From patchwork Mon Oct 19 06:43:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101254 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71171CCF2DE for ; Mon, 19 Oct 2026 06:43:33 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.28816.1792392206147735939 for ; Sun, 18 Oct 2026 23:43:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Jpk7Y3B5; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=14619; q=dns/txt; s=iport01; t=1792392206; x=1793601806; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ACQYK4zeVzLzm2byaH+KIFKZxrprckKDdSGRIxisDT0=; b=Jpk7Y3B56JAclGsviwNOrqb/mYZkUmW34IfixiNM00WJwKvZrJ4Gsz2d EKCn41ikg3RoCkEiJ0JoZliiN5qkFJ2AKmAx4QWaC0J/Yv4WPqm+HO48V oLa90nJ5HByx7CG54gpygyPcoUnTJ9iv6Z9QErX32oCnautVlM2/rV84K Ov9+6iCPXDynlBSWA9eNycbOD5iqYE3Ty2fsH6/QMukbY2Cn3e4BvdulO DwA/c6WxWu1PnUE8cWkWGHA8QrPm7wCfJGrrSL5R71SuQRf8xliI+BTsz eexOSlSGNGD3l2Dj2Tp2oKgYPnI+pWJKqs/AY4tsvNHiTZimU1ZRy7oVf A==; X-CSE-ConnectionGUID: 2/CBc88dQtiO+L4BxsxQ/w== X-CSE-MsgGUID: j/bbgx5aSI6hzyo8kDb/OA== X-IPAS-Result: A0BKAgBsu9Vq/5T/Ja1aHgEBCxIMggULgld1YENJlkoDkUqMUhSBag8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyARgBLRAcAwECFwEBFisdAQUIGYMCAYJ0AxEGvR0bN4IsgQGDKQE/AgJAAVDbMgELFAGBOIVAiCNdGAGEfCcbG4FygRWBO4IugQWBMioCAYEmIAFgAgaFdQSCInoSgVoYBmWHNocnhX1IgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JB00YDUgRLDcVGQQ+bgeSKh6CXgcBWAgtAQciAQGBBX0GNQsBAQQYknSQJ4IhgTWfWgoog3aMIo4Nhy0aM4VbpRSZCIs3glOVNDQLDk+EaYFoPIFZcBU7gmcJFjQZD44uCwuBeIFohAeCOcgaJzICCTIBAQcCBw4DC4FokAACJAKBVgEB IronPort-Data: A9a23:oSUvIKKfNyrkXXU/FE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS0WYGn 2EZCjyBPPffNzD2KYwlYI7l8h8A6pDQyINnHQsd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2clajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN00S2ocNt1I9t9rAEYN0 aAyOCsdV1ec0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2MESojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeOyb4KKIIXaLSlTtkTfr GjJ7znwOTBENM6OzmqG3njrocaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul/fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:tQ7Im65AkE0/mabPcAPXwOrXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPN 9bAstDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhFQpcUAUdAZ0++/YTzra3FLeA== X-Talos-CUID: 9a23:2YfnOmM8Ftr2su5DAm5M3kVESswcbnz6j1OMCV+jGV8uV+jA X-Talos-MUID: 9a23:dPz75wQSVMj8TSgjRXTuwztoO9c16p+PVkAfgJJWuOWOcgtZbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,167,1787011200"; d="scan'208";a="537707218" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 19 Oct 2026 06:43:25 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id D59471800014B; Mon, 19 Oct 2026 06:43:24 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 5E0CACBF201; Sun, 18 Oct 2026 23:43:24 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 1/5] curl: fix CVE-2026-8926 Date: Sun, 18 Oct 2026 23:43:16 -0700 Message-Id: <20261019064320.3978613-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261019064320.3978613-1-dkelaiya@cisco.com> References: <20261019064320.3978613-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 19 Oct 2026 06:43:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248135 From: Darsh Kelaiya Backport the upstream fix [1] for [2] to curl 8.19.0. Include entry-selection changes and extended test 685 from [4]. Keep password-only entries valid for a user supplied in the URL, while rejecting passwords tied to a different login. Reset login matching state when changing entries. Include upstream follow-up [3] to cover URL users absent from the netrc file, with regression test 1646. [1] https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854 [2] https://curl.se/docs/CVE-2026-8926.html [3] https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8 [4] https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-8926-dependent.patch | 140 ++++++++++++++++++ .../curl/curl/CVE-2026-8926_p1.patch | 100 +++++++++++++ .../curl/curl/CVE-2026-8926_p2.patch | 84 +++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 3 + 4 files changed, 327 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch new file mode 100644 index 0000000000..1c46d08e27 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch @@ -0,0 +1,140 @@ +From a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 9 Mar 2026 08:38:14 +0100 +Subject: [PATCH] netrc: refactor into smaller sub functions + +Fixes #20950 - test 685 is extended for this +Closes #20932 + +CVE: CVE-2026-8926 +Upstream-Status: Backport [https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca] + +Backport Changes: +- Kept the curl 8.19.0 parser and login/password API instead of + extracting netrc_state, token, state, and finalization helpers. +- Applied the password-presence check, generic-entry selection and + entry-state resets in the existing parser, without the helper moves. +- Omitted netrc_finalize's password-return comment because the CVE + fix must reject entries with an explicitly mismatched login. + +(cherry picked from commit a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca) +Signed-off-by: Darsh Kelaiya +--- + docs/cmdline-opts/netrc.md | 12 ++++++++++-- + docs/libcurl/opts/CURLOPT_NETRC.md | 5 +++++ + lib/netrc.c | 17 ++++++++++++++--- + tests/data/test685 | 4 +++- + 4 files changed, 32 insertions(+), 6 deletions(-) + +diff --git a/docs/cmdline-opts/netrc.md b/docs/cmdline-opts/netrc.md +index 72b5ff9..03a7ed6 100644 +--- a/docs/cmdline-opts/netrc.md ++++ b/docs/cmdline-opts/netrc.md +@@ -35,10 +35,18 @@ On Windows two filenames in the home directory are checked: *.netrc* and + *_netrc*, preferring the former. Older versions on Windows checked for + *_netrc* only. + +-A quick and simple example of how to setup a *.netrc* to allow curl to FTP to +-the machine host.example.com with username 'myself' and password 'secret' ++A quick and simple example of how to setup a *.netrc* to allow curl to access ++the machine host.example.com with username `myself` and password `secret` + could look similar to: + + machine host.example.com + login myself + password secret ++ ++curl also supports the `default` keyword. This is the same as machine name ++except that default matches any name. There can be only one `default` token, ++and it must be after all machine tokens. ++ ++When providing a username in the URL and a *.netrc* file, curl looks for the ++password for that specific user for the given host if such an entry appears in ++the file before a "generic" `machine` entry without `login` specified. +diff --git a/docs/libcurl/opts/CURLOPT_NETRC.md b/docs/libcurl/opts/CURLOPT_NETRC.md +index 