From patchwork Fri Sep 4 09:00:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 97266 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12463C79F87 for ; Fri, 4 Sep 2026 09:00:17 +0000 (UTC) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9551.1788512409467513020 for ; Fri, 04 Sep 2026 02:00:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=V7U3ixKU; spf=pass (domain: cisco.com, ip: 173.37.142.93, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3622; q=dns/txt; s=iport01; t=1788512409; x=1789722009; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=69MdxyJjjN0k6VBUdLblNXZY1MR4w6iIg03xtl74R2Y=; b=V7U3ixKUNLqmLx8oj2uEOL0G5r3r41laFceELmfteViELp1p3MNFYGa/ 9eeoxoWlreL9a+6bDRyAHxuwMi4VN4N4hGGg8WgsDuQ6mM3f4DClfWmG0 pwe2R57mDkoblePcIsKvmaMigrZr5457m+37E7lTUittt/Rho6jib9MZX wFfR6bzkr4KGFJPlun/rXM2y+0faU6AAbiUaa6lADR5CdjldBM48Ubnkt cupRbk/tmLpE7ezO7t1Hvt+ip8ZtmWBo8nCB356giZZbV6hbu61PqFwcP cpukCCbAdVcOmduCRfScbg32oy4GJZctVjbtuEFzuiW1smlIhLO9++6IT g==; X-CSE-ConnectionGUID: wQWPtZARTWq4O9xcdH/gvg== X-CSE-MsgGUID: Ze0vwEDVQ9ebS00Et1D2kA== X-IPAS-Result: A0BFAgBwh5pq/5EQJK1aglmCV3RgQ0mWSp4egX4PAQEBD0QNBAEBhQWOBAImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDZAZAQIBKgsBGAEtLAMBAlojGAmDAgGCdAMRBsI4gXkzgQGDKAE/AgJAAVDbMQELFAEFgTOFP4giXRgBhHwnGxuBcoEVg2mBBYFcAgGBUIZUBIIigQyBWpINSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BJ4M/Ixk2eoEJXoErKWABEheBCYIIAoJUggMCAUlDDgdHUwknQQQLGA1IESw3FRkEPm4Hjl8fglABLDQtASkBAYIDOgeTIEKRfKEPCiiDdowilToaM6ptmQiOCpZQhGmBaDyBWXAVgyIJFjQZD445g2uGQMV5JzICCTIBAQcCBw4DC4FokAKBfAEB IronPort-Data: A9a23:BvmW46AL0PJV5hVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApGhzgTNUz DZOCmiFOfyNMGqnf491OoTl9h5VsJDSzoM3OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGdIZvCCeA+n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXmthh fuo+5eBYA79gGYoWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE3MxRNF0EFLckxf8rJjBe/ vA4bz8TYUXW7w626OrTpuhEj8AnKozveYgYoHwllWGfBvc9SpeFSKLPjTNa9G5v3YYVQ7CHO YxANWcHgBfoO3WjPn8bBYw3mvyonlH0ciZTrxSeoq9fD237nFYgi+GwaouIEjCMbfdYxliHi 074xjX0CCpCbPGDkBbf8Vv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWstxoYXZ9UVuY98gzIkvqS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH69V5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:y9wSDa/zcmz0PAP7bcNuk+D0I+orL9Y04lQ7vn2ZhyY7TiX+rb HKoB11737JYVoqNU3I+urwWpVoP0m9yXcd2+B4Vt2ftWLd1ldAQrsP0WLK+UyFJ8SHzJ8/6Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:GfBOAmPWVIfHfu5DRxBYzFImM/oZTWSB6ybAKEOYTml3R+jA X-Talos-MUID: 9a23:BTcZwglb4LCzs1dtFvjKdnpQOZ92/ImCNnlcnJ8945GpKXVcYTS02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,260,1779148800"; d="scan'208";a="829315295" Received: from alln-l-core-08.cisco.com ([173.36.16.145]) by alln-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Sep 2026 09:00:08 +0000 Received: from sjc-ads-5197.cisco.com (sjc-ads-5197.cisco.com [10.28.35.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-08.cisco.com (Postfix) with ESMTPS id 5CB4118000778; Fri, 4 Sep 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5197.cisco.com (Postfix, from userid 1887503) id E3BC2CC12A6; Fri, 4 Sep 2026 02:00:07 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Date: Fri, 4 Sep 2026 02:00:02 -0700 Message-Id: <20260904090007.27374-1-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-5197.cisco.com [10.28.35.211];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.28.35.211, sjc-ads-5197.cisco.com X-Outbound-Node: alln-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 04 Sep 2026 09:00:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245075 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 [2] https://curl.se/docs/CVE-2026-8286.html Signed-off-by: Devansh Patel --- .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch new file mode 100644 index 0000000000..ec2f6165c3 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch @@ -0,0 +1,60 @@ +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 7 May 2026 10:30:07 +0200 +Subject: [PATCH] url: fix connection reuse for starttls protocols + +When a connection is tested for reuse in a transfer that *may* upgrade +to TLS (commonly via STARTTLS), the SSL configuration must match the +existing connection. + +Reported-by: Andrew Nesbit +Closes #21522 + +CVE: CVE-2026-8286 +Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16] + +Backport Changes: +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream may-TLS + and require-TLS distinction in ConnectionExists() and preserve the upstream + TLS configuration matching behavior. + +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16) +Signed-off-by: Devansh Patel +--- + lib/url.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +index dfcd6f4841..9e1ca0336c 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data, + /* plain HTTP with upgrade */ + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) && + (needle->handler->protocol & CURLPROTO_HTTP); +- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; ++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; ++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE; + + *usethis = NULL; + *force_reuse = FALSE; +@@ -1054,7 +1055,7 @@ ConnectionExists(struct Curl_easy *data, + continue; + + if(!(needle->handler->flags & PROTOPT_SSL) && +- req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET)) ++ require_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET)) + continue; + + if(needle->bits.conn_to_host != check->bits.conn_to_host) +@@ -1202,8 +1203,8 @@ ConnectionExists(struct Curl_easy *data, + needle->remote_port != check->remote_port) + continue; + +- /* If talking TLS, check needs to use the same SSL options. */ +- if((needle->handler->flags & PROTOPT_SSL) && ++ /* If talking/upgrading to TLS, check needs the same SSL options. */ ++ if(((needle->handler->flags & PROTOPT_SSL) || may_tls) && + !Curl_ssl_conn_config_match(data, check, FALSE)) { + DEBUGF(infof(data, + "Connection #%" CURL_FORMAT_CURL_OFF_T diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 365f02ad59..c006649a1b 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -41,6 +41,7 @@ SRC_URI = " \ file://CVE-2026-5545.patch \ file://CVE-2026-6253.patch \ file://CVE-2026-4873.patch \ + file://CVE-2026-8286.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Sep 4 09:00:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 97263 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 590A1C79F83 for ; Fri, 4 Sep 2026 09:00:16 +0000 (UTC) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9551.1788512409467513020 for ; Fri, 04 Sep 2026 02:00:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=A/kqCkhp; spf=pass (domain: cisco.com, ip: 173.37.142.93, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4977; q=dns/txt; s=iport01; t=1788512410; x=1789722010; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=0fuEG2w3xG6rGt3jy1sHUwy3WDcxgvtD3Noe7QAO1o0=; b=A/kqCkhp5hu918nDo/cTTGJYCkuqJqhggWBNs8opm5hCzo1dntDiWcAK GBo+jKn0khGtnHXbmzxV7ryQwR5JViD3F/oQVl+1NoqEEQf9OATwWI4UM oKbK45YLXBr+4w9xShjueITXYiz6Fq1bPKaAlmMIltbatWZGx6GO7Vm+X nX+rZSDcgqx9wRb8Y8IGbQm5A/VY67f4DKbIUxX00X43OKIwiVFaYukYJ 2qrSw4y47WlyWGIeQRuVhifJG80/AtHghNK7bCXarPjf+1/el8RN5yjfg +LJqs3rRAsAsw7VMynq7jFbFig+91DPQ7oa+DKmD6yP88BurX8UEx2DDH w==; X-CSE-ConnectionGUID: dFUzJcNYSkObsKr97IE08w== X-CSE-MsgGUID: ydr77p8hS5S6nSFzYGPxbg== X-IPAS-Result: A0C2AABwh5pq/48QJK1aHQEBAQEJARIBBQUBgX8FAQsBglZ0YENJlkoDoBkPAQEBD0QNBAEBhQUCjgICJjcGDgECBAMCAwEBAQEBAQEBAQEBCwEBBQEBAQIBBwWBDhOGTw2QGQECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEQbCOIF5M4EBgygBPwICQAFQ2zEBCxQBBYEzAYU+iCJdGAGEfCcbG4FyhAh2gQWBXAIBgUeGXQSCIoEMgVqBDpB/SIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BJ4M/Ixk2eoEJXoErKWABEheBCYIIAoJUggMCAUlDDgdHUwknQQQLGA1IESw3FRkEPm4Hjl8fglABYC0BKQEBggIDAzULFgijG4IhoQ8KKIN2jCKVOhozhVulEpkIjgqWUIRpgX4mgVlwFTuCZwkWNBkPjjmCA4FohkDFeScyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:YuGETKgz/B7f+VnTve+BuEXaX161NhEKZh0ujC45NGQN5FlHY01je htvWDuEPPvZZTf3e98gPtvjoBwC75+Byt5hTQZp+X1kEyNjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FH1dOOn9SUgvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeCULOZ82QsaDxMuvrY8E8HUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUU1NtlI2pox McbDzoWTQrS2MObmOKkH7wEasQLdKEHPasWvnVmiDWcBvE8TNWbHePB5MRT23E7gcUm8fT2P pVCL2ExKk2eJUQTYT/7C7pm9AusrnXybTRes1KNjaE2+GPUigd21dABNfKFII3RHJgPzxnwS mTu7mjjXU4CZNyklAHb9EmClN7gpTPxV9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUz7AWLj66R6AGDCy1cEHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Ixd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:J9uszK6LNgWV/sOWSQPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:tOiV92MWMlJHMu5DVAda5mwfPPEecVrX11TKchCZJD45V+jA X-Talos-MUID: 9a23:+AA85Qgp4ALmg9ywlMWICMMpJctyvPu2WEA2zK5YvfKqJx1fAyeXg2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,260,1779148800"; d="scan'208";a="829315297" Received: from alln-l-core-06.cisco.com ([173.36.16.143]) by alln-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Sep 2026 09:00:08 +0000 Received: from sjc-ads-5197.cisco.com (sjc-ads-5197.cisco.com [10.28.35.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-06.cisco.com (Postfix) with ESMTPS id 6349718000133; Fri, 4 Sep 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5197.cisco.com (Postfix, from userid 1887503) id E7AF8CC12A7; Fri, 4 Sep 2026 02:00:07 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Date: Fri, 4 Sep 2026 02:00:03 -0700 Message-Id: <20260904090007.27374-2-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260904090007.27374-1-devanshp@cisco.com> References: <20260904090007.27374-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-5197.cisco.com [10.28.35.211];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.28.35.211, sjc-ads-5197.cisco.com X-Outbound-Node: alln-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 04 Sep 2026 09:00:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245079 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Backporting it also protects downstream configurations that enable libpsl. [1] https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8 [2] https://curl.se/docs/CVE-2026-8924.html Signed-off-by: Devansh Patel --- .../curl/curl/CVE-2026-8924.patch | 127 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 128 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8924.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8924.patch b/meta/recipes-support/curl/curl/CVE-2026-8924.patch new file mode 100644 index 0000000000..9f3ac9ae39 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8924.patch @@ -0,0 +1,127 @@ +From b9eaedeb9d5440eae886c0b33f4ee48859d7123d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Sat, 16 May 2026 00:19:09 +0200 +Subject: [PATCH] cookie: trim trailing dots when checking PSL + +Verified with test 1629 + +Closes #21636 + +CVE: CVE-2026-8924 +Upstream-Status: Backport [https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8] + +Backport Changes: +- curl 8.7.1 performs the PSL check inline in Curl_cookie_add(). Apply the + upstream trailing-dot length normalization at that equivalent code path. +- Register test1629 in the target-generated Makefile.inc instead of the newer + Makefile.am list. + +(cherry picked from commit 51beed175dbfc37da3113f6acce60c630c070ce8) +Signed-off-by: Devansh Patel +--- + lib/cookie.c | 13 ++++++++-- + tests/data/Makefile.inc | 2 +- + tests/data/test1629 | 53 +++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 65 insertions(+), 3 deletions(-) + create mode 100644 tests/data/test1629 + +diff --git a/lib/cookie.c b/lib/cookie.c +index 67494d2855..11081e0ba0 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -1032,12 +1032,21 @@ Curl_cookie_add(struct Curl_easy *data, + char lcookie[256]; + size_t dlen = strlen(domain); + size_t clen = strlen(co->domain); ++ ++ /* trim trailing dots */ ++ if(dlen && (domain[dlen - 1] == '.')) ++ dlen--; ++ if(clen && (co->domain[clen - 1] == '.')) ++ clen--; ++ + if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { + const psl_ctx_t *psl = Curl_psl_use(data); + if(psl) { + /* the PSL check requires lowercase domain name and pattern */ +- Curl_strntolower(lcase, domain, dlen + 1); +- Curl_strntolower(lcookie, co->domain, clen + 1); ++ Curl_strntolower(lcase, domain, dlen); ++ lcase[dlen] = 0; ++ Curl_strntolower(lcookie, co->domain, clen); ++ lcookie[clen] = 0; + acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); + Curl_psl_release(data); + } +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 461eb37b92..9fd47df771 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -207,7 +207,7 @@ test1598 \ + test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \ + test1608 test1609 test1610 test1611 test1612 test1613 test1614 test1615 \ + \ +-test1620 test1621 \ ++test1620 test1621 test1629 \ + \ + test1630 test1631 test1632 test1633 test1634 test1635 \ + \ +diff --git a/tests/data/test1629 b/tests/data/test1629 +new file mode 100644 +index 0000000000..6ee479ba31 +--- /dev/null ++++ b/tests/data/test1629 +@@ -0,0 +1,53 @@ ++ ++ ++ ++ ++HTTP ++HTTP GET ++ ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 200 OK ++Content-Length: 6 ++Set-Cookie: something=1; Domain=co.uk.; Path=/ ++ ++-foo- ++ ++ ++ ++# Client-side ++ ++ ++PSL ++cookies ++ ++ ++http ++ ++ ++cookies with trailing dot after PSL domain ++ ++ ++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET / HTTP/1.1 ++Host: foo.co.uk.:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++GET / HTTP/1.1 ++Host: bar.co.uk.:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++ diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index c006649a1b..6516c95030 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -42,6 +42,7 @@ SRC_URI = " \ file://CVE-2026-6253.patch \ file://CVE-2026-4873.patch \ file://CVE-2026-8286.patch \ + file://CVE-2026-8924.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Sep 4 09:00:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 97268 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84107C79F85 for ; Fri, 4 Sep 2026 09:00:16 +0000 (UTC) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9554.1788512410066615658 for ; Fri, 04 Sep 2026 02:00:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=DQGzhNlQ; spf=pass (domain: cisco.com, ip: 173.37.142.91, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=14692; q=dns/txt; s=iport01; t=1788512410; x=1789722010; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=tx0cPMAeUiKznjjT4tcnDJ8UutzrQTjLLLgIJGhYJB4=; b=DQGzhNlQAgLWxqkg3KDHDInGJ9eOQcQDbp/ABLTE5rJqjNqijGl25D4J RUILTNWQPpXD3V3WMz+BCJo7ItzUX6GmVyCCUnVts8fzsZrGLfP9o+8h2 vlPDgAhvJHBljhEWaGZUEMnN8Rr66eYxJgkoNF7GKdpHa6rGKT12O2F5L H1FJj+oP7a5FseR0OjkuhrZF5+RtArO/6o8cin0F3Fy+g9BeFS/Weg+l0 Fqth1lFdniicP2stgPCuwAiGbCe9dFktRDGS7J5B+gsjjhoOyAfLOEcIZ WZqpHbiwgMs80MMZKlU+Q+ir5sL/0Sdlox5xRIzT+FKDya9h2whHhsKWM w==; X-CSE-ConnectionGUID: eprmqjjaRQS4s65gS2k0mw== X-CSE-MsgGUID: jnj59r0ySt+YdiAiBb0m6A== X-IPAS-Result: A0AaAABwh5pq/4wQJK1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ0YENJjHKJWAOBE50IFIFqDwEBAQ9EDQQBAYFxASCCcwKOAgImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDZAZAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBsI4gXkzgQGDKAE/AgJAAVDbMQELFAEFgTMBhT6IIl0YAYNdgR8nGxuBcoEVgnN2gQWBXAIBAYEhAwEhhl0Egg0VgQyBWh5wgSWDRIwWSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BJ4M/Ixk2eoEJXoErKWABEheBCYIIAoJUggMCAUlDDgdHUwknQQQLGA1IESw3FRkEPm4Hjl8fghg3ATEpBgEhAgoBExYBAQQrcTooAjcCDBUIkmgMJJADgiGBNZ9aCiiDdowilToaM4QEgVeSQJJSmQiOCpU0NBtNhGmBaDyBWXAVO4JnCQkNNBkPji4LC4NghUF/xXknMgIJMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:6CuyS68ZjCYVA+9urmN9DrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3y 2sYUW3QM6neamOkLtx+PIS+/E9T65LQnddjGVdppCBEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmE4EzrauS9xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mvyyHjEAX9gWAsYzpPs/7rRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k7JZcd4+R1CFt3z qADdm0CVUqA3+eplefTpulE3qzPLeHiOIcZ/3UlxjbDALN+GtbIQr7B4plT2zJYasJmRKmFI ZFHL2MxKk2cO3WjOX9PYH46tOulmHD5aD1AgFmUvqEwpWPUyWSd1ZC9a4KOIIXVHJQ9ckCwp GTEojXjWgAhKJ+uxTus81im3uqRtHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJZF+k8rQXIwa3O7kPBXS4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rBnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:U2Vjl6FndtqGd/wQpLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:Z5S822yG8WkA0r5ONsJKBgUZAtoga3/fxU3pGBOjVztmc+eWEVqPrfY= X-Talos-MUID: 9a23:lQuYWAzpLIW7qnFp4XLP6Viu5pCaqKaoCh1ci80XgNXHBCBxEja3hmyyHKZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,260,1779148800"; d="scan'208";a="830321719" Received: from alln-l-core-03.cisco.com ([173.36.16.140]) by alln-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Sep 2026 09:00:09 +0000 Received: from sjc-ads-5197.cisco.com (sjc-ads-5197.cisco.com [10.28.35.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-03.cisco.com (Postfix) with ESMTPS id 6613918001262; Fri, 4 Sep 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5197.cisco.com (Postfix, from userid 1887503) id EF579CC12A8; Fri, 4 Sep 2026 02:00:07 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927 Date: Fri, 4 Sep 2026 02:00:04 -0700 Message-Id: <20260904090007.27374-3-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260904090007.27374-1-devanshp@cisco.com> References: <20260904090007.27374-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-5197.cisco.com [10.28.35.211];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.28.35.211, sjc-ads-5197.cisco.com X-Outbound-Node: alln-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 04 Sep 2026 09:00:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245078 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. The test-only prerequisite uses [3] to provide positive digest-auth feature detection on curl 8.7.1. [1] https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567 [2] https://curl.se/docs/CVE-2026-8927.html [3] https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385 Signed-off-by: Devansh Patel --- .../curl/curl/CVE-2026-8927-dependent.patch | 41 ++ .../curl/curl/CVE-2026-8927.patch | 375 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 2 + 3 files changed, 418 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch new file mode 100644 index 0000000000..35ff6a9413 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch @@ -0,0 +1,41 @@ +From 9c85f980c3350b59736e4844da34e7f4b726e9c5 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Fri, 25 Apr 2025 08:16:13 +0200 +Subject: [PATCH] tests/buildinfo: former "disabled" now provides more info + +This tool now contains ON/OFF information about features in the build. +This way, runtests gets both positive and negative feature presence with +this. Allows for more flexibility and avoids having to duplicate the +names. + +Closes #17180 + +CVE: CVE-2026-8927 +Upstream-Status: Backport [https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385] + +Backport Changes: +- curl 8.7.1 uses the older disabled helper rather than buildinfo. Initialize + digest-auth positively in runtests.pl and retain the existing disabled-list + pass to clear it when CURL_DISABLE_DIGEST_AUTH is configured. +- Scope the backport to the digest-auth detection needed by tests 1647 and + 1686; omit the buildinfo rename and unrelated feature-reporting changes. + +(cherry picked from commit 1968b32afd8e41fbb87f8911d15c552c6b705385) +Signed-off-by: Devansh Patel +--- + tests/runtests.pl | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/runtests.pl b/tests/runtests.pl +index ddfab20e86..b40df554b2 100755 +--- a/tests/runtests.pl ++++ b/tests/runtests.pl +@@ -637,6 +637,8 @@ sub checksystemfeatures { + $feature{"Kerberos"} = $feat =~ /Kerberos/i; + # SPNEGO enabled + $feature{"SPNEGO"} = $feat =~ /SPNEGO/i; ++ # Digest auth enabled unless disabled by build ++ $feature{"digest-auth"} = 1; + # CharConv enabled + $feature{"CharConv"} = $feat =~ /CharConv/i; + # TLS-SRP enabled diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927.patch b/meta/recipes-support/curl/curl/CVE-2026-8927.patch new file mode 100644 index 0000000000..d2bb76e91e --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8927.patch @@ -0,0 +1,375 @@ +From 66ff71c5c22eed2dfb9c5dbd925e83e37e0d732d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 18 May 2026 23:47:11 +0200 +Subject: [PATCH] url: detect proxy changes read from environment + +When a proxy is set from an environment variable, detect if that proxy +is not the same as previously and flush state. + +Verified by test1647: verify changing proxy with env variables and make +sure Digest state is flushed in the second use + +Closes #21666 + +CVE: CVE-2026-8927 +Upstream-Status: Backport [https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567] + +Backport Changes: +- curl 8.7.1 predates the curlx allocation aliases, so the new envproxy state + uses the equivalent free() and strdup() calls. +- curl 8.7.1 frees the parsed proxy string earlier. Keep it alive until the + shared cleanup path so the new Digest-state comparison can use it safely. +- Include vauth/vauth.h explicitly because the target's existing url.c + includes do not declare Curl_auth_digest_cleanup(). +- Register test1647 and lib1647 in the target-version Makefile.inc lists, + independently of lib1588 from CVE-2026-7168, and adapt the newer libtest + entry point to the 8.7.1 test harness. +- Use the target harness feature names digest-auth and lowercase debug. The + preceding test-only dependency backports positive digest-auth detection + from curl commit 1968b32afd8e while retaining disabled-build detection. + +(cherry picked from commit 5c225384b8d52c67ce8259c6e4203bc57aacb567) +Signed-off-by: Devansh Patel +--- + lib/url.c | 13 +++- + lib/urldata.h | 1 + + tests/data/Makefile.inc | 2 + + tests/data/test1647 | 103 ++++++++++++++++++++++++++++++ + tests/libtest/Makefile.inc | 5 ++ + tests/libtest/lib1647.c | 124 +++++++++++++++++++++++++++++++++++++ + 6 files changed, 247 insertions(+), 1 deletion(-) + create mode 100644 tests/data/test1647 + create mode 100644 tests/libtest/lib1647.c + +diff --git a/lib/url.c b/lib/url.c +index 9e1ca0336c..fe7639713a 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -79,6 +79,7 @@ + #include "share.h" + #include "content_encoding.h" + #include "http_digest.h" ++#include "vauth/vauth.h" + #include "http_negotiate.h" + #include "select.h" + #include "multiif.h" +@@ -331,6 +332,9 @@ CURLcode Curl_close(struct Curl_easy **datap) + Curl_wildcard_dtor(&data->wildcard); + Curl_freeset(data); + Curl_headers_cleanup(data); ++#ifndef CURL_DISABLE_DIGEST_AUTH ++ free(data->state.envproxy); ++#endif + free(data); + return CURLE_OK; + } +@@ -2535,7 +2539,6 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data, + curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype; + if(proxy) { + result = parse_proxy(data, conn, proxy, ptype); +- Curl_safefree(proxy); /* parse_proxy copies the proxy string */ + if(result) + goto out; + } +@@ -2554,6 +2557,14 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data, + result = CURLE_UNSUPPORTED_PROTOCOL; + goto out; + #else ++#ifndef CURL_DISABLE_DIGEST_AUTH ++ if(!Curl_safecmp(data->state.envproxy, proxy)) { ++ /* proxy changed */ ++ Curl_auth_digest_cleanup(&data->state.proxydigest); ++ free(data->state.envproxy); ++ data->state.envproxy = strdup(proxy); ++ } ++#endif + /* force this connection's protocol to become HTTP if compatible */ + if(!(conn->handler->protocol & PROTO_FAMILY_HTTP)) { + if((conn->handler->flags & PROTOPT_PROXY_AS_HTTP) && +diff --git a/lib/urldata.h b/lib/urldata.h +index 4fc595a639..d2d9424197 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1247,6 +1247,7 @@ struct UrlState { + void (*prev_signal)(int sig); + #endif + #ifndef CURL_DISABLE_DIGEST_AUTH ++ char *envproxy; /* last proxy string used for proxy-related state */ + struct digestdata digest; /* state data for host Digest auth */ + struct digestdata proxydigest; /* state data for proxy Digest auth */ + #endif +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 3ec7fa4e21..7452061ea9 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -210,6 +210,8 @@ test1620 test1621 test1629 \ + \ + test1630 test1631 test1632 test1633 test1634 test1635 \ + \ ++test1647 \ ++\ + test1650 test1651 test1652 test1653 test1654 test1655 test1656 \ + test1660 test1661 test1662 \ + \ +diff --git a/tests/data/test1647 b/tests/data/test1647 +new file mode 100644 +index 0000000000..ecd1cf01c7 +--- /dev/null ++++ b/tests/data/test1647 +@@ -0,0 +1,103 @@ ++ ++ ++ ++ ++HTTP ++HTTP GET ++HTTP proxy ++HTTP proxy Digest auth ++multi ++ ++ ++ ++# Server-side ++ ++ ++# this is returned first since we get no proxy-auth ++ ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++And you should ignore this data. ++ ++ ++# then this is returned when we get proxy-auth ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++ ++ ++ ++HTTP/1.1 401 OK ++Content-Length: 21 ++Server: no ++ ++Denied access. Leave ++ ++ ++ ++ ++# Client-side ++ ++ ++http ++https-proxy ++https ++ ++# tool is what to use instead of 'curl' ++ ++lib%TESTNUMBER ++ ++ ++!SSPI ++crypto ++proxy ++digest-auth ++debug ++ ++ ++http_proxy=%HOSTIP:%HTTPPORT ++https_proxy=https://%HOSTIP:%HTTPSPROXYPORT ++CURL_ENTROPY=99376 ++ ++ ++HTTP proxy auth Digest, then change proxy with env var and do it again ++ ++ ++http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456 ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 ++Host: test.remote.example.com ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 ++Host: test.remote.example.com ++Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096" ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++ ++ ++ ++CONNECT another.example.com:%HTTPSPORT HTTP/1.1 ++Host: another.example.com:%HTTPSPORT ++Proxy-Connection: Keep-Alive ++ ++ ++ ++# CONNECT fails ++ ++7 ++ ++ ++ +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 9d3356aaf5..639d010a00 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -64,6 +64,8 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \ + lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \ + lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ + \ ++ lib1647 \ ++ \ + lib1662 \ + \ + lib1900 \ +@@ -540,6 +542,9 @@ lib1597_LDADD = $(TESTUTIL_LIBS) + lib1598_SOURCES = lib1598.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1598_LDADD = $(TESTUTIL_LIBS) + ++lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1647_LDADD = $(TESTUTIL_LIBS) ++ + lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1662_LDADD = $(TESTUTIL_LIBS) + +diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c +new file mode 100644 +index 0000000000..2cf4c30da9 +--- /dev/null ++++ b/tests/libtest/lib1647.c +@@ -0,0 +1,124 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, , et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++/* ++ * argv1 = the first URL ++ * argv2 = URL2 ++ * argv3 = credentials 1 ++ * argv4 = credentials 2 ++ */ ++ ++#include "test.h" ++#include "testutil.h" ++ ++/* this is meant to pick up the proxy from the environment variable */ ++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd) ++{ ++ int res = CURLE_OK; ++ ++ res_easy_setopt(curl, CURLOPT_URL, url); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ++ if(res) ++ goto init_failed; ++ ++ return CURLE_OK; /* success */ ++ ++init_failed: ++ return (CURLcode)res; /* failure */ ++} ++ ++static CURLcode run1647(CURL *curl, const char *url, const char *userpwd) ++{ ++ CURLcode res = CURLE_OK; ++ ++ res = init1647(curl, url, userpwd); ++ if(res) ++ return res; ++ ++ return curl_easy_perform(curl); ++} ++ ++int test(char *URL) ++{ ++ int res = CURLE_OK; ++ CURL *curl = NULL; ++ ++ if(test_argc < 5) ++ return TEST_ERR_MAJOR_BAD; ++ ++ res_global_init(CURL_GLOBAL_ALL); ++ if(res) ++ return res; ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ start_test_timing(); ++ ++ curl_mprintf("--- First get '%s'\n", URL); ++ res = run1647(curl, URL, libtest_arg3); ++ if(res) ++ goto test_cleanup; ++ ++ curl_mprintf("--- Then get '%s'\n", libtest_arg2); ++ res = run1647(curl, libtest_arg2, test_argv[4]); ++ ++test_cleanup: ++ ++ /* proper cleanup sequence - type PB */ ++ ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ return res; ++} diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 6516c95030..f22e69fba4 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -43,6 +43,8 @@ SRC_URI = " \ file://CVE-2026-4873.patch \ file://CVE-2026-8286.patch \ file://CVE-2026-8924.patch \ + file://CVE-2026-8927-dependent.patch \ + file://CVE-2026-8927.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Sep 4 09:00:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 97264 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57F13C624DE for ; Fri, 4 Sep 2026 09:00:16 +0000 (UTC) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9552.1788512409683483933 for ; Fri, 04 Sep 2026 02:00:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=TdBWxUEy; spf=pass (domain: cisco.com, ip: 173.37.142.95, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=14163; q=dns/txt; s=iport01; t=1788512409; x=1789722009; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Gfm+LgX2azY5DeXmqSn+19+iX2DVIssul+DxXoCMvd8=; b=TdBWxUEyY2f2g/QFu90fQ+zWHZ8M1+mk0G7bKqQ7kO+f8NA/hDHlPzWO udq8QUw9Kdi5CFfC0khTCk4z53xLwYumcyry6gr47uhcmBZtzA9boHOVK 1q0F1eZLiTPKz0UEhfuAPtJNFt/4Q0aWeByC/ENqYI4GhY0P6AR9P3nI2 aSOdmdxAbbGL0TQ3U6Xda9QSiJyrQGfpnkM3aiXkixV2IQTvPxra2dn2H Bq3aAvOMgrdF6pbjoOB8rEkTV0YH+gIMvbvuYZC0GiFzTufpnsF0vFwKp yY+W8PN3EpiPY7JakmJyvRPUvuHZYq8MZQXSRR4TJ7HCIS/caOgqkmrqn A==; X-CSE-ConnectionGUID: nkAnx5erSXCb5RL/whITRQ== X-CSE-MsgGUID: xvz9eyqTQDeKKj8On6z+KQ== X-IPAS-Result: A0BLAgDxh5pq/48QJK1RCYJZgld0YENJlkoDgROdCBSBag8BAQEPRA0EAQGBcQEggnMCjgICJjQJDgECBAMCAwEBAQEBAQEBAQEBCwEBBQEBAQIBBwWBDhOGTw2QGQECAQMnCwEYAS0QHAMBAhkWKyMIGYMCAYJ0AxEGwjiBeTOBAYMoAT8CAkABUNsxAQsUAQWBM4U/iCJdGAGEfCcbG4FygRWCc3aBBYFcAgGBIhEUaIV1BIINFYEMgVoecIElg0SGa4UrSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BJ4M/Ixk2eoEJXoErKWABEheBCYIIAoJUggMCAUlDDgdHUwknQQQLGA1IESw3FRkEPm4Hjl8fgkkFAhYbLwEhDAETFgIvUBmBIgECDAEUCJJ0B5AggiGBNZ9aCiiDdowilToaM6ptmQiOCpU0gRyEaYFoPIFZcBU7gmcJFjQZD44uCwuDYIZAxVghJzICCTIBAQcCBw4DC4FokCaBWAEB IronPort-Data: A9a23:3kzPoqAkkHysFBVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApD4k32AHy 2QYC2DXbP/bMzamLoslOojn90oG6MeAzYRhOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGdIZvCCeA+n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXmthh fuo+5eBYA79gGYoWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TExfZHClFrMJcjys19XFtqs uMYCQw3V0XW7w626OrTpuhEj8AnKozveYgYoHwllW+fBvc9SpeFSKLPjTNa9G5v3YYVQ7CHO YxANWEHgBfoO3WjPn8bBYw3mvyonlH0ciZTrxSeoq9fD237nFcoi+G2bIGIEjCMbdVLjBeVt 3v6xkj0ITIYZPuZlyjG0Uv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWstxoYXZ9UVuY98gzIkvSS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH69V5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:Iqcka6pm6w3KBZ4FQH2yfZ4aV5rzeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5Q43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0FWMqyXMbEDt7eY3CCIV/A93dKA7Kekwc3az3trUEVWTpsI1XYBNu5eeXcGPzWvwvECZe Kh2vY= X-Talos-CUID: 9a23:Sl/eV2xkTz6yzKX0do7tBgUSGekjYiDQ1kzgCEXlM0IuV720dWWprfY= X-Talos-MUID: 9a23:4b7sTgbG+VQrSeBTpyH+1TxzLftRz6mNK0JdtpNYqYqnDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,260,1779148800"; d="scan'208";a="831313435" Received: from alln-l-core-06.cisco.com ([173.36.16.143]) by alln-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Sep 2026 09:00:08 +0000 Received: from sjc-ads-5197.cisco.com (sjc-ads-5197.cisco.com [10.28.35.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-06.cisco.com (Postfix) with ESMTPS id 63D0E18000254; Fri, 4 Sep 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5197.cisco.com (Postfix, from userid 1887503) id 023DCCC12A9; Fri, 4 Sep 2026 02:00:08 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932 Date: Fri, 4 Sep 2026 02:00:05 -0700 Message-Id: <20260904090007.27374-4-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260904090007.27374-1-devanshp@cisco.com> References: <20260904090007.27374-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-5197.cisco.com [10.28.35.211];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.28.35.211, sjc-ads-5197.cisco.com X-Outbound-Node: alln-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 04 Sep 2026 09:00:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245076 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e [2] https://curl.se/docs/CVE-2026-8932.html Signed-off-by: Devansh Patel --- .../curl/curl/CVE-2026-8932.patch | 342 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 343 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8932.patch b/meta/recipes-support/curl/curl/CVE-2026-8932.patch new file mode 100644 index 0000000000..c845826cb3 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8932.patch @@ -0,0 +1,342 @@ +From fc625fa247f68bc6a44bda391cd8c09bfc5ce5d5 Mon Sep 17 00:00:00 2001 +From: Joshua Rogers +Date: Tue, 19 May 2026 11:47:50 +0200 +Subject: [PATCH] tls: fix incomplete mTLS config in conn reuse and session + cache + +cert_type, key, key_type, key_passwd and key_blob lived in +ssl_config_data but not in ssl_primary_config, so they were invisible to +match_ssl_primary_config() and to the TLS session cache peer key. + +Two easy handles sharing a connection pool could reuse each other's +authenticated connections when they differed only on SSLKEY, SSLKEYTYPE, +KEYPASSWD, SSLCERTTYPE or SSLKEYBLOB. The second handle would silently +inherit the first handle's authenticated identity. + +Promote all five fields into ssl_primary_config so the conn-reuse +predicate and session cache key cover the complete client credential +set. Also replace the fixed ":CCERT" session cache marker with the +actual clientcert path so sessions are not shared across different +client certificates. + +Verified by test 3303 and 3304 + +Reported-By: Joshua Rogers (AISLE Research) +Closes #21667 + +CVE: CVE-2026-8932 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e] + +Backport Changes: +- curl 8.7.1 keeps the session cache in vtls.c and stores backend key properties + outside ssl_primary_config. Duplicate those pointers into the primary + configuration so the upstream match, clone, and free behavior covers + connection and session reuse without moving every backend access. +- Omitted backend-only field-access moves in ldap.c, vssh/, and vtls backends + because the target keeps the original ssl_config_data members as aliases. +- Adapt unit3303 to the target curlcheck and test-data harnesses and allocation + helpers, and extend it with unit3304's case-insensitive cert_type/key_type + checks. +- Omit newer vtls_scache.c/vtls_scache.h and unit3304 because their peer-key + API does not exist in 8.7.1. The target session cache instead uses the clone + and match functions in vtls.c, which the adapted unit3303 exercises. + +(cherry picked from commit 7541ae569d82fb308a5e2d94916027da4fa3ba3e) +Signed-off-by: Devansh Patel +--- + lib/urldata.h | 5 ++ + lib/vtls/vtls.c | 25 ++++++++ + tests/data/Makefile.inc | 3 +- + tests/data/test3303 | 23 ++++++++ + tests/unit/Makefile.inc | 4 +- + tests/unit/unit3303.c | 127 ++++++++++++++++++++++++++++++++++++++++ + 6 files changed, 185 insertions(+), 2 deletions(-) + create mode 100644 tests/data/test3303 + create mode 100644 tests/unit/unit3303.c + +diff --git a/lib/urldata.h b/lib/urldata.h +index d2d9424197..9015515e17 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -286,6 +286,11 @@ struct ssl_primary_config { + char *CAfile; /* certificate to verify peer against */ + char *issuercert; /* optional issuer certificate filename */ + char *clientcert; ++ char *cert_type; /* format for certificate (default: PEM) */ ++ char *key; /* private key file name */ ++ struct curl_blob *key_blob; ++ char *key_type; /* format for private key (default: PEM) */ ++ char *key_passwd; /* plain text private key password */ + char *cipher_list; /* list of ciphers to use */ + char *cipher_list13; /* list of TLS 1.3 cipher suites to use */ + char *pinned_key; +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index d13a3cb1b7..c89e8abcc6 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -187,10 +187,15 @@ match_ssl_primary_config(struct Curl_easy *data, + blobcmp(c1->cert_blob, c2->cert_blob) && + blobcmp(c1->ca_info_blob, c2->ca_info_blob) && + blobcmp(c1->issuercert_blob, c2->issuercert_blob) && ++ blobcmp(c1->key_blob, c2->key_blob) && + Curl_safecmp(c1->CApath, c2->CApath) && + Curl_safecmp(c1->CAfile, c2->CAfile) && + Curl_safecmp(c1->issuercert, c2->issuercert) && + Curl_safecmp(c1->clientcert, c2->clientcert) && ++ curl_strequal(c1->cert_type, c2->cert_type) && ++ Curl_safecmp(c1->key, c2->key) && ++ curl_strequal(c1->key_type, c2->key_type) && ++ !Curl_timestrcmp(c1->key_passwd, c2->key_passwd) && + #ifdef USE_TLS_SRP + !Curl_timestrcmp(c1->username, c2->username) && + !Curl_timestrcmp(c1->password, c2->password) && +@@ -234,10 +239,15 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source, + CLONE_BLOB(cert_blob); + CLONE_BLOB(ca_info_blob); + CLONE_BLOB(issuercert_blob); ++ CLONE_BLOB(key_blob); + CLONE_STRING(CApath); + CLONE_STRING(CAfile); + CLONE_STRING(issuercert); + CLONE_STRING(clientcert); ++ CLONE_STRING(cert_type); ++ CLONE_STRING(key); ++ CLONE_STRING(key_type); ++ CLONE_STRING(key_passwd); + CLONE_STRING(cipher_list); + CLONE_STRING(cipher_list13); + CLONE_STRING(pinned_key); +@@ -257,12 +267,17 @@ static void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc) + Curl_safefree(sslc->CAfile); + Curl_safefree(sslc->issuercert); + Curl_safefree(sslc->clientcert); ++ Curl_safefree(sslc->cert_type); ++ Curl_safefree(sslc->key); ++ Curl_safefree(sslc->key_type); ++ Curl_safefree(sslc->key_passwd); + Curl_safefree(sslc->cipher_list); + Curl_safefree(sslc->cipher_list13); + Curl_safefree(sslc->pinned_key); + Curl_safefree(sslc->cert_blob); + Curl_safefree(sslc->ca_info_blob); + Curl_safefree(sslc->issuercert_blob); ++ Curl_safefree(sslc->key_blob); + Curl_safefree(sslc->curves); + Curl_safefree(sslc->CRLfile); + #ifdef USE_TLS_SRP +@@ -297,6 +312,11 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD]; + data->set.ssl.primary.clientcert = data->set.str[STRING_CERT]; + data->set.ssl.key_blob = data->set.blobs[BLOB_KEY]; ++ data->set.ssl.primary.cert_type = data->set.ssl.cert_type; ++ data->set.ssl.primary.key = data->set.ssl.key; ++ data->set.ssl.primary.key_type = data->set.ssl.key_type; ++ data->set.ssl.primary.key_passwd = data->set.ssl.key_passwd; ++ data->set.ssl.primary.key_blob = data->set.ssl.key_blob; + + #ifndef CURL_DISABLE_PROXY + data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY]; +@@ -322,6 +342,11 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY]; + data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY]; + data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY]; ++ data->set.proxy_ssl.primary.cert_type = data->set.proxy_ssl.cert_type; ++ data->set.proxy_ssl.primary.key = data->set.proxy_ssl.key; ++ data->set.proxy_ssl.primary.key_type = data->set.proxy_ssl.key_type; ++ data->set.proxy_ssl.primary.key_passwd = data->set.proxy_ssl.key_passwd; ++ data->set.proxy_ssl.primary.key_blob = data->set.proxy_ssl.key_blob; + #ifdef USE_TLS_SRP + data->set.proxy_ssl.primary.username = + data->set.str[STRING_TLSAUTH_USERNAME_PROXY]; +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index b68e6b4562..02189d8cc6 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -265,4 +265,5 @@ test3024 test3025 test3026 test3027 test3028 test3029 test3030 \ + \ + test3100 test3101 test3102 test3103 \ + test3200 \ +-test3201 test3202 ++test3201 test3202 \ ++test3303 +diff --git a/tests/data/test3303 b/tests/data/test3303 +new file mode 100644 +index 0000000000..9b52bcb817 +--- /dev/null ++++ b/tests/data/test3303 +@@ -0,0 +1,23 @@ ++ ++ ++ ++ ++unittest ++TLS ++mTLS ++ ++ ++ ++# Client-side ++ ++ ++none ++ ++ ++unittest ++ ++ ++conn-reuse match distinguishes mTLS key, cert_type, key_type and key_passwd fields ++ ++ ++ +diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc +index 1926b49b3a..afbe29d2b7 100644 +--- a/tests/unit/Makefile.inc ++++ b/tests/unit/Makefile.inc +@@ -39,7 +39,7 @@ UNITPROGS = unit1300 unit1302 unit1303 unit1304 unit1305 unit1307 \ + unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 unit1656 \ + unit1660 unit1661 \ + unit2600 unit2601 unit2602 unit2603 \ +- unit3200 ++ unit3200 unit3303 + + unit1300_SOURCES = unit1300.c $(UNITFILES) + +@@ -134,3 +134,5 @@ unit2602_SOURCES = unit2602.c $(UNITFILES) + unit2603_SOURCES = unit2603.c $(UNITFILES) + + unit3200_SOURCES = unit3200.c $(UNITFILES) ++ ++unit3303_SOURCES = unit3303.c $(UNITFILES) +diff --git a/tests/unit/unit3303.c b/tests/unit/unit3303.c +new file mode 100644 +index 0000000000..060a9361fc +--- /dev/null ++++ b/tests/unit/unit3303.c +@@ -0,0 +1,127 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, , et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++#include "curlcheck.h" ++#include "urldata.h" ++ ++#ifdef USE_SSL ++#include "vtls/vtls.h" ++#endif ++ ++static CURLcode unit_setup(void) ++{ ++ return curl_global_init(CURL_GLOBAL_ALL); ++} ++ ++static void unit_stop(void) ++{ ++ curl_global_cleanup(); ++} ++ ++UNITTEST_START ++#ifdef USE_SSL ++{ ++ CURL *curl; ++ struct connectdata *conn; ++ struct ssl_primary_config *primary; ++ char *saved; ++ static char alt_passwd[] = "wrong"; ++ static char alt_key[] = "other.key"; ++ static char alt_ktype[] = "DER"; ++ static char alt_ctype[] = "P12"; ++ static char lc_ctype[] = "pem"; ++ static char lc_ktype[] = "pem"; ++ ++ curl = curl_easy_init(); ++ abort_unless(curl, "curl_easy_init failed"); ++ ++ curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem"); ++ curl_easy_setopt(curl, CURLOPT_SSLKEY, "client.key"); ++ curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "secret"); ++ curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM"); ++ curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM"); ++ ++ abort_unless(!Curl_ssl_easy_config_complete((struct Curl_easy *)curl), ++ "Curl_ssl_easy_config_complete failed"); ++ ++ conn = calloc(1, sizeof(*conn)); ++ abort_unless(conn, "connection allocation failed"); ++ abort_unless(!Curl_ssl_conn_config_init((struct Curl_easy *)curl, conn), ++ "Curl_ssl_conn_config_init failed"); ++ ++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "identical mTLS config should match"); ++ ++ primary = &((struct Curl_easy *)curl)->set.ssl.primary; ++ ++ saved = primary->key_passwd; ++ primary->key_passwd = alt_passwd; ++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "different key_passwd must not reuse conn"); ++ primary->key_passwd = saved; ++ ++ saved = primary->key; ++ primary->key = alt_key; ++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "different key must not reuse conn"); ++ primary->key = saved; ++ ++ saved = primary->key_type; ++ primary->key_type = alt_ktype; ++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "different key_type must not reuse conn"); ++ primary->key_type = saved; ++ ++ saved = primary->cert_type; ++ primary->cert_type = alt_ctype; ++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "different cert_type must not reuse conn"); ++ primary->cert_type = saved; ++ ++ primary->cert_type = lc_ctype; ++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "cert_type comparison must be case-insensitive"); ++ primary->cert_type = saved; ++ ++ primary->key_type = lc_ktype; ++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "key_type comparison must be case-insensitive"); ++ primary->key_type = saved; ++ ++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, ++ FALSE), ++ "restored mTLS config should match"); ++ ++ Curl_ssl_conn_config_cleanup(conn); ++ free(conn); ++ curl_easy_cleanup(curl); ++} ++#endif /* USE_SSL */ ++UNITTEST_STOP diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index f22e69fba4..6a2c44365b 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -45,6 +45,7 @@ SRC_URI = " \ file://CVE-2026-8924.patch \ file://CVE-2026-8927-dependent.patch \ file://CVE-2026-8927.patch \ + file://CVE-2026-8932.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Sep 4 09:00:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 97265 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7669FC79F80 for ; Fri, 4 Sep 2026 09:00:16 +0000 (UTC) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9551.1788512409467513020 for ; Fri, 04 Sep 2026 02:00:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=AsWBitar; spf=pass (domain: cisco.com, ip: 173.37.142.93, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2549; q=dns/txt; s=iport01; t=1788512409; x=1789722009; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=WQ+zhD2gY3WpVH9AGJdkg9jpvMtHksufSlMBAkDW2UM=; b=AsWBitar8i7CJkE0QrW/nCA6spjKSPtFQ2/9vnq+7YSi/SKe8RZVMPo9 qP35M/6PWMwwVdIbQFsBAP5cmWCDEGFiL5KPgSHaodIfi6Gx/zQGKyCJ2 EuYX0kZXE6RKhBIxSa3YnGsjpmcBJM+KGOhpiolhLWAVpQSH003O3FB4I oLSyIvTLVOFCC9QGDBUO7m1uS8xvGUkPCmVQv/v4IqroAaPtE35b9qwYb obKjziqScCr8+sla1tjoAidZS9ZG3QrEMzpj3Nr39sf4z05ku0DtP+9FZ gGJUuDiF3c83OG8TOuzzIeQb5YXcNX053xMUlto9Tnb2uNBK2ui0Iiaft g==; X-CSE-ConnectionGUID: HaEvECuTTP+7QCPLeWyxZw== X-CSE-MsgGUID: CknB5uzOTGehlQ7zUWbWRQ== X-IPAS-Result: A0AnAABwh5pq/5IQJK1aHQEBAQEJARIBBQUBgXwIAQsBglZ0YENJjHKJWAOeG4F+DwEBAQ9EDQQBAYUFAo4CAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NkBkBAgEDMgEYAS0QHAMBAi8rIwgZgwIBgnQDEQbCOIIsgQGDKAE/AgJAAVDbMQELFAEFgTMBhT6IIl0YAYR8JxsbgXKEfoEFgVwCAYIshXgEgiKBDIFakg1IgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQcbBgWBHYEngz8jGTZ6gQlegSspYAESF4EJgggCglSCAwIBSUMOB0dTCSdBBAsYDUgRLDcVGQQ+bgeOXx+CSQdhLQEpAn+BPg2lWKEPCiiDdowilToaM6ptmQiOCpVzXYRpgWg8gVlwFYMiCRY0GQ+OOYNrhkDFeScyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:2JqAB6v/Z3VjuBzEQSYb8sHJxufnVABfMUV32f8akzHdYApBsoF/q tZmKTqFbP7ZZTP8et9/bNiy/UpU6pCGmN5hGgA/rXwyRioUgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrav666yEgiclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZTdJ5xYuajhKs/Pb80sz1BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw2u9aH0xl6 MAkEHNSVzu7o++J0aKJVbw57igjBJGD0II3s3Vky3TdSP0hW52GG/SM7t5D1zB2jcdLdRrcT 5NGMnw0MlKZPVsWZgl/5JEWxI9EglHzfiNRrkmVvYI84nPYy0p6172F3N/9KobbHpwIxR7Bz o7A10/6BDtHKc649RWI8naV2f3yoinEYrtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS4QWJzO/Qpg2eHGVBFm8HY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn288Vte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:AYenza22MHGAHxer1SEO2wqjBGokLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFebvN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn5E4sLxKDwMeOGAbqBJbK ah2g== X-Talos-CUID: 9a23:dxX7r27KxNClMQTQpNss1Ec5BO0Ob0Hh9DSPGmSALWtWWa2nVgrF X-Talos-MUID: 9a23:+9Oz8QrTK+Uc7CM/+fUezxphMu01/raJNG8AkZE/5Nu5CiZPAQ7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,260,1779148800"; d="scan'208";a="829315301" Received: from alln-l-core-09.cisco.com ([173.36.16.146]) by alln-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Sep 2026 09:00:08 +0000 Received: from sjc-ads-5197.cisco.com (sjc-ads-5197.cisco.com [10.28.35.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-09.cisco.com (Postfix) with ESMTPS id 69DB51800014B; Fri, 4 Sep 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5197.cisco.com (Postfix, from userid 1887503) id 09218CC124A; Fri, 4 Sep 2026 02:00:08 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547 Date: Fri, 4 Sep 2026 02:00:06 -0700 Message-Id: <20260904090007.27374-5-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260904090007.27374-1-devanshp@cisco.com> References: <20260904090007.27374-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-5197.cisco.com [10.28.35.211];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.28.35.211, sjc-ads-5197.cisco.com X-Outbound-Node: alln-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 04 Sep 2026 09:00:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245077 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Backporting it also protects downstream configurations that enable the libssh backend. [1] https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1 [2] https://curl.se/docs/CVE-2026-9547.html Signed-off-by: Devansh Patel --- .../curl/curl/CVE-2026-9547.patch | 33 +++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9547.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-9547.patch b/meta/recipes-support/curl/curl/CVE-2026-9547.patch new file mode 100644 index 0000000000..992ed21e4c --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-9547.patch @@ -0,0 +1,33 @@ +From 3f73b2318b9e6358e33519fa49dc3e022aa28c41 Mon Sep 17 00:00:00 2001 +From: Joshua Rogers +Date: Fri, 22 May 2026 09:48:15 +0200 +Subject: [PATCH] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH + +Host key type mismatch from libssh was incorrectly reported as missing, +causing key callbacks to accept instead of reject. + +Reported by: Joshua Rogers (Aisle Research) +Closes #21724 + +CVE: CVE-2026-9547 +Upstream-Status: Backport [https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1] + +(cherry picked from commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1) +Signed-off-by: Devansh Patel +--- + lib/vssh/libssh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c +index 39067a1db6..00dae896bb 100644 +--- a/lib/vssh/libssh.c ++++ b/lib/vssh/libssh.c +@@ -439,6 +439,8 @@ static int myssh_is_known(struct Curl_easy *data) + keymatch = CURLKHMATCH_OK; + break; + case SSH_KNOWN_HOSTS_OTHER: ++ keymatch = CURLKHMATCH_MISMATCH; ++ break; + case SSH_KNOWN_HOSTS_NOT_FOUND: + case SSH_KNOWN_HOSTS_UNKNOWN: + case SSH_KNOWN_HOSTS_ERROR: diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 6a2c44365b..e9ba10cb97 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -46,6 +46,7 @@ SRC_URI = " \ file://CVE-2026-8927-dependent.patch \ file://CVE-2026-8927.patch \ file://CVE-2026-8932.patch \ + file://CVE-2026-9547.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Sep 4 09:00:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 97267 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1249EC79F89 for ; Fri, 4 Sep 2026 09:00:17 +0000 (UTC) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9553.1788512409943525828 for ; Fri, 04 Sep 2026 02:00:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Yf3JvBx6; spf=pass (domain: cisco.com, ip: 173.37.142.90, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9086; q=dns/txt; s=iport01; t=1788512410; x=1789722010; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=zPz6gdzsKDYrAQ1xg+P0vhq8GgHoo/87ea+PcYWSzdQ=; b=Yf3JvBx6rO08FOknkjtV7FWMy61RUVnJArN5qzE0hOex41tX3eafo0+D RBFp9mP8xUarMvKi2JMCPDM+PsnCBpq9Eyigt7SWPEH+v9w2ikG2rcQC0 pHpxLimFZOckaTPQjEe2MciUUcT/dAQ9onIpCdu6BiZDRpL0iyk4ORjuX YJbWb0nws7CCVeHU2Z9mTfyYrcmhDpl/+zuzAC5L7qp3VIZu+lxy0E6BJ LBPBqGFdRfOi7WBoxiHGbe0wBIMJ/1Cpb/QWEECnB85YLYTxpbHd305kM se/YMq4DIloEq1hn8NpfwMGn40TMLZKzhZeMDb+UjLbZLIUJdnsCdTKxP Q==; X-CSE-ConnectionGUID: BFdFrKURS7O0TgrutfwJlQ== X-CSE-MsgGUID: N0AU6K76SFqOlYaNfotxSg== X-IPAS-Result: A0AHAADxh5pq/4sQJK1aGgEBAQEBAQEBAQEDAQEBARIBAQEBAgIBAQEBgX4DAQEBAQsBglZ0YENJlkoDgROdCIF+DwEBAQ9EDQQBAYUFAo4CAiY2Bw4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZAZAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBsI4gXkzgQGDKAE/AgJAAVDbMQELFAEFgTMBhT6DA4EQhA9dGAGEfCcbG4FygRWBO4E4doEFgVwCAYFHhl0EgiKBDIFakg1IgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQcbBgWBHYEngz8jGTZ6gQlegSspYAESF4EJgggCglSCAwIBSUMOB0dTCSdBBAsYDUgRLDcVGQQ+bgeOXx+CSQYBAWAaCgkBKQEBggIDOAsWCJJrGpAWgiGhDwoog3aMIpU6GjOqbQuYfY4KlWAHDF2EaYFvATSBWXAVgyIJFjQZD44rDguDYIQHgjnFeScyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:OrNJIql/ViQ9tTHHKbitV6zo5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJODDqPa/eLM2qjKdwnOYXioUwEvJ+Ay4NrQFFlqnszE1tH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZC31GONgWYubDpFs/nb9HuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05Fac29shtIlx0z qM/cAwCdA2fif2UxIvuH4GAhux7RCXqFIobvnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmQpNUqGOkYeUrsUIMpWcOOAinThejtDqEq9rqss6G+Vxwt0uFToGIqJJYbXG5gLxy50o Ergp03EXDJFauex0B2Bw3uKiOjTjRj0Ddd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO+Q+7AfIzu/f5ByUQzBeCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3uz8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:cv/CXak43VRsQzBxTijX/9Y6G/7pDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:6tDsMW1+1eMnzJQJvkVo8bxfMO4pXGf+8U3rfGjgNWlzVaGbVn2UwfYx X-Talos-MUID: 9a23:VXGqHAl5bjtcinDJKGRMdnpEbO5VvYfxVnsjiLICisCiOytsKwyS2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,260,1779148800"; d="scan'208";a="847256561" Received: from alln-l-core-02.cisco.com ([173.36.16.139]) by alln-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Sep 2026 09:00:09 +0000 Received: from sjc-ads-5197.cisco.com (sjc-ads-5197.cisco.com [10.28.35.211]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-02.cisco.com (Postfix) with ESMTPS id CD64218000199; Fri, 4 Sep 2026 09:00:08 +0000 (GMT) Received: by sjc-ads-5197.cisco.com (Postfix, from userid 1887503) id 0FD0ECC124B; Fri, 4 Sep 2026 02:00:08 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064 Date: Fri, 4 Sep 2026 02:00:07 -0700 Message-Id: <20260904090007.27374-6-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260904090007.27374-1-devanshp@cisco.com> References: <20260904090007.27374-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-5197.cisco.com [10.28.35.211];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.28.35.211, sjc-ads-5197.cisco.com X-Outbound-Node: alln-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 04 Sep 2026 09:00:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245080 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. The config2setopts.c change is adapted to curl 8.7.1's equivalent url_proto() implementation in tool_operate.c while preserving upstream out-of-memory error propagation. [1] https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e [2] https://curl.se/docs/CVE-2026-12064.html Signed-off-by: Devansh Patel --- .../curl/curl/CVE-2026-12064.patch | 258 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 259 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-12064.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-12064.patch b/meta/recipes-support/curl/curl/CVE-2026-12064.patch new file mode 100644 index 0000000000..4444401864 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-12064.patch @@ -0,0 +1,258 @@ +From 1bdb3dbcc85bd754b8f5af73159decd926a0b7a4 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Fri, 12 Jun 2026 09:01:22 +0200 +Subject: [PATCH] config2setopts: use default protocol properly + +Verified by test 1724, 1725 and 2036 + +Closes #21983 + +CVE: CVE-2026-12064 +Upstream-Status: Backport [https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e] + +Backport Changes: +- Adapt the config2setopts.c change to curl 8.7.1's equivalent url_proto() + implementation in tool_operate.c. Since CURLU_NO_GUESS_SCHEME is not + available, parse without scheme guessing when --proto-default is set and + use the configured default only when the URL has no explicit scheme. +- Preserve upstream error handling by propagating CURLUE_OUT_OF_MEMORY from + both curl_url_set() and curl_url_get() as CURLE_OUT_OF_MEMORY. +- Register the regression tests in the target Makefile.inc. Renumber upstream + test2036 to test1726 because test2036 already exists in curl 8.7.1. Use + the target's %SSH_PWD substitution in test1725. Declare the no-server + test1726 explicitly because the older test harness requires it. + +(cherry picked from commit ab3bb8cd8be8f9d4acb97da0418abc279182041e) +Signed-off-by: Devansh Patel +--- + docs/cmdline-opts/proto-default.md | 6 +++- + src/tool_operate.c | 45 +++++++++++++++---------- + tests/data/Makefile.inc | 1 + + tests/data/test1724 | 53 ++++++++++++++++++++++++++++++ + tests/data/test1725 | 29 ++++++++++++++++ + tests/data/test1726 | 29 ++++++++++++++++ + 6 files changed, 144 insertions(+), 19 deletions(-) + create mode 100644 tests/data/test1724 + create mode 100644 tests/data/test1725 + create mode 100644 tests/data/test1726 + +diff --git a/docs/cmdline-opts/proto-default.md b/docs/cmdline-opts/proto-default.md +index 209e5cdc83..903fac73a5 100644 +--- a/docs/cmdline-opts/proto-default.md ++++ b/docs/cmdline-opts/proto-default.md +@@ -16,7 +16,8 @@ Example: + + # `--proto-default` + +-Use *protocol* for any provided URL missing a scheme. ++Use *protocol* for any provided URL missing a scheme. The case-insensitive ++name should be given without any `://` suffix. + + An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*. + +@@ -24,3 +25,6 @@ This option does not change the default proxy protocol (http). + + Without this option set, curl guesses protocol based on the hostname, see + --url for details. ++ ++The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to ++be used explicitly in the URL. +diff --git a/src/tool_operate.c b/src/tool_operate.c +index 7e2c1eefe0..c8059a40d9 100644 +--- a/src/tool_operate.c ++++ b/src/tool_operate.c +@@ -704,26 +704,35 @@ static CURLcode url_proto(char **url, + if(*url) { + char *schemep = NULL; + +- if(!curl_url_set(uh, CURLUPART_URL, *url, +- CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) && +- !curl_url_get(uh, CURLUPART_SCHEME, &schemep, +- CURLU_DEFAULT_SCHEME)) { +- if(curl_strequal(schemep, proto_ipfs) || +- curl_strequal(schemep, proto_ipns)) { +- result = ipfs_url_rewrite(uh, schemep, url, config); +- /* short-circuit proto_token, we know it's ipfs or ipns */ +- if(curl_strequal(schemep, proto_ipfs)) +- proto = proto_ipfs; +- else if(curl_strequal(schemep, proto_ipns)) +- proto = proto_ipns; +- if(result) +- config->synthetic_error = TRUE; ++ CURLUcode uc = ++ curl_url_set(uh, CURLUPART_URL, *url, ++ CURLU_NON_SUPPORT_SCHEME | ++ (config->proto_default ? 0 : CURLU_GUESS_SCHEME)); ++ ++ if((uc == CURLUE_BAD_SCHEME) && config->proto_default) ++ proto = proto_token(config->proto_default); ++ else if(!uc) { ++ uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep, ++ CURLU_DEFAULT_SCHEME); ++ if(!uc) { ++ if(curl_strequal(schemep, proto_ipfs) || ++ curl_strequal(schemep, proto_ipns)) { ++ result = ipfs_url_rewrite(uh, schemep, url, config); ++ /* short-circuit proto_token, we know it's ipfs or ipns */ ++ if(curl_strequal(schemep, proto_ipfs)) ++ proto = proto_ipfs; ++ else if(curl_strequal(schemep, proto_ipns)) ++ proto = proto_ipns; ++ if(result) ++ config->synthetic_error = TRUE; ++ } ++ else ++ proto = proto_token(schemep); + } +- else +- proto = proto_token(schemep); +- +- curl_free(schemep); + } ++ if(uc == CURLUE_OUT_OF_MEMORY) ++ result = CURLE_OUT_OF_MEMORY; ++ curl_free(schemep); + } + curl_url_cleanup(uh); + } +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 9708e37b1f..da87400564 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -220,6 +220,7 @@ test1670 test1671 \ + test1680 test1681 test1682 test1683 \ + \ + test1700 test1701 test1702 test1703 test1704 \ ++test1724 test1725 test1726 \ + \ + test1800 test1801 \ + \ +diff --git a/tests/data/test1724 b/tests/data/test1724 +new file mode 100644 +index 0000000000..3cd328e39c +--- /dev/null ++++ b/tests/data/test1724 +@@ -0,0 +1,53 @@ ++ ++ ++ ++ ++IPFS ++ ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 200 OK ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: test-server/fake ++Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT ++ETag: "21025-dc7-39462498" ++Accept-Ranges: bytes ++Content-Length: 21 ++Connection: close ++Content-Type: text/plain ++Funny-head: yesyes ++ ++Hello curl from IPFS ++ ++ ++ ++# Client-side ++ ++ ++ipfs ++ ++ ++http ++ ++ ++IPFS with --proto-default HTTP ++ ++ ++--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++ +diff --git a/tests/data/test1725 b/tests/data/test1725 +new file mode 100644 +index 0000000000..e3b2c5abd2 +--- /dev/null ++++ b/tests/data/test1725 +@@ -0,0 +1,29 @@ ++ ++ ++ ++ ++SCP ++server key check ++ ++ ++ ++# Client-side ++ ++ ++scp ++ ++ ++SCP incorrect host key with --proto-default SCP ++ ++ ++--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++60 ++ ++ ++ +diff --git a/tests/data/test1726 b/tests/data/test1726 +new file mode 100644 +index 0000000000..61f5b5dbd5 +--- /dev/null ++++ b/tests/data/test1726 +@@ -0,0 +1,29 @@ ++ ++ ++ ++ ++--proto-default ++ ++ ++ ++# Client-side ++ ++ ++none ++ ++ ++Attempt to set a default protocol with :// suffix ++ ++ ++--proto-default https:// ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++# CURLE_UNSUPPORTED_PROTOCOL is error code 1 ++ ++1 ++ ++ ++ diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index e9ba10cb97..267182aacd 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -47,6 +47,7 @@ SRC_URI = " \ file://CVE-2026-8927.patch \ file://CVE-2026-8932.patch \ file://CVE-2026-9547.patch \ + file://CVE-2026-12064.patch \ " SRC_URI:append:class-nativesdk = " \