From patchwork Fri Oct 23 09:33:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101773 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3159.1792748016536575068 for ; Fri, 23 Oct 2026 02:33:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=TAcKNfhZ; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=20855; q=dns/txt; s=iport01; t=1792748016; x=1793957616; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=gURhZ9MJ3Bhr2WVpxDenAIIIFDcbQR//pGKnqqVVuXY=; b=TAcKNfhZD2VK189h4ZXJnqsdsoeon2v+YvEBRF9jHCYhTWVUUTeiaf6n VCCImkjZkRMH1CoHC/yOjIyPUF0cq4VvCIxJBZsia7YD9qYKM6cB3DZcU rvvftKmtZ7OI3HfiM/rq7NSbetxOieZKjhzkEVYl8qkXqThX5n/fNy7hZ KL7vRgJi3PKF6FN9ruk3y6A7nUTH4HKyP3UvBJxvfqo0Y9oRZsEo6ZWeN NctNqwe6wr2B3HBqGZYg8YhSNHsZtnnfq4wDGoTvq4Er9upwFg4ft1tP7 Y6C0JNjEUjY2oxsJ0JrWBlzJ1rlOXiTdjgGkqqhYo9NBzUqWxpVKjAZsE g==; X-CSE-ConnectionGUID: jvl5zqR7RMaR3xPHmRzLBg== X-CSE-MsgGUID: d3eZ298xQFyXWxZ9c8f4tQ== X-IPAS-Result: A0BLAgBIKNtq/4z/Ja1aglmCV3VgQ0kDlkgDnhwUgWoPAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDMgEYAS0QHAMBAhYBAQEWKx0BBQgZgwIBgnQDEQa1chs3giyBAYMpAT8CAkABUNsyAQsUAYE4hUCII10YAYR8JxsbgXKBFYE7gi6BBYEyKgIBgRgOIAFXCQIGhXUEgg0VehKBWhgGZYYlhkoaAmqGCUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BFiMZNmuBCV2BKylgASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExouC4EaODwJJkEVDGYLGgViCAINDH85EB8YDUgRLDcVGQQ+bgeRb4IaagcBWAgCKwEHIgEBBIEBfQY1CwEBBBiSdAcKkBaCIYE1n1oKKIN2jCKODYctGjOFW6UUmQiLN4JTlTQ0aIRpgWg8gVlwFTuCZwkWNBkPji4LC4F4gWiEB4I5yBonMgIEBTIBAQcCBw4DC4FokAACJAKBVgEB IronPort-Data: A9a23:0LJ54qn+uPkgxWU9h3FHma7o5gzvJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIcCjrSPaqJYGL8KtBzbYWzphsB6pHSzIBrQAA9/CxgEVtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsfnb9HuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FY8G/rtlGFsRz 9kREmsdVjCGvfCS6r3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMiYBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTYj/7C7pm9AusrnX8fjlRqUOcjaE2+GPUigd21dABNfKIIY3WGZ0Fzh3wS mTu8z/0MEtLZMym5yu1zWKe1+Sfk3/nYddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM/JBFOQ87keGzazb6gKxHW0FSjMHZsZOiSMtbSYh2 lnMm5biAiZi9eXOD3mc7byT6zi1PED5MFM/WMPNdiNdi/GLnW35pkunogpLeEJtsuDIJA== IronPort-HdrOrdr: A9a23:ecp0L6tF1aW3/ZRqmKmfFSVG7skDVNV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaDZ2JK2xCe36m+oocfng+OaYE X-Talos-CUID: 9a23:F/7ufGzj4rdoWPqmrSD3BgUWBMR4YGTnk031KnXjGV5JTYeHbXWfrfY= X-Talos-MUID: 9a23:TWi7tAmxOvCYJ8jE6FTRdnpub8paufX+GHkjgKU5q/vVPnx+Zyuk2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,174,1787011200"; d="scan'208";a="539440883" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 23 Oct 2026 09:33:35 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 00FD818000636; Fri, 23 Oct 2026 09:33:35 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 99CCACBF201; Fri, 23 Oct 2026 02:33:34 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, Darsh Kelaiya Subject: [OE-core][wrynose][PATCH v2 1/5] curl: fix CVE-2026-8926 Date: Fri, 23 Oct 2026 02:33:27 -0700 Message-Id: <20261023093331.1886272-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261023093331.1886272-1-dkelaiya@cisco.com> References: <20261023093331.1886272-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 23 Oct 2026 09:33:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248496 From: Darsh Kelaiya Backport the upstream fix [1] for [2] to curl 8.19.0. Include entry-selection changes and extended test 685 from [4]. Keep password-only entries valid for a user supplied in the URL, while rejecting passwords tied to a different login. Reset login matching state when changing entries. Include upstream follow-up [3] to cover URL users absent from the netrc file, with regression test 1646. Select the final login and password at the end of each machine