65d87cf..1e3dbb1 100644 +--- a/docs/libcurl/opts/CURLOPT_NETRC.md ++++ b/docs/libcurl/opts/CURLOPT_NETRC.md +@@ -50,6 +50,11 @@ and similar things are not supported). + The netrc file provides credentials for a hostname independent of which + protocol and port number that are used. + ++When providing a username in the URL and a *.netrc* file, libcurl looks for ++and uses the password for that specific user for the given host if such an ++entry appears in the file before a "generic" `machine` entry without `login` ++specified. ++ + libcurl does not verify that the file has the correct properties set (as the + standard Unix ftp client does). It should only be readable by user. + +diff --git a/lib/netrc.c b/lib/netrc.c +index 1073cc5..5eb0c84 100644 +--- a/lib/netrc.c ++++ b/lib/netrc.c +@@ -289,8 +289,7 @@ static NETRCcode parsenetrc(struct store_netrc *store, + retcode = NETRC_OUT_OF_MEMORY; /* allocation failed */ + goto out; + } +- if(!specific_login || our_login) +- found |= FOUND_PASSWORD; ++ found |= FOUND_PASSWORD; + keyword = NONE; + } + else if(curl_strequal("login", tok)) +@@ -299,13 +298,22 @@ static NETRCcode parsenetrc(struct store_netrc *store, + keyword = PASSWORD; + else if(curl_strequal("machine", tok)) { + /* a new machine here */ +- if(found & FOUND_PASSWORD) { ++ if(found & FOUND_PASSWORD && ++ /* a password was provided for this host */ ++ ++ ((!specific_login || our_login) || ++ /* either there was no specific login to search for, or this ++ is the specific one we wanted */ ++ (specific_login && !(found & FOUND_LOGIN)))) { ++ /* or we look for a specific login, but that was not specified */ ++ + done = TRUE; + break; + } + state = HOSTFOUND; + keyword = NONE; + found = 0; ++ our_login = FALSE; + Curl_safefree(password); + if(!specific_login) + Curl_safefree(login); +@@ -313,6 +321,9 @@ static NETRCcode parsenetrc(struct store_netrc *store, + else if(curl_strequal("default", tok)) { + state = HOSTVALID; + retcode = NETRC_OK; /* we did find our host */ ++ keyword = NONE; ++ found = 0; ++ our_login = FALSE; + Curl_safefree(password); + if(!specific_login) + Curl_safefree(login); +diff --git a/tests/data/test685 b/tests/data/test685 +index a069ff8..5346cd1 100644 +--- a/tests/data/test685 ++++ b/tests/data/test685 +@@ -26,13 +26,15 @@ Connection: close + http + + +-netrc with no login - provided user ++netrc with no login - but provided user in URL + + + --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://user@%HOSTIP:%HTTPPORT/ + + ++machine %HOSTIP password firstthis login unknown + machine %HOSTIP password 5up3r53cr37 ++machine %HOSTIP password d1ff3r3nt login anotherone + + + +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch new file mode 100644 index 0000000000..8402429fce --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch @@ -0,0 +1,100 @@ +From 4ae1d7cc2643e4773a136395f12bc02fc6867854 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Fri, 15 May 2026 11:45:49 +0200 +Subject: [PATCH] netrc: scanner refactor + +Refactor the netrc scanner. Add test case for checking that the last +matched machine with unmatched login does not return the password as +success (unit1304). + +Closes #21624 + +CVE: CVE-2026-8926 +Upstream-Status: Backport [https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854] + +Backport Changes: +- Kept the curl 8.19.0 tokenizer and login/password API in netrc.c; + omitted the Curl_creds API changes in netrc.h and url.c. +- Replaced the scanner refactor with a NETRC_NO_MATCH guard for an + unmatched requested login, keeping generic password-only entries. +- Corrected test 685's regression in the initial backport: a missing + login keyword must not reject a password-only entry for a URL user. +- Preserved the old blank-password behavior for a matching login. +- Adapted unit1304 to the curl 8.19.0 login/password API and retained + the upstream regression scenario for the last unmatched login. + +(cherry picked from commit 4ae1d7cc2643e4773a136395f12bc02fc6867854) +Signed-off-by: Darsh Kelaiya +--- + lib/netrc.c | 3 +++ + tests/unit/unit1304.c | 20 +++++++++++++++++--- + 2 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/lib/netrc.c b/lib/netrc.c +index 5eb0c84..425a535 100644 +--- a/lib/netrc.c ++++ b/lib/netrc.c +@@ -349,6 +349,9 @@ static NETRCcode parsenetrc(struct store_netrc *store, + + out: + curlx_dyn_free(&token); ++ if(!retcode && specific_login && !our_login && ++ ((found & FOUND_LOGIN) || !password)) ++ retcode = NETRC_NO_MATCH; + if(!retcode) { + if(!password && our_login) { + /* success without a password, set a blank one */ +diff --git a/tests/unit/unit1304.c b/tests/unit/unit1304.c +index 231ddd4..cff99f1 100644 +--- a/tests/unit/unit1304.c ++++ b/tests/unit/unit1304.c +@@ -59,7 +59,7 @@ static CURLcode test_unit1304(const char *arg) + login = curlx_strdup("me"); + Curl_netrc_init(&store); + result = Curl_parsenetrc(&store, "example.com", &login, &password, arg); +- fail_unless(result == 0, "Host should have been found"); ++ fail_unless(result == 1, "Login should not have been found"); + abort_unless(password == NULL, "password is not NULL!"); + Curl_netrc_cleanup(&store); + curlx_free(login); +@@ -82,7 +82,7 @@ static CURLcode test_unit1304(const char *arg) + login = curlx_strdup("admi"); /* spellchecker:disable-line */ + Curl_netrc_init(&store); + result = Curl_parsenetrc(&store, "example.com", &login, &password, arg); +- fail_unless(result == 0, "Host should have been found"); ++ fail_unless(result == 1, "Login should not have been found"); + abort_unless(password == NULL, "password is not NULL!"); + Curl_netrc_cleanup(&store); + curlx_free(login); +@@ -94,7 +94,7 @@ static CURLcode test_unit1304(const char *arg) + login = curlx_strdup("adminn"); + Curl_netrc_init(&store); + result = Curl_parsenetrc(&store, "example.com", &login, &password, arg); +- fail_unless(result == 0, "Host should have been found"); ++ fail_unless(result == 1, "Login should not have been found"); + abort_unless(password == NULL, "password is not NULL!"); + Curl_netrc_cleanup(&store); + curlx_free(login); +@@ -166,6 +166,20 @@ static CURLcode test_unit1304(const char *arg) + fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'"); + Curl_netrc_cleanup(&store); + ++ /* ++ * Test for the last host where we do not want to see the password ++ * if the login does not match. ++ */ ++ curlx_free(password); ++ password = NULL; ++ curlx_free(login); ++ login = curlx_strdup("hilarious"); ++ Curl_netrc_init(&store); ++ result = Curl_parsenetrc(&store, "curl.example.com", &login, &password, arg); ++ fail_unless(result == 1, "Login should not have been found"); ++ abort_unless(password == NULL, "password is not NULL!"); ++ Curl_netrc_cleanup(&store); ++ + UNITTEST_END(t1304_stop(&password, &login)) + } + +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch new file mode 100644 index 0000000000..b511e03fc4 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch @@ -0,0 +1,84 @@ +From 7ca5f939c8403db7ede21e2ccb805a65d3329ef8 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Sat, 16 May 2026 00:54:13 +0200 +Subject: [PATCH] test1646: netrc parsing without user match but user in URL + +Follow-up to 4ae1d7cc2643e + +CVE: CVE-2026-8926 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8] + +Backport Changes: +- Registered test 1646 in the older curl 8.19.0 test-list row. + +(cherry picked from commit 7ca5f939c8403db7ede21e2ccb805a65d3329ef8) +Signed-off-by: Darsh Kelaiya +--- + tests/data/Makefile.am | 2 +- + tests/data/test1646 | 45 +++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 46 insertions(+), 1 deletion(-) + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 13e47a3..ea700cd 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -218,7 +218,7 @@ test1620 test1621 test1622 test1623 test1624 \ + \ + test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \ + \ +-test1640 test1641 test1642 test1643 test1647 test1648 test1649 \ ++test1640 test1641 test1642 test1643 test1646 test1647 test1648 test1649 \ + \ + test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \ + test1658 \ +diff --git a/tests/data/test1646 b/tests/data/test1646 +new file mode 100644 +index 0000000..3df03be +--- /dev/null ++++ b/tests/data/test1646 +@@ -0,0 +1,45 @@ ++ ++ ++ ++ ++netrc ++ ++ ++ ++ ++ ++HTTP/1.1 200 OK ++Content-Length: 6 ++ ++12345 ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++ ++netrc parsing without user match but user in URL ++ ++ ++--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://alice@example.com:%HTTPPORT/%TESTNUMBER --resolve example.com:%HTTPPORT:%HOSTIP ++ ++ ++machine example.com login bob password sekret ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET /%TESTNUMBER HTTP/1.1 ++Host: example.com:%HTTPPORT ++Authorization: Basic %b64[alice:]b64% ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++ diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index c2697d6dd8..af76f5d53b 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -38,6 +38,9 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80229.patch \ file://CVE-2026-9546-01.patch \ file://CVE-2026-9546-02.patch \ + file://CVE-2026-8926-dependent.patch \ + file://CVE-2026-8926_p1.patch \ + file://CVE-2026-8926_p2.patch \ file://CVE-2026-80230.patch \ " From patchwork Mon Oct 19 06:43:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101251 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4EAFDCCF2DA for ; Mon, 19 Oct 2026 06:43:33 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.28813.1792392205794689588 for ; Sun, 18 Oct 2026 23:43:27 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=N0Mkpg9a; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6557; q=dns/txt; s=iport01; t=1792392207; x=1793601807; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=+RRrR0R3b70wKGNoBZ3NsqrUSI48gLYYobqeyO8Blsk=; b=N0Mkpg9aNeP+qC1d0ZBRqtamPjfigWFT2j2qxxcAWPEAdHY02Jv7g4Q0 Zv9MXd+GgyS4r8N7cSfVxa6nQzufb6RPy3Vws2WvlbiTyG0TbSG2W9L8c 3ZgwbeIKoYc/Kn4k11jYDlNnd3qg9gaIrOP3SeFOBiUXhGXCfWyyA913X ciI13CQoRsvlPy1cCoFT8zuh+hCKEFJGoYPBmWWZz7tnSfCLnrUWFkZ9o tBp0wxlV2wJdlxB1zYEhFxV8YW4kIhBfCsSL7An10OM38y05JO1vJAsm7 nP/cDz9JKWFAVAJZc3AyrfbYOcvxEaEZTzav9IUOq1abllwe49ovwN1im w==; X-CSE-ConnectionGUID: ofCgf3FqQ76HmvWGkDRKGQ== X-CSE-MsgGUID: TykQ/MLnQ1CZUlu8DRYZ4g== X-IPAS-Result: A0BIAgBsu9Vq/5T/Ja1aglmCV3VgQ0mWSgOeHIF+DwEBAQ9EDQQBAYUFAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBAJgwIBgnQDEQa9HRs3gXkzgQGDKQE/AgJAAVDbMgELFAGBOIVAiCNdGAGEfCcbG4FyhH6BBYFcAgGIJASCInoSgVoegUiTd0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHTRgNSBEsNxUZBD5uB5IqHoJeBQJhLQEpAoILMpMnB5I3oQ8KKIN2jCKVOhozqm8LmH2OCpVoaIRpgWg8gVlwFYMiCRY0GQ+OLgsLg2CGQMgaJzICCTIBAQcCBw4DC4FokAAqgVQBAQ IronPort-Data: A9a23:zDVd2ao+H8dnBCW7SDxCnpoYhXJeBmJJZBIvgKrLsJaIsI4StFCzt garIBnQO/eJZjHyfot+Pdjl/U4DvcPRmIQ3SFc9ryg8FC0W9OPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8UI35ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0uF5Km5Ar tIBEW9TThWduM217IiYZdA506zPLOGzVG8ekmtrwTecCbMtRorOBvyTo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LWPrSn8/w7pX7WzFbpVacpLs+y2PS1wd2lrPqNbI5f/TXHpoNxx7C/ D2uE2LRPgAZDZu67Ty8q1meu+vSzQ/BabBOG+jtnhJtqBjJroAJMzURTVa9rPyzh0KyVt4aI EsO9wIqrLMu7wqsVtT7UhiyrXKIsxJaXMBfe9DW8ymXwabSpgLcDW8eQ3sYMZottdQ9Qnoh0 Vrhc87VOAGDeYa9ERq1nop4ZxvoUcTJBQfuvRM5cDY= IronPort-HdrOrdr: A9a23:z/E/L67JhcTwgHmdlAPXwOrXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPN 9bAstDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhFQpcUAUdAZ0++/YTzra3FLeA== X-Talos-CUID: 9a23:Jt8dVmMhkhmdXu5DXydM+0BPNNkcLSP9yWnvDEyUM0VGcejA X-Talos-MUID: 9a23:G7A5fwtQsVPxp7ZzP82nuCBhDYBNx6KXUWs/rJEb6+W+BB4sNGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,167,1787011200"; d="scan'208";a="537010227" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 19 Oct 2026 06:43:25 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id D959D18000163; Mon, 19 Oct 2026 06:43:24 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 6BCFACBF202; Sun, 18 Oct 2026 23:43:24 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564 Date: Sun, 18 Oct 2026 23:43:17 -0700 Message-Id: <20261019064320.3978613-3-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261019064320.3978613-1-dkelaiya@cisco.com> References: <20261019064320.3978613-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 19 Oct 2026 06:43:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248137 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Restore the upstream native CA and proxy-origin comments while retaining the curl 8.19.0 option-completion API. [1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891 [2] https://curl.se/docs/CVE-2026-11564.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-11564.patch | 132 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 133 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch new file mode 100644 index 0000000000..539236228c --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch @@ -0,0 +1,132 @@ +From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Mon, 8 Jun 2026 10:11:30 +0200 +Subject: [PATCH] ssl native_ca_store: always reinit + +Add bit `native_ca_store_opt` to keep the setting of +CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy +transfer if a native CA store shall be used or not. + +This avoids `native_ca_store` getting stuck on TRUE after being set +once. + +Closes #21902 + +CVE: CVE-2026-11564 +Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891] + +Backport Changes: +- Applied the option-completion helper to lib/vtls/vtls.c because curl + 8.19.0 does not have lib/vtls/vtls_config.c. +- Retained the curl 8.19.0 auto-client-certificate behavior because the + later initial-origin tracking API is not available. + +(cherry picked from commit d69bfad3fa3daf5e72331f6870667607828d5891) +Signed-off-by: Darsh Kelaiya +--- + lib/doh.c | 3 ++- + lib/setopt.c | 20 ++------------------ + lib/vtls/vtls.c | 21 +++++++++++++++++++++ + 3 files changed, 25 insertions(+), 19 deletions(-) + +diff --git a/lib/doh.c b/lib/doh.c +index 4488d42..80da94b 100644 +--- a/lib/doh.c ++++ b/lib/doh.c +@@ -397,7 +397,8 @@ static CURLcode doh_probe_run(struct Curl_easy *data, + } + + (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS, +- (long)data->set.ssl.primary.ssl_options); ++ ((long)data->set.ssl.primary.ssl_options & ++ ~CURLSSLOPT_AUTO_CLIENT_CERT)); + + doh->state.internal = TRUE; + doh->master_mid = data->mid; /* master transfer of this one */ +diff --git a/lib/setopt.c b/lib/setopt.c +index 7e6960c..3603912 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -407,22 +407,6 @@ static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg) + } + #endif /* !CURL_DISABLE_RTSP */ + +-#ifdef USE_SSL +-static void set_ssl_options(struct ssl_config_data *ssl, +- struct ssl_primary_config *config, +- long arg) +-{ +- config->ssl_options = (unsigned char)(arg & 0xff); +- ssl->enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST); +- ssl->no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE); +- ssl->no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN); +- ssl->revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT); +- ssl->native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA); +- ssl->auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT); +- ssl->earlydata = !!(arg & CURLSSLOPT_EARLYDATA); +-} +-#endif +- + static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option, + long arg) + { +@@ -1002,11 +986,11 @@ static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option, + s->use_ssl = (unsigned char)arg; + break; + case CURLOPT_SSL_OPTIONS: +- set_ssl_options(&s->ssl, &s->ssl.primary, arg); ++ s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff); + break; + #ifndef CURL_DISABLE_PROXY + case CURLOPT_PROXY_SSL_OPTIONS: +- set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg); ++ s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff); + break; + #endif + case CURLOPT_SSL_ENABLE_NPN: +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index 6dcc67d..35cb4f0 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -306,6 +306,22 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc) + #endif + } + ++static void ssl_easy_config_compl_options(struct ssl_config_data *sslc) ++{ ++ uint8_t options = sslc->primary.ssl_options; ++ /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it. ++ * If not, we switch it on for supported backends if no custom ++ * ca settings exist. */ ++ sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); ++ sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST); ++ sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN); ++ sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE); ++ sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT); ++ sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA); ++ ++ sslc->auto_client_cert = !!(options & CURLSSLOPT_AUTO_CLIENT_CERT); ++} ++ + CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + { + struct ssl_config_data *sslc = &data->set.ssl; +@@ -314,6 +330,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + CURLcode result; + #endif + ++ ssl_easy_config_compl_options(sslc); ++ + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +@@ -360,6 +378,9 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + + #ifndef CURL_DISABLE_PROXY + sslc = &data->set.proxy_ssl; ++ /* no initial origin for proxy, it is not changed for redirects */ ++ ssl_easy_config_compl_options(sslc); ++ + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index af76f5d53b..322304f47d 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -41,6 +41,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-8926-dependent.patch \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \ + file://CVE-2026-11564.patch \ file://CVE-2026-80230.patch \ " From patchwork Mon Oct 19 06:43:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101255 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3592CCF2E0 for ; Mon, 19 Oct 2026 06:43:33 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.28815.1792392206077915467 for ; Sun, 18 Oct 2026 23:43:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NyFOyyI7; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10014; q=dns/txt; s=iport01; t=1792392206; x=1793601806; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=yJx6o7wNE3RXqvNQ3zoewYC5vAvDOtREMXQ8KUG7hOg=; b=NyFOyyI7va1yGBqH1brJ9oyjKNRhoHajYefB5DQColX5GvBGllILTDez kqIGQK27yXyz1fDOp+0vvJt8XfmPyrYGkxqJ+5pUlR3+HkBWBQa2AdueU zoifyUz6DSi7duB0Oxfl3maNexQlmg31WxeBGukigATwKLTJzhSMqgffH fSU0LK/A0Pvs94k+YZUYLJ+IaKW4C6k1k2esxXd2B1i11ncryXKSKbHlw OK6sHothy0HlEMxbvQ+J9LHCr8A+s6mc/Yd5i/BN51aTeSppbTXAGtWQG Hb4Xz+DGcv7daHsGQye+BDApX1+nsu3ENaHKqVgCTZ4p7eWTrXdA+I+K9 A==; X-CSE-ConnectionGUID: dxIu3cLHQ1efBGcICHNEMA== X-CSE-MsgGUID: nA8zVMs4Qy6CY/f577A4tg== X-IPAS-Result: A0BHAgBsu9Vq/5T/Ja1aHgEBCxIMggULgld1YENJlkoDnhyBfg8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEQa9HRs3gXkzgQGDKQE/AgJAAVDbMgELFAGBOIVAiCNdGAGEfCcbG4FyglCCLoEFgVwCAYFHhl0EgiJ6EoFaHmWUWkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHTRgNSBEsNxUZBD5uB5IqHoJlAWAtASkBAReBawIEHxYLFgijG4IhoQ8KKIN2jCKVOhozhASBV5JAklQLmH2OCpVoG02EaYFoPIFZcBU7gmcJFjQZD44rDguBeIFohkDIGicyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:1fzE3aiW6Fs+sfgXM6RTHAKIX161MREKZh0ujC45NGQN5FlHY01je htvCz2Fb/ffa2L9L98nbd/l90hVuMTSzd4xHQZlqH1nRiljpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vS8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUU6sdqWmpq1 cVBJT4nQRuirMKQ7ZeSH7wEasQLdKEHPasFsX1miDWcBvE8TNWaGuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgd/5JEWxI9EglHzcDBcoVOErII84nPYy0p6172F3N/9J4bQFJQNwhrAz o7A12LQUgMkEcfD8Cvb2UPriLKQwgqnRI1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBF2cHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:Q+Ko9a6gRPnx0BHFxAPXwOrXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPN 9bAstDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhFQpcUAUdAZ0++/YTzra3FLeA== X-Talos-CUID: 9a23:DYGlzWkHHzOek+rSnD7UNKcATxvXOXHN7WqLKGuYMD9kRpe6Qn672IVJtuM7zg== X-Talos-MUID: 9a23:qg9AVQgFMbZ4DH9mKCgazcMpMu448ZqLExw0gMstio6KaHMvEmuBg2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,167,1787011200"; d="scan'208";a="522990440" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 19 Oct 2026 06:43:25 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id E951A180002E7; Mon, 19 Oct 2026 06:43:24 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 8A1FACBF203; Sun, 18 Oct 2026 23:43:24 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-80255 Date: Sun, 18 Oct 2026 23:43:18 -0700 Message-Id: <20261019064320.3978613-4-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261019064320.3978613-1-dkelaiya@cisco.com> References: <20261019064320.3978613-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 19 Oct 2026 06:43:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248134 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Apply prerequisite [3] to reject TABs in cookie attribute values. Retain test 1685 alongside the main fix and test 2885. Keep the 8.19.0 invalid_octets() adaptation that prevents test 1105 regressions. [1] https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a [2] https://curl.se/docs/CVE-2026-80255.html [3] https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-80255-dependent.patch | 139 ++++++++++++++++++ .../curl/curl/CVE-2026-80255.patch | 125 ++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 2 + 3 files changed, 266 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch new file mode 100644 index 0000000000..ca7737e5dd --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch @@ -0,0 +1,139 @@ +From 8e8bdd36048c146fe843d8948a912fbd398d1c5d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 1 Apr 2026 08:09:47 +0200 +Subject: [PATCH] cookie: fix rejection when tabs in value + +A previous refactor changed the TAB check so that the octet could be +accepted in the 'path', which would cause an invalid line in the saved +cookie file so not possible to read the cookie back. Not terrible +because the path cannot contain a raw tab anyway so it would never match +anyway. + +Add test 1685 to verify + +Reported-by: Izan on hackerone + +Closes #21185 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d] + +Backport Changes: +- Registered test 1685 in the older curl 8.19.0 test-list row. + +(cherry picked from commit 8e8bdd36048c146fe843d8948a912fbd398d1c5d) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 14 ++++++------- + tests/data/Makefile.am | 2 +- + tests/data/test1685 | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 65 insertions(+), 8 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 4d53cc4..cd95130 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -461,6 +461,13 @@ parse_cookie_header(struct Curl_easy *data, + sep = TRUE; /* a '=' was used */ + if(!curlx_str_cspn(&ptr, &val, ";\r\n")) + curlx_str_trimblanks(&val); ++ ++ /* Reject cookies with a TAB inside the value */ ++ if(curlx_strlen(&val) && ++ memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { ++ infof(data, "cookie contains TAB, dropping"); ++ return CURLE_OK; ++ } + } + else + curlx_str_init(&val); +@@ -489,13 +496,6 @@ parse_cookie_header(struct Curl_easy *data, + return CURLE_OK; + } + +- /* Reject cookies with a TAB inside the value */ +- if(curlx_strlen(&val) && +- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { +- infof(data, "cookie contains TAB, dropping"); +- return CURLE_OK; +- } +- + /* Check if we have a reserved prefix set. */ + if(!strncmp("__Secure-", curlx_str(&name), 9)) + co->prefix_secure = TRUE; +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index ea700cd..5bb4f7e 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -226,7 +226,7 @@ test1660 test1661 test1662 test1663 test1664 test1665 \ + \ + test1670 test1671 \ + \ +-test1680 test1681 test1682 test1683 \ ++test1680 test1681 test1682 test1683 test1685 \ + \ + test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \ + test1708 test1709 test1710 test1711 test1712 \ +diff --git a/tests/data/test1685 b/tests/data/test1685 +new file mode 100644 +index 0000000..b98dc20 +--- /dev/null ++++ b/tests/data/test1685 +@@ -0,0 +1,57 @@ ++ ++ ++ ++ ++HTTP ++cookies ++ ++ ++ ++# Server-side ++ ++ ++HTTP/1.0 200 OK swsclose ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Type: text/html ++Set-Cookie: name=content; path=/we%TABwant ++Set-Cookie: accept=this; path=/only/this ++ ++boo ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++ ++HTTP, reject cookie with tab in path ++ ++ ++http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt ++ ++ ++ ++cookies ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis ++ ++ ++ diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch new file mode 100644 index 0000000000..50af08fc3c --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch @@ -0,0 +1,125 @@ +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Thu, 27 Aug 2026 08:33:30 +0200 +Subject: [PATCH] cookie: improve TAB handling + +For entries with a leading tab. Verified in test 2885. + +Reported-by: Stanislav Fort +Closes #22699 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a] + +Backport Changes: +- Made invalid_octets() reject TAB as required by the curl 8.19.0 + parser; without this adaptation, upstream test 1105 regresses. +- Registered test 2885 in the older test-list layout. + +(cherry picked from commit 4f6aa41a0145e930e766775dbe860883d350aa0a) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 6 ++--- + tests/data/Makefile.am | 2 +- + tests/data/test2885 | 52 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 56 insertions(+), 4 deletions(-) + create mode 100644 tests/data/test2885 + +diff --git a/lib/cookie.c b/lib/cookie.c +index 4d53cc4..c3adf1d 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -354,9 +354,9 @@ static bool bad_domain(const char *domain, size_t len) + static bool invalid_octets(const char *ptr, size_t len) + { + const unsigned char *p = (const unsigned char *)ptr; +- /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */ ++ /* Reject all bytes \x01 - \x1f + \x7f */ + while(len && *p) { +- if(((*p != 9) && (*p < 0x20)) || (*p == 0x7f)) ++ if((*p < 0x20) || (*p == 0x7f)) + return TRUE; + p++; + len--; +@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data, + struct Curl_str val; + + /* we have a = pair or a stand-alone word here */ +- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) { ++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) { + bool sep = FALSE; + curlx_str_trimblanks(&name); + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 13e47a3..18e7730 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -272,7 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \ + test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \ + test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \ + test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \ +-\ ++test2885 \ + test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \ + test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \ + test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \ +diff --git a/tests/data/test2885 b/tests/data/test2885 +new file mode 100644 +index 0000000..456224f +--- /dev/null ++++ b/tests/data/test2885 +@@ -0,0 +1,52 @@ ++ ++ ++ ++ ++HTTP ++cookies ++ ++ ++ ++ ++ ++HTTP/1.1 200 OK ++Content-Length: 0 ++Set-Cookie: thisis=SECRET;%TABSecure ++Set-Cookie: also=notab; Secure ++ ++ ++ ++ ++ ++ ++cookies ++ ++ ++https ++ ++ ++Cookies with TAB before 'secure' ++ ++ ++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure ++ ++ ++ ++ ++ ++GET /%TESTNUMBER HTTP/1.1 ++Host: cookie.example:%HTTPSPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET ++ ++ ++ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 322304f47d..33954465f7 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -42,6 +42,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \ file://CVE-2026-11564.patch \ + file://CVE-2026-80255-dependent.patch \ + file://CVE-2026-80255.patch \ file://CVE-2026-80230.patch \ " From patchwork Mon Oct 19 06:43:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101252 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A09F6CCF2E3 for ; Mon, 19 Oct 2026 06:43:33 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.28814.1792392206059043169 for ; Sun, 18 Oct 2026 23:43:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VV30YKyl; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3163; q=dns/txt; s=iport01; t=1792392206; x=1793601806; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=B2XFghZ/d7zWU8L9Iuccc9vF2Rg+kD2nXiVzDRyzPvo=; b=VV30YKyllG52TzBo/dBnpSzK2wWzCDSr4qoWutOzJ/blvBqrsYU8DwT4 Gh3yUeEbqFXmx3o0UiR1rXbZ04ab+D0udU4IwQu/BYhCDenuwFxSxRx+4 T23VPbRp5Pa34XalHrePLI917/5DhAEYteKFBCf1mB9D799GmR5o4vRB8 rGVw5fPs+d5DgbKgxfvYuVIVgHRE1tiHJWhwk9DUeKqPSa7B4IUmG2q1o 6q2JDiQpCawIJ/kNSnMJzzWUfZcRx+zs1gDuzWGVqpuNFtWSZutYcJ6rI 053griBkTZkP9TKBwD0p7vi3cXNIQ+LtxqOmaD5p1mWfpPjdG1GV8lYPi Q==; X-CSE-ConnectionGUID: AEARg5QHRHOaOsH+FQvviw== X-CSE-MsgGUID: VlSkR1FUT42gK04Fg/g2yg== X-IPAS-Result: A0BIAgBsu9Vq/5T/Ja1aglmCV3VgQ0mWSgOeHIF+DwEBAQ9EDQQBAYUFAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBr0dGzeBeTOBAYMpAT8CAkABUNsyAQsUAYE4hUCII10YAYR8JxsbgXKEfoEFgVwCAYgkBIIiehKBWh6VP0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHTRgNSBEsNxUZBD5uB5IqHoJkAWEtASkCgj2TJpI/oQ8KKIN2jCKVOhozqm8LmH2OCpZQhGmBaDyBWXAVgyIJFjQZD445g2uGQMgaJzICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:ZTpqk6i9Mo/rfIULGYf/yUsNX161MREKZh0ujC45NGQN5FlHY01je htvDDjQP6nYM2SmLtxxO4Ti/BsBuZ6AmoUwTgE+/iw2FShjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vS8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUx189NDjx31 cY4DzkqdTDAqduo3rOkH7wEasQLdKEHPasFsX1miDWcBvE8TNWaGuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgd/5JEWxI9EglHzcDBcoVOErII84nPYy0p6172F3N/9J4fVHJUFzx7Gz o7A11r9ORIgbfKi9Wbf/VH02sHA2iyhSY1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBF2cHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn2891te5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:8MXHF6rKOvB4xfdaXvtI/x4aV5oJeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5Q43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0EHMqySMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ANV0mlhD0Jcjpy1SZNNXB7OaY= X-Talos-CUID: 9a23:oXEtDGmvyb56CHUE2TFooULTEq7XOVTw5U3ffnaYM0ZOQZqOaRy+wb16ktU7zg== X-Talos-MUID: 9a23:BGvdVAhygUCR6MkqsnAfS8MpCsNT4J73Jn0xzc8JmJHYGyM3NG2Mg2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,167,1787011200"; d="scan'208";a="537188906" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 19 Oct 2026 06:43:25 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 17B3A180002EA; Mon, 19 Oct 2026 06:43:25 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 9CE90CBF204; Sun, 18 Oct 2026 23:43:24 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208 Date: Sun, 18 Oct 2026 23:43:19 -0700 Message-Id: <20261019064320.3978613-5-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261019064320.3978613-1-dkelaiya@cisco.com> References: <20261019064320.3978613-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 19 Oct 2026 06:43:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248133 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a [2] https://curl.se/docs/CVE-2026-82208.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-82208.patch | 52 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch new file mode 100644 index 0000000000..2c733de210 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch @@ -0,0 +1,52 @@ +From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Wed, 26 Aug 2026 13:46:13 +0200 +Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice + +The flag preventing a rerun was not set when a cached_store +was used. + +CURL_UNCONST an ech string for my old wolfssl version + +Closes #22689 + +CVE: CVE-2026-82208 +Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a] + +Backport Changes: +- Omitted the unrelated CURL_UNCONST ECH compatibility change because + curl 8.19.0 uses a mutable ECH configuration string and a different + code path. + +(cherry picked from commit ed0338befd1d865a8ea1fbaa90013a096dedd07a) +Signed-off-by: Darsh Kelaiya +--- + lib/vtls/wolfssl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c +index 74bd247..fdf33a8 100644 +--- a/lib/vtls/wolfssl.c ++++ b/lib/vtls/wolfssl.c +@@ -597,9 +597,6 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf, + bool imported_native_ca = FALSE; + bool imported_ca_info_blob = FALSE; + +- /* We do not want to do this again, no matter the outcome */ +- wssl->x509_store_setup = TRUE; +- + #ifndef NO_FILESYSTEM + /* load native CA certificates */ + if(ssl_config->native_ca_store) { +@@ -802,6 +799,9 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf, + WOLFSSL_X509_STORE *cached_store; + bool cache_criteria_met; + ++ /* We do not want to do this again, no matter the outcome */ ++ wssl->x509_store_setup = TRUE; ++ + /* Consider the X509 store cacheable if it comes exclusively from a CAfile, + or no source is provided and we are falling back to wolfSSL's built-in + default. */ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 33954465f7..0418bec61c 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -44,6 +44,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-11564.patch \ file://CVE-2026-80255-dependent.patch \ file://CVE-2026-80255.patch \ + file://CVE-2026-82208.patch \ file://CVE-2026-80230.patch \ " From patchwork Mon Oct 19 06:43:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101253 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94275CCF2DB for ; Mon, 19 Oct 2026 06:43:33 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.28717.1792392206312397773 for ; Sun, 18 Oct 2026 23:43:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Wfp1Hmvs; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10761; q=dns/txt; s=iport01; t=1792392206; x=1793601806; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=mNQqTgUv0Xx2v2WIjZpj6MU404jI0q2N3JduvmObGqc=; b=Wfp1HmvsG+lWpsaFisrk0qBQaBkKzbkvu+LoFA/rV2NHRf8L80ZSJOW3 IckUaGiNJTvbHGJnPxcuKv9tj9u/YZL/LZOnsIQ2QAvKDBiu6nxmU0sCE STa2zX/5fyLkir5Q9yZqtR5dOyYfaSB8+qbAh20NSbZ7wuspjX8C5Tb/6 5wlYC0Hey/nZcMD36rRQubWPy0uGacm8DgQTMN7+oE9fg8Ht8Z5qWPTiQ ZMm5zFKQaBGurGZXhxplEWhXRMLesIyPtgJ6ApN4432mEvbbJv8bEyhFp VvUwT73aXVEG77cpX/rDrtvDCw1luOZIg+aPmbb0GvkC9YhO1IGDiQZTj w==; X-CSE-ConnectionGUID: k5zghNf9QiykzsIz5QzCZQ== X-CSE-MsgGUID: Y2lBS/YNST+sV/YY/xmhZQ== X-IPAS-Result: A0BIAgDzutVq/5D/Ja1aglmCV3VgQ0mWSgOeHIF+DwEBAQ9EDQQBAYUFAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBr0YGzeBeTOBAYMpAT8CAkABUNsyAQsUAYE4hUCII10YAYR8JxsbgXKBFYNpgQWBXAIBiCQEgiKBDIFaHmWUWkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHTRgNSBEsNxUZBD5uB5IqHoIWGzICYQkREwEpAgRPgQdgAyEIkn2SP6EPCiiDdowilToaM4QElBeSVAuYfYIBWIsxlTY9XYRpgWg8gVlwFTuCZwkWNBkPji4LC4NghkDIGCcyAgkyAQEHAgcOAwuBaJAAKoFUAQE IronPort-Data: A9a23:c9sswaJlKpAWg7TpFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS1WEFm jZOUG2PMvyMZGTzKt8nbIjj9k9UvpfdnIRjQQEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2clajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1tUVM5PasWq992EGJc7 t0KdQkfRSK60rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBUrAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEiojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeOybIWFJY3VLSlTtnfCo kj9uFXfOS1ZL+LY+AvC4nestNaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1nfDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:3AF5m6pWPROKflDRTKJs6+kaV5oJeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5Q43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0EHMqySMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ANV0mlhD0Jcjpy1SZNNXB7OaY= X-Talos-CUID: 9a23:TzMyz28LjpeEFDpcsTWVv01JCM8lVHOM9XbBIF2jKHQ0ca++e2bFrQ== X-Talos-MUID: 9a23:euh5jgWjdaCpHxPq/A62gBtZc/ZO2JjtE35KoKRBq8yEBxUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,167,1787011200"; d="scan'208";a="537478797" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 19 Oct 2026 06:43:25 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 4B48C18000200; Mon, 19 Oct 2026 06:43:25 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id BD5EDCBF21E; Sun, 18 Oct 2026 23:43:24 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231 Date: Sun, 18 Oct 2026 23:43:20 -0700 Message-Id: <20261019064320.3978613-6-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261019064320.3978613-1-dkelaiya@cisco.com> References: <20261019064320.3978613-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 19 Oct 2026 06:43:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248136 From: Darsh Kelaiya Apply the native CA connection-reuse fix [1] after CVE-2026-11564. Store the effective native CA setting in the primary SSL configuration and include it in connection matching and cloning. Update each affected TLS backend to read the connection setting using the curl 8.19.0 layout. The upstream advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 [2] https://curl.se/docs/CVE-2026-80231.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-80231.patch | 212 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 213 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80231.patch b/meta/recipes-support/curl/curl/CVE-2026-80231.patch new file mode 100644 index 0000000000..dd58c6c544 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80231.patch @@ -0,0 +1,212 @@ +From 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 25 Aug 2026 13:47:11 +0200 +Subject: [PATCH] vtls: move 'native_ca_store' ssl_config_data => + ssl_primary_config + +And include it as key for connection reuse matching. + +Reported-by: Stanislav Fort + +Closes #22668 + +CVE: CVE-2026-80231 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42] + +Backport Changes: +- Moved the SSL config structures to lib/urldata.h and matching, + cloning and option completion to lib/vtls/vtls.c. Curl 8.19.0 + does not provide lib/vtls/vtls_config.[ch]. +- Omitted the ossl_apply_session() hunk because curl 8.19.0 has no + corresponding session-verification path. +- Retained the older GnuTLS verification layout and helper names. + +(cherry picked from commit 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42) +Signed-off-by: Darsh Kelaiya +--- + lib/urldata.h | 2 +- + lib/vtls/gtls.c | 6 +++--- + lib/vtls/openssl.c | 7 +++---- + lib/vtls/rustls.c | 2 +- + lib/vtls/vtls.c | 8 +++++--- + lib/vtls/wolfssl.c | 5 ++--- + 6 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/lib/urldata.h b/lib/urldata.h +index dce181d..0bc9ade 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -249,6 +249,7 @@ struct ssl_primary_config { + BIT(verifypeer); /* set TRUE if this is desired */ + BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */ + BIT(verifystatus); /* set TRUE if certificate status must be checked */ ++ BIT(native_ca_store); /* use the native CA store of operating system */ + BIT(cache_session); /* cache session or not */ + }; + +@@ -264,7 +265,6 @@ struct ssl_config_data { + BIT(no_partialchain); /* do not accept partial certificate chains */ + BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation + list errors */ +- BIT(native_ca_store); /* use the native CA store of operating system */ + BIT(auto_client_cert); /* automatically locate and use a client + certificate for authentication (Schannel) */ + BIT(custom_cafile); /* application has set custom CA file */ +diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c +index bfeb948..f19940a 100644 +--- a/lib/vtls/gtls.c ++++ b/lib/vtls/gtls.c +@@ -451,7 +451,7 @@ static CURLcode gtls_populate_creds(struct Curl_cfilter *cf, + } + + infof(data, "SSL Trust Anchors:"); +- if(ssl_config->native_ca_store) { ++ if(config->native_ca_store) { + #ifdef USE_APPLE_SECTRUST + infof(data, " Native: Apple SecTrust"); + creds_are_empty = FALSE; +@@ -655,7 +655,7 @@ CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf, + !conn_config->CApath && + !conn_config->ca_info_blob && + !ssl_config->primary.CRLfile && +- !ssl_config->native_ca_store && ++ !conn_config->native_ca_store && + !conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */ + + if(cache_criteria_met) +@@ -1659,7 +1659,7 @@ CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf, + infof(data, " SSL certificate verified by GnuTLS"); + + #ifdef USE_APPLE_SECTRUST +- if(!verified && ssl_config->native_ca_store) { ++ if(!verified && config->native_ca_store) { + result = glts_apple_verify(cf, data, peer, &chain, &verified); + if(result && (result != CURLE_PEER_FAILED_VERIFICATION)) + goto out; /* unexpected error */ +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 1cf357c..e162114 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -3034,7 +3034,6 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf, + X509_STORE *store) + { + struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf); +- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data); + CURLcode result = CURLE_OK; + const char * const ssl_cafile = + /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */ +@@ -3043,7 +3042,7 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf, + bool have_native_check = FALSE; + + octx->store_is_empty = TRUE; +- if(ssl_config->native_ca_store) { ++ if(conn_config->native_ca_store) { + #ifdef USE_WIN32_CRYPTO + bool added = FALSE; + result = ossl_windows_load_anchors(cf, data, store, &added); +@@ -3352,7 +3351,7 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf, + !conn_config->CApath && + !conn_config->ca_info_blob && + !ssl_config->primary.CRLfile && +- !ssl_config->native_ca_store; ++ !conn_config->native_ca_store; + + ERR_set_mark(); + +@@ -4834,7 +4833,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, + infof(data, "SSL certificate verified via OpenSSL."); + + #ifdef USE_APPLE_SECTRUST +- if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) { ++ if(!verified && conn_config->verifypeer && conn_config->native_ca_store) { + /* we verify using Apple SecTrust *unless* OpenSSL already verified. + * This may happen if the application intercepted the OpenSSL callback + * and installed its own. */ +diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c +index 564b10a..8961943 100644 +--- a/lib/vtls/rustls.c ++++ b/lib/vtls/rustls.c +@@ -1035,7 +1035,7 @@ static CURLcode cr_init_backend(struct Curl_cfilter *cf, + rustls_client_config_builder_dangerous_set_certificate_verifier( + config_builder, cr_verify_none); + } +- else if(ssl_config->native_ca_store) { ++ else if(conn_config->native_ca_store) { + result = init_config_builder_platform_verifier(data, config_builder); + if(result != CURLE_OK) { + rustls_client_config_builder_free(config_builder); +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index 35cb4f0..a3ed81b 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -198,6 +198,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data, + if((c1->version == c2->version) && + (c1->version_max == c2->version_max) && + (c1->ssl_options == c2->ssl_options) && ++ (c1->native_ca_store == c2->native_ca_store) && + (c1->verifypeer == c2->verifypeer) && + (c1->verifyhost == c2->verifyhost) && + (c1->verifystatus == c2->verifystatus) && +@@ -251,6 +252,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source, + dest->verifypeer = source->verifypeer; + dest->verifyhost = source->verifyhost; + dest->verifystatus = source->verifystatus; ++ dest->native_ca_store = source->native_ca_store; + dest->cache_session = source->cache_session; + dest->ssl_options = source->ssl_options; + +@@ -312,7 +314,7 @@ static void ssl_easy_config_compl_options(struct ssl_config_data *sslc) + /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it. + * If not, we switch it on for supported backends if no custom + * ca settings exist. */ +- sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); ++ sslc->primary.native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); + sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST); + sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN); + sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE); +@@ -335,7 +337,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +- sslc->native_ca_store = TRUE; ++ sslc->primary.native_ca_store = TRUE; + #endif + #ifdef CURL_CA_PATH + if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH]) { +@@ -384,7 +386,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +- sslc->native_ca_store = TRUE; ++ sslc->primary.native_ca_store = TRUE; + #endif + #ifdef CURL_CA_PATH + if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) { +diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c +index fdf33a8..c901ebf 100644 +--- a/lib/vtls/wolfssl.c ++++ b/lib/vtls/wolfssl.c +@@ -593,13 +593,12 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf, + /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */ + (ca_info_blob ? NULL : conn_config->CAfile); + const char * const ssl_capath = conn_config->CApath; +- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data); + bool imported_native_ca = FALSE; + bool imported_ca_info_blob = FALSE; + + #ifndef NO_FILESYSTEM + /* load native CA certificates */ +- if(ssl_config->native_ca_store) { ++ if(conn_config->native_ca_store) { + #ifdef WOLFSSL_SYS_CA_CERTS + if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) { + infof(data, "error importing native CA store, continuing anyway"); +@@ -810,7 +809,7 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf, + !conn_config->CApath && + !conn_config->ca_info_blob && + !ssl_config->primary.CRLfile && +- !ssl_config->native_ca_store; ++ !conn_config->native_ca_store; + + cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data) + : NULL; diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 0418bec61c..208595d950 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -46,6 +46,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80255.patch \ file://CVE-2026-82208.patch \ file://CVE-2026-80230.patch \ + file://CVE-2026-80231.patch \ " SRC_URI:append:class-nativesdk = " \