : -1, blen, result, *pnread); +@@ -1788,7 +1788,7 @@ static CURLcode cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data, + result = cf_progress_egress(cf, data, &pktx); + + out: +- result = Curl_1st_err(result, check_and_set_expiry(cf, data, &pktx)); ++ result = Curl_1st_fatal(result, check_and_set_expiry(cf, data, &pktx)); + denied: + CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %d, %zu", + stream ? stream->id : -1, len, result, *pnwritten); +diff --git a/lib/vquic/curl_quiche.c b/lib/vquic/curl_quiche.c +index a9a5ae6b99..4e8788aa1e 100644 +--- a/lib/vquic/curl_quiche.c ++++ b/lib/vquic/curl_quiche.c +@@ -918,7 +918,7 @@ static CURLcode cf_quiche_recv(struct Curl_cfilter *cf, struct Curl_easy *data, + result = CURLE_AGAIN; + + out: +- result = Curl_1st_err(result, cf_flush_egress(cf, data)); ++ result = Curl_1st_fatal(result, cf_flush_egress(cf, data)); + if(*pnread > 0) + ctx->data_recvd += *pnread; + CURL_TRC_CF(data, cf, "[%" PRIu64 "] cf_recv(len=%zu) -> %d, %zu, total=%" +@@ -1144,7 +1144,7 @@ static CURLcode cf_quiche_send(struct Curl_cfilter *cf, struct Curl_easy *data, + } + + out: +- result = Curl_1st_err(result, cf_flush_egress(cf, data)); ++ result = Curl_1st_fatal(result, cf_flush_egress(cf, data)); + + CURL_TRC_CF(data, cf, "[%" PRIu64 "] cf_send(len=%zu) -> %d, %zu", + stream ? stream->id : (uint64_t)~0, len, diff --git a/meta/recipes-support/curl/curl/CVE-2026-9545-02.patch b/meta/recipes-support/curl/curl/CVE-2026-9545-02.patch new file mode 100644 index 0000000000..4fc60eb5c9 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-9545-02.patch @@ -0,0 +1,67 @@ +From 7b9613fa9b1a5e04301a3920eef58e8138dad05e Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 21 May 2026 14:21:59 +0200 +Subject: [PATCH] ngtcp2: fail handshake directly + +When certificate verification fails, error out of the handshake +callback, forcing ngtcp2 to stop processing the connection any further. + +Closes #21712 + +CVE: CVE-2026-9545 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e] +Signed-off-by: Peter Marko +--- + lib/vquic/curl_ngtcp2.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c +index 4d27ebc0c1..fb7fd61889 100644 +--- a/lib/vquic/curl_ngtcp2.c ++++ b/lib/vquic/curl_ngtcp2.c +@@ -504,7 +504,7 @@ static int cf_ngtcp2_handshake_completed(ngtcp2_conn *tconn, void *user_data) + data = CF_DATA_CURRENT(cf); + DEBUGASSERT(data); + if(!ctx || !data) +- return NGHTTP3_ERR_CALLBACK_FAILURE; ++ return NGTCP2_ERR_CALLBACK_FAILURE; + + ctx->handshake_at = *Curl_pgrs_now(data); + ctx->tls_handshake_complete = TRUE; +@@ -512,6 +512,9 @@ static int cf_ngtcp2_handshake_completed(ngtcp2_conn *tconn, void *user_data) + + ctx->tls_vrfy_result = Curl_vquic_tls_verify_peer(&ctx->tls, cf, + data, &ctx->peer); ++ if(ctx->tls_vrfy_result) ++ return NGTCP2_ERR_CALLBACK_FAILURE; ++ + #ifdef CURLVERBOSE + if(Curl_trc_is_verbose(data)) { + const ngtcp2_transport_params *rp; +@@ -1463,6 +1466,8 @@ static CURLcode cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data, + out: + result = Curl_1st_fatal(result, cf_progress_egress(cf, data, &pktx)); + result = Curl_1st_fatal(result, check_and_set_expiry(cf, data, &pktx)); ++ if(ctx->tls_vrfy_result) ++ result = ctx->tls_vrfy_result; + denied: + CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv(blen=%zu) -> %d, %zu", + stream ? stream->id : -1, blen, result, *pnread); +@@ -1789,6 +1794,8 @@ static CURLcode cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data, + + out: + result = Curl_1st_fatal(result, check_and_set_expiry(cf, data, &pktx)); ++ if(ctx->tls_vrfy_result) ++ result = ctx->tls_vrfy_result; + denied: + CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %d, %zu", + stream ? stream->id : -1, len, result, *pnwritten); +@@ -2717,6 +2724,8 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf, + } + + out: ++ if(ctx->tls_vrfy_result) ++ result = ctx->tls_vrfy_result; + if(ctx->qconn && + ((result == CURLE_RECV_ERROR) || (result == CURLE_SEND_ERROR)) && + ngtcp2_conn_in_draining_period(ctx->qconn)) { diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 9de6b1c4dd..e228618cc3 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -28,6 +28,8 @@ SRC_URI = " \ file://CVE-2026-7009.patch \ file://CVE-2026-8925.patch \ file://CVE-2026-9080.patch \ + file://CVE-2026-9545-01.patch \ + file://CVE-2026-9545-02.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Tue Aug 25 18:50:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 96302 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A955C61DC6 for ; Tue, 25 Aug 2026 18:50:46 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29685.1787683841542538592 for ; Tue, 25 Aug 2026 11:50:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=UpcFuXfA; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20260825185043d83ac925be000207eb-nd4ins@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20260825185043d83ac925be000207eb for ; Tue, 25 Aug 2026 20:50:43 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=zz5UV5ZGaAoe0e4EwPofM4v8tWDjtfuvW1Kzed99tnQ=; b=UpcFuXfAkI6JRv+n4GvV2EGgofI8Pi2Rt11CJ7VcPOQ0fFVw+t1bKgBaUi/tZwKZmn7nzM f2wAsoDEgtsb+J486ViKIp6d4ggpYm59QxjP3Q9409yEiYRM1FFDqxa+SgDY+RU4WIUgy8Kt 1nBXlUJTAvJ7xSdUvUGbrnlUWJ4t7qfzb/L5HbOkgUjSZx3CCShMRhIyFt+HtYygxgZMXWmL UO1vkgteJt0MLtOBcet2v8OLcMksjyoVxT1UfKpk76B5HArzeYLZYBReo6l/HnvLEqqacOgC UsfBeo2W2+Txv5pxJ8bIgmbsgHRh09hapACDmAbb3l9Vjh8+s4R1jmBQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH v2 5/5] curl: patch CVE-2026-9546 Date: Tue, 25 Aug 2026 20:50:22 +0200 Message-ID: <20260825185022.1020129-5-peter.marko@siemens.com> In-Reply-To: <20260825185022.1020129-1-peter.marko@siemens.com> References: <20260825185022.1020129-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 25 Aug 2026 18:50:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244266 From: Peter Marko Pick patch per [1]. Pick also a precondition patch (containing if clause to else which is added by the actual patch). Resolve conflicts in test makefiles caused by differences in available test suites. [1] https://curl.se/docs/CVE-2026-9546.html Signed-off-by: Peter Marko --- .../curl/curl/CVE-2026-9546-01.patch | 227 ++++++++++++++++++ .../curl/curl/CVE-2026-9546-02.patch | 216 +++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 2 + 3 files changed, 445 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9546-01.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9546-02.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-9546-01.patch b/meta/recipes-support/curl/curl/CVE-2026-9546-01.patch new file mode 100644 index 0000000000..9cd1a20166 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-9546-01.patch @@ -0,0 +1,227 @@ +From fa057ea3dedb04f93672ec95ee964f1f02ec0ecf Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 15 Apr 2026 08:11:33 +0200 +Subject: [PATCH] transfer: clear the old autoreferer + +Verify in test 2505 + +Closes #21322 + +CVE: CVE-2026-9546 +Upstream-Status: Backport [https://github.com/curl/curl/commit/fa057ea3dedb04f93672ec95ee964f1f02ec0ecf] +Signed-off-by: Peter Marko +--- + lib/setopt.c | 1 - + lib/transfer.c | 5 +++ + tests/data/Makefile.am | 2 +- + tests/data/test2505 | 67 +++++++++++++++++++++++++++++++++++ + tests/libtest/Makefile.inc | 2 +- + tests/libtest/lib2505.c | 71 ++++++++++++++++++++++++++++++++++++++ + 6 files changed, 145 insertions(+), 3 deletions(-) + create mode 100644 tests/data/test2505 + create mode 100644 tests/libtest/lib2505.c + +diff --git a/lib/setopt.c b/lib/setopt.c +index dae4218b70..e832ef1afd 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -2015,7 +2015,6 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option, + * String to set in the HTTP Referer: field. + */ + result = Curl_setstropt(&s->str[STRING_SET_REFERER], ptr); +- Curl_bufref_set(&data->state.referer, s->str[STRING_SET_REFERER], 0, NULL); + break; + + case CURLOPT_USERAGENT: +diff --git a/lib/transfer.c b/lib/transfer.c +index a2fce9331b..fd1a903dab 100644 +--- a/lib/transfer.c ++++ b/lib/transfer.c +@@ -535,6 +535,11 @@ CURLcode Curl_pretransfer(struct Curl_easy *data) + data->state.authproxy.want = data->set.proxyauth; + Curl_safefree(data->info.wouldredirect); + Curl_data_priority_clear_state(data); ++ if(data->set.http_auto_referer) ++ Curl_bufref_free(&data->state.referer); ++ if(data->set.str[STRING_SET_REFERER]) ++ Curl_bufref_set(&data->state.referer, data->set.str[STRING_SET_REFERER], ++ 0, NULL); + + if(data->state.httpreq == HTTPREQ_PUT) + data->state.infilesize = data->set.filesize; +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 1e84b26820..238da5331c 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -265,7 +265,7 @@ test2309 \ + \ + test2400 test2401 test2402 test2403 test2404 test2405 test2406 test2407 \ + \ +-test2500 test2501 test2502 test2503 test2504 test2506 \ ++test2500 test2501 test2502 test2503 test2504 test 2505 test2506 \ + \ + test2600 test2601 test2602 test2603 test2604 test2605 \ + \ +diff --git a/tests/data/test2505 b/tests/data/test2505 +new file mode 100644 +index 0000000000..8fac590b37 +--- /dev/null ++++ b/tests/data/test2505 +@@ -0,0 +1,67 @@ ++ ++ ++ ++ ++HTTP ++referer ++autoreferer ++ ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 301 redirect ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: server.example.com ++Content-Length: 47 ++Location: %TESTNUMBER0002 ++ ++file contents should appear once for each file ++ ++ ++ ++HTTP/1.1 200 OK ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: server.example.com ++Content-Length: 47 ++ ++file contents should appear once for each file ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++ ++lib%TESTNUMBER ++ ++ ++verify CURLOPT_AUTOREFERER switched off ++ ++ ++http://%HOSTIP:%HTTPPORT ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++Accept: */* ++ ++GET /%TESTNUMBER0002 HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++Accept: */* ++Referer: http://%HOSTIP:%HTTPPORT/ ++ ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++Accept: */* ++ ++ ++ ++ +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 249c6fda87..bdf8a1dbea 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -113,7 +113,7 @@ TESTS_C = \ + lib2023.c lib2032.c lib2082.c \ + lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \ + lib2402.c lib2404.c lib2405.c \ +- lib2502.c lib2504.c lib2506.c \ ++ lib2502.c lib2504.c lib2505.c lib2506.c \ + lib2700.c \ + lib3010.c lib3025.c lib3026.c lib3027.c lib3033.c lib3034.c \ + lib3100.c lib3101.c lib3102.c lib3103.c lib3104.c lib3105.c \ +diff --git a/tests/libtest/lib2505.c b/tests/libtest/lib2505.c +new file mode 100644 +index 0000000000..c170259874 +--- /dev/null ++++ b/tests/libtest/lib2505.c +@@ -0,0 +1,71 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Linus Nielsen Feltzing ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++#include "first.h" ++ ++#include "testtrace.h" ++ ++static size_t sink2505(char *ptr, size_t size, size_t nmemb, void *ud) ++{ ++ (void)ptr; ++ (void)ud; ++ return size * nmemb; ++} ++ ++static CURLcode test_lib2505(const char *URL) ++{ ++ CURL *curl; ++ CURLcode result = CURLE_OUT_OF_MEMORY; ++ ++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { ++ curl_mfprintf(stderr, "curl_global_init() failed\n"); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2505); ++ test_setopt(curl, CURLOPT_AUTOREFERER, 1L); ++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); ++ test_setopt(curl, CURLOPT_URL, URL); ++ ++ result = curl_easy_perform(curl); ++ curl_mprintf("req1=%d\n", (int)result); ++ ++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L); ++ test_setopt(curl, CURLOPT_URL, URL); ++ ++ result = curl_easy_perform(curl); ++ curl_mprintf("req2=%d\n", (int)result); ++ ++test_cleanup: ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ ++ return result; ++} diff --git a/meta/recipes-support/curl/curl/CVE-2026-9546-02.patch b/meta/recipes-support/curl/curl/CVE-2026-9546-02.patch new file mode 100644 index 0000000000..4306b508d1 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-9546-02.patch @@ -0,0 +1,216 @@ +From 862e8a74a84478d82973471b4f49dc2746c1780e Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 25 May 2026 16:43:00 +0200 +Subject: [PATCH] transfer: clear referer when set to NULL + +Verify in test 1649 + +Closes #21741 + +CVE: CVE-2026-9546 +Upstream-Status: Backport [https://github.com/curl/curl/commit/862e8a74a84478d82973471b4f49dc2746c1780e] +Signed-off-by: Peter Marko +--- + lib/transfer.c | 2 + + tests/data/Makefile.am | 1 + + tests/data/test1649 | 55 +++++++++++++++++++++++ + tests/libtest/Makefile.inc | 1 + + tests/libtest/lib1649.c | 90 ++++++++++++++++++++++++++++++++++++++ + 5 files changed, 149 insertions(+) + create mode 100644 tests/data/test1649 + create mode 100644 tests/libtest/lib1649.c + +diff --git a/lib/transfer.c b/lib/transfer.c +index 721ad8d9ce..49930518ee 100644 +--- a/lib/transfer.c ++++ b/lib/transfer.c +@@ -540,6 +540,8 @@ CURLcode Curl_pretransfer(struct Curl_easy *data) + if(data->set.str[STRING_SET_REFERER]) + Curl_bufref_set(&data->state.referer, data->set.str[STRING_SET_REFERER], + 0, NULL); ++ else ++ Curl_bufref_free(&data->state.referer); + + if(data->state.httpreq == HTTPREQ_PUT) + data->state.infilesize = data->set.filesize; +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 238da5331c..e8feaf3533 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -217,6 +217,7 @@ test1614 test1615 test1616 test1617 \ + test1620 test1621 test1622 test1623 test1624 \ + \ + test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \ ++test1649 \ + \ + test1640 test1641 test1642 test1643 \ + \ +diff --git a/tests/data/test1649 b/tests/data/test1649 +new file mode 100644 +index 0000000000..d2fd7799bd +--- /dev/null ++++ b/tests/data/test1649 +@@ -0,0 +1,55 @@ ++ ++ ++ ++ ++HTTP ++Referer ++ ++ ++ ++# Server-side ++ ++ ++# this is returned first since we get no proxy-auth ++ ++HTTP/1.1 200 OK ++Content-Length: 6 ++ ++hello ++ ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++ ++ ++lib%TESTNUMBER ++ ++ ++Set referer first then NULL it ++ ++ ++http://%HOSTIP:%HTTPPORT ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++Accept: */* ++Referer: https://secret.example.com/ ++ ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++Accept: */* ++ ++ ++ ++ ++ +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index ad86411a7f..d9a94a1e71 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -100,6 +100,7 @@ TESTS_C = \ + lib1582.c lib1588.c \ + lib1591.c lib1592.c lib1593.c lib1594.c lib1597.c \ + lib1598.c lib1599.c \ ++ lib1649.c \ + lib1662.c \ + lib1900.c lib1901.c lib1902.c lib1903.c lib1905.c lib1906.c lib1907.c \ + lib1908.c lib1910.c lib1911.c lib1912.c lib1913.c \ +diff --git a/tests/libtest/lib1649.c b/tests/libtest/lib1649.c +new file mode 100644 +index 0000000000..2dd66c0231 +--- /dev/null ++++ b/tests/libtest/lib1649.c +@@ -0,0 +1,90 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, , et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++ ++#include "first.h" ++ ++/* this is meant to pick up the proxy from the environment variable */ ++static CURLcode init1649(CURL *curl, const char *url) ++{ ++ CURLcode result = CURLE_OK; ++ ++ res_easy_setopt(curl, CURLOPT_URL, url); ++ if(result) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ++ if(result) ++ goto init_failed; ++ ++ return CURLE_OK; /* success */ ++ ++init_failed: ++ return result; /* failure */ ++} ++ ++static CURLcode run1649(CURL *curl, const char *url) ++{ ++ CURLcode result = CURLE_OK; ++ ++ result = init1649(curl, url); ++ if(result) ++ return result; ++ ++ return curl_easy_perform(curl); ++} ++ ++static CURLcode test_lib1649(const char *URL) ++{ ++ CURLcode result = CURLE_OK; ++ CURL *curl = NULL; ++ ++ res_global_init(CURL_GLOBAL_ALL); ++ if(result) ++ return result; ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ start_test_timing(); ++ ++ easy_setopt(curl, CURLOPT_REFERER, "https://secret.example.com/"); ++ ++ result = run1649(curl, URL); ++ if(result) ++ goto test_cleanup; ++ ++ /* reset it */ ++ easy_setopt(curl, CURLOPT_REFERER, NULL); ++ ++ result = run1649(curl, URL); ++ ++test_cleanup: ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ return result; ++} diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index e228618cc3..73d4394ca9 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -30,6 +30,8 @@ SRC_URI = " \ file://CVE-2026-9080.patch \ file://CVE-2026-9545-01.patch \ file://CVE-2026-9545-02.patch \ + file://CVE-2026-9546-01.patch \ + file://CVE-2026-9546-02.patch \ " SRC_URI:append:class-nativesdk = " \