entry. Extend tests/data/test1304 and tests/unit/unit1304.c for both credential orders, replaced logins, account values and macros. Document the retained parser API and test harness separately from upstream's lexer/scanner rewrite. Preserve generic password-only entries and the old blank-password API. [1] https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854 [2] https://curl.se/docs/CVE-2026-8926.html [3] https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8 [4] https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca Signed-off-by: Darsh Kelaiya --- Changes in v2: - Select the final login/password at entry boundaries to handle both credential orderings and reject a mismatched final login. - Extend tests/data/test1304 and tests/unit/unit1304.c for both orders, replaced logins, account values and macro bodies. - Document the retained parser API, test harness, password-only entries and blank-password behavior. --- .../curl/curl/CVE-2026-8926-dependent.patch | 140 ++++++++++ .../curl/curl/CVE-2026-8926_p1.patch | 258 ++++++++++++++++++ .../curl/curl/CVE-2026-8926_p2.patch | 84 ++++++ meta/recipes-support/curl/curl_8.19.0.bb | 3 + 4 files changed, 485 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch new file mode 100644 index 0000000000..1c46d08e27 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch @@ -0,0 +1,140 @@ +From a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 9 Mar 2026 08:38:14 +0100 +Subject: [PATCH] netrc: refactor into smaller sub functions + +Fixes #20950 - test 685 is extended for this +Closes #20932 + +CVE: CVE-2026-8926 +Upstream-Status: Backport [https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca] + +Backport Changes: +- Kept the curl 8.19.0 parser and login/password API instead of + extracting netrc_state, token, state, and finalization helpers. +- Applied the password-presence check, generic-entry selection and + entry-state resets in the existing parser, without the helper moves. +- Omitted netrc_finalize's password-return comment because the CVE + fix must reject entries with an explicitly mismatched login. + +(cherry picked from commit a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca) +Signed-off-by: Darsh Kelaiya +--- + docs/cmdline-opts/netrc.md | 12 ++++++++++-- + docs/libcurl/opts/CURLOPT_NETRC.md | 5 +++++ + lib/netrc.c | 17 ++++++++++++++--- + tests/data/test685 | 4 +++- + 4 files changed, 32 insertions(+), 6 deletions(-) + +diff --git a/docs/cmdline-opts/netrc.md b/docs/cmdline-opts/netrc.md +index 72b5ff9..03a7ed6 100644 +--- a/docs/cmdline-opts/netrc.md ++++ b/docs/cmdline-opts/netrc.md +@@ -35,10 +35,18 @@ On Windows two filenames in the home directory are checked: *.netrc* and + *_netrc*, preferring the former. Older versions on Windows checked for + *_netrc* only. + +-A quick and simple example of how to setup a *.netrc* to allow curl to FTP to +-the machine host.example.com with username 'myself' and password 'secret' ++A quick and simple example of how to setup a *.netrc* to allow curl to access ++the machine host.example.com with username `myself` and password `secret` + could look similar to: + + machine host.example.com + login myself + password secret ++ ++curl also supports the `default` keyword. This is the same as machine name ++except that default matches any name. There can be only one `default` token, ++and it must be after all machine tokens. ++ ++When providing a username in the URL and a *.netrc* file, curl looks for the ++password for that specific user for the given host if such an entry appears in ++the file before a "generic" `machine` entry without `login` specified. +diff --git a/docs/libcurl/opts/CURLOPT_NETRC.md b/docs/libcurl/opts/CURLOPT_NETRC.md +index 65d87cf..1e3dbb1 100644 +--- a/docs/libcurl/opts/CURLOPT_NETRC.md ++++ b/docs/libcurl/opts/CURLOPT_NETRC.md +@@ -50,6 +50,11 @@ and similar things are not supported). + The netrc file provides credentials for a hostname independent of which + protocol and port number that are used. + ++When providing a username in the URL and a *.netrc* file, libcurl looks for ++and uses the password for that specific user for the given host if such an ++entry appears in the file before a "generic" `machine` entry without `login` ++specified. ++ + libcurl does not verify that the file has the correct properties set (as the + standard Unix ftp client does). It should only be readable by user. + +diff --git a/lib/netrc.c b/lib/netrc.c +index 1073cc5..5eb0c84 100644 +--- a/lib/netrc.c ++++ b/lib/netrc.c +@@ -289,8 +289,7 @@ static NETRCcode parsenetrc(struct store_netrc *store, + retcode = NETRC_OUT_OF_MEMORY; /* allocation failed */ + goto out; + } +- if(!specific_login || our_login) +- found |= FOUND_PASSWORD; ++ found |= FOUND_PASSWORD; + keyword = NONE; + } + else if(curl_strequal("login", tok)) +@@ -299,13 +298,22 @@ static NETRCcode parsenetrc(struct store_netrc *store, + keyword = PASSWORD; + else if(curl_strequal("machine", tok)) { + /* a new machine here */ +- if(found & FOUND_PASSWORD) { ++ if(found & FOUND_PASSWORD && ++ /* a password was provided for this host */ ++ ++ ((!specific_login || our_login) || ++ /* either there was no specific login to search for, or this ++ is the specific one we wanted */ ++ (specific_login && !(found & FOUND_LOGIN)))) { ++ /* or we look for a specific login, but that was not specified */ ++ + done = TRUE; + break; + } + state = HOSTFOUND; + keyword = NONE; + found = 0; ++ our_login = FALSE; + Curl_safefree(password); + if(!specific_login) + Curl_safefree(login); +@@ -313,6 +321,9 @@ static NETRCcode parsenetrc(struct store_netrc *store, + else if(curl_strequal("default", tok)) { + state = HOSTVALID; + retcode = NETRC_OK; /* we did find our host */ ++ keyword = NONE; ++ found = 0; ++ our_login = FALSE; + Curl_safefree(password); + if(!specific_login) + Curl_safefree(login); +diff --git a/tests/data/test685 b/tests/data/test685 +index a069ff8..5346cd1 100644 +--- a/tests/data/test685 ++++ b/tests/data/test685 +@@ -26,13 +26,15 @@ Connection: close + http + + +-netrc with no login - provided user ++netrc with no login - but provided user in URL + + + --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://user@%HOSTIP:%HTTPPORT/ + + ++machine %HOSTIP password firstthis login unknown + machine %HOSTIP password 5up3r53cr37 ++machine %HOSTIP password d1ff3r3nt login anotherone + + + +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch new file mode 100644 index 0000000000..71d44a2bd5 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch @@ -0,0 +1,258 @@ +From 4ae1d7cc2643e4773a136395f12bc02fc6867854 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Fri, 15 May 2026 11:45:49 +0200 +Subject: [PATCH] netrc: scanner refactor + +Refactor the netrc scanner. Add test case for checking that the last +matched machine with unmatched login does not return the password as +success (unit1304). + +Closes #21624 + +CVE: CVE-2026-8926 +Upstream-Status: Backport [https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854] + +Backport Changes: +- Kept curl 8.19.0's parsenetrc() state machine and tokenizer; + applied the selection rules from upstream netrc_scan_end_entry() + without importing the lexer/scanner replacement. +- Kept Curl_parsenetrc() and its char **loginp / char **passwordp + interface. Omitted the netrc.h and url.c API/credential plumbing + changes for Curl_netrc_scan() and Curl_creds. +- Kept the existing file-loading helpers; omitted upstream's grammar + documentation, debug tracing and helper reordering. +- In the old parser, replaced the early login/password return with + selection at machine, default, macdef and EOF boundaries. Reject + an explicitly mismatched final login; keep password-only entries. +- Retained the old API's blank-password result for a matching login + without a password, rather than importing Curl_creds handling. +- Consume account values and skip macro-body lines in the retained + tokenizer instead of using upstream's literal-token/macro helpers. +- Adapted tests/unit/unit1304.c to the old API. Kept + UNITTEST_BEGIN_SIMPLE and string cleanup instead of upstream's + easy-handle setup. Retained the old assertion style and substring/ + superstring inputs. Updated the three unmatched-login results and + ported the final host/unmatched-login regression. +- Extended the existing tests/data/test1304 fixture, which upstream + does not modify, and added unit1304 assertions for both credential + orders, replaced logins, account values and macro bodies. + +(cherry picked from commit 4ae1d7cc2643e4773a136395f12bc02fc6867854) +Signed-off-by: Darsh Kelaiya +--- + lib/netrc.c | 53 +++++++++++++++++++++++++-------------------------- + tests/data/test1304 | 8 ++++++++ + tests/unit/unit1304.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++--- + 3 files changed, 83 insertions(+), 30 deletions(-) + +diff --git a/lib/netrc.c b/lib/netrc.c +index 5eb0c84..9f97781 100644 +--- a/lib/netrc.c ++++ b/lib/netrc.c +@@ -53,7 +53,8 @@ enum host_lookup_state { + enum found_state { + NONE, + LOGIN, +- PASSWORD ++ PASSWORD, ++ ACCOUNT + }; + + #define FOUND_LOGIN 1 +@@ -148,6 +149,8 @@ static NETRCcode parsenetrc(struct store_netrc *store, + if(state == MACDEF) { + if((*tok == '\n') || (*tok == '\r')) + state = NOTHING; /* end of macro definition */ ++ /* Macro contents are not netrc tokens. */ ++ break; + } + + if(!*tok || (*tok == '\n')) +@@ -292,35 +295,32 @@ static NETRCcode parsenetrc(struct store_netrc *store, + found |= FOUND_PASSWORD; + keyword = NONE; + } ++ else if(keyword == ACCOUNT) ++ keyword = NONE; /* Ignore the account value. */ ++ else if(curl_strequal("account", tok)) ++ keyword = ACCOUNT; + else if(curl_strequal("login", tok)) + keyword = LOGIN; + else if(curl_strequal("password", tok)) + keyword = PASSWORD; +- else if(curl_strequal("machine", tok)) { +- /* a new machine here */ +- if(found & FOUND_PASSWORD && +- /* a password was provided for this host */ +- +- ((!specific_login || our_login) || +- /* either there was no specific login to search for, or this +- is the specific one we wanted */ +- (specific_login && !(found & FOUND_LOGIN)))) { +- /* or we look for a specific login, but that was not specified */ +- ++ else if(curl_strequal("machine", tok) || ++ curl_strequal("default", tok) || ++ curl_strequal("macdef", tok)) { ++ /* Select credentials only after reading the whole entry. */ ++ if((found & FOUND_PASSWORD) && ++ (!specific_login || our_login || ++ !(found & FOUND_LOGIN))) { + done = TRUE; + break; + } +- state = HOSTFOUND; +- keyword = NONE; +- found = 0; +- our_login = FALSE; +- Curl_safefree(password); +- if(!specific_login) +- Curl_safefree(login); +- } +- else if(curl_strequal("default", tok)) { +- state = HOSTVALID; +- retcode = NETRC_OK; /* we did find our host */ ++ if(curl_strequal("machine", tok)) ++ state = HOSTFOUND; ++ else if(curl_strequal("default", tok)) { ++ state = HOSTVALID; ++ retcode = NETRC_OK; ++ } ++ else ++ state = MACDEF; + keyword = NONE; + found = 0; + our_login = FALSE; +@@ -328,10 +328,6 @@ static NETRCcode parsenetrc(struct store_netrc *store, + if(!specific_login) + Curl_safefree(login); + } +- if((found == (FOUND_PASSWORD | FOUND_LOGIN)) && our_login) { +- done = TRUE; +- break; +- } + break; + } /* switch (state) */ + tok = ++tok_end; +@@ -349,6 +345,9 @@ static NETRCcode parsenetrc(struct store_netrc *store, + + out: + curlx_dyn_free(&token); ++ if(!retcode && specific_login && !our_login && ++ ((found & FOUND_LOGIN) || !password)) ++ retcode = NETRC_NO_MATCH; + if(!retcode) { + if(!password && our_login) { + /* success without a password, set a blank one */ +diff --git a/tests/data/test1304 b/tests/data/test1304 +index 35f2a54..638a7d8 100644 +--- a/tests/data/test1304 ++++ b/tests/data/test1304 +@@ -21,6 +21,14 @@ netrc parsing unit tests + + + machine example.com login admin password passwd ++machine multi.example.com login alice password p1 login bob password p2 ++machine order.example.com login alice password p1 password p2 login bob ++machine account.example.com login bob password p2 account login ++machine macro.example.com login alice password p1 ++macdef boot ++login bob password wrong ++ ++machine macro.example.com login bob password p2 + machine curl.example.com login none password none + + +diff --git a/tests/unit/unit1304.c b/tests/unit/unit1304.c +index 231ddd4..5287061 100644 +--- a/tests/unit/unit1304.c ++++ b/tests/unit/unit1304.c +@@ -37,6 +37,11 @@ static CURLcode test_unit1304(const char *arg) + { + char *login = NULL; + char *password = NULL; ++ size_t i; ++ static const char * const hosts[] = { ++ "multi.example.com", "order.example.com", ++ "account.example.com", "macro.example.com" ++ }; + + UNITTEST_BEGIN_SIMPLE + +@@ -59,7 +64,7 @@ static CURLcode test_unit1304(const char *arg) + login = curlx_strdup("me"); + Curl_netrc_init(&store); + result = Curl_parsenetrc(&store, "example.com", &login, &password, arg); +- fail_unless(result == 0, "Host should have been found"); ++ fail_unless(result == 1, "Login should not have been found"); + abort_unless(password == NULL, "password is not NULL!"); + Curl_netrc_cleanup(&store); + curlx_free(login); +@@ -82,7 +87,7 @@ static CURLcode test_unit1304(const char *arg) + login = curlx_strdup("admi"); /* spellchecker:disable-line */ + Curl_netrc_init(&store); + result = Curl_parsenetrc(&store, "example.com", &login, &password, arg); +- fail_unless(result == 0, "Host should have been found"); ++ fail_unless(result == 1, "Login should not have been found"); + abort_unless(password == NULL, "password is not NULL!"); + Curl_netrc_cleanup(&store); + curlx_free(login); +@@ -94,7 +99,7 @@ static CURLcode test_unit1304(const char *arg) + login = curlx_strdup("adminn"); + Curl_netrc_init(&store); + result = Curl_parsenetrc(&store, "example.com", &login, &password, arg); +- fail_unless(result == 0, "Host should have been found"); ++ fail_unless(result == 1, "Login should not have been found"); + abort_unless(password == NULL, "password is not NULL!"); + Curl_netrc_cleanup(&store); + curlx_free(login); +@@ -166,6 +171,47 @@ static CURLcode test_unit1304(const char *arg) + fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'"); + Curl_netrc_cleanup(&store); + ++ /* ++ * Test for the last host where we do not want to see the password ++ * if the login does not match. ++ */ ++ curlx_free(password); ++ password = NULL; ++ curlx_free(login); ++ login = curlx_strdup("hilarious"); ++ Curl_netrc_init(&store); ++ result = Curl_parsenetrc(&store, "curl.example.com", &login, &password, arg); ++ fail_unless(result == 1, "Login should not have been found"); ++ abort_unless(password == NULL, "password is not NULL!"); ++ Curl_netrc_cleanup(&store); ++ ++ /* Select final credentials in either order, skipping account values ++ and macro bodies. */ ++ for(i = 0; i < CURL_ARRAYSIZE(hosts); i++) { ++ curlx_free(password); ++ password = NULL; ++ curlx_free(login); ++ login = curlx_strdup("bob"); ++ Curl_netrc_init(&store); ++ result = Curl_parsenetrc(&store, hosts[i], &login, &password, arg); ++ fail_unless(result == 0, "Login should have been found"); ++ abort_unless(password != NULL, "password is NULL!"); ++ fail_unless(!strcmp(password, "p2"), "password should be p2"); ++ Curl_netrc_cleanup(&store); ++ } ++ ++ /* An earlier login must not match after a later one replaces it. */ ++ curlx_free(password); ++ password = NULL; ++ curlx_free(login); ++ login = curlx_strdup("alice"); ++ Curl_netrc_init(&store); ++ result = Curl_parsenetrc(&store, "multi.example.com", ++ &login, &password, arg); ++ fail_unless(result == 1, "Login should not have been found"); ++ abort_unless(password == NULL, "password is not NULL!"); ++ Curl_netrc_cleanup(&store); ++ + UNITTEST_END(t1304_stop(&password, &login)) + } + +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch new file mode 100644 index 0000000000..b511e03fc4 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch @@ -0,0 +1,84 @@ +From 7ca5f939c8403db7ede21e2ccb805a65d3329ef8 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Sat, 16 May 2026 00:54:13 +0200 +Subject: [PATCH] test1646: netrc parsing without user match but user in URL + +Follow-up to 4ae1d7cc2643e + +CVE: CVE-2026-8926 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8] + +Backport Changes: +- Registered test 1646 in the older curl 8.19.0 test-list row. + +(cherry picked from commit 7ca5f939c8403db7ede21e2ccb805a65d3329ef8) +Signed-off-by: Darsh Kelaiya +--- + tests/data/Makefile.am | 2 +- + tests/data/test1646 | 45 +++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 46 insertions(+), 1 deletion(-) + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 13e47a3..ea700cd 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -218,7 +218,7 @@ test1620 test1621 test1622 test1623 test1624 \ + \ + test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \ + \ +-test1640 test1641 test1642 test1643 test1647 test1648 test1649 \ ++test1640 test1641 test1642 test1643 test1646 test1647 test1648 test1649 \ + \ + test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \ + test1658 \ +diff --git a/tests/data/test1646 b/tests/data/test1646 +new file mode 100644 +index 0000000..3df03be +--- /dev/null ++++ b/tests/data/test1646 +@@ -0,0 +1,45 @@ ++ ++ ++ ++ ++netrc ++ ++ ++ ++ ++ ++HTTP/1.1 200 OK ++Content-Length: 6 ++ ++12345 ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++ ++netrc parsing without user match but user in URL ++ ++ ++--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://alice@example.com:%HTTPPORT/%TESTNUMBER --resolve example.com:%HTTPPORT:%HOSTIP ++ ++ ++machine example.com login bob password sekret ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET /%TESTNUMBER HTTP/1.1 ++Host: example.com:%HTTPPORT ++Authorization: Basic %b64[alice:]b64% ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++ diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index c2697d6dd8..af76f5d53b 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -38,6 +38,9 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80229.patch \ file://CVE-2026-9546-01.patch \ file://CVE-2026-9546-02.patch \ + file://CVE-2026-8926-dependent.patch \ + file://CVE-2026-8926_p1.patch \ + file://CVE-2026-8926_p2.patch \ file://CVE-2026-80230.patch \ " From patchwork Fri Oct 23 09:33:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101777 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3156.1792748016059443437 for ; Fri, 23 Oct 2026 02:33:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NjFxiP9/; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7357; q=dns/txt; s=iport01; t=1792748016; x=1793957616; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4qA5bHaPuIsn8WH+3nWhxw/kHyD9wdJubQ/UcdcrWo0=; b=NjFxiP9/uA9+7R+E/5lSDh+UrVYZhkEt/zbp7yYjBmSX9PC58rB/XNG+ qUfw03j+WchGYIZVlpSKnvBI9Lzk9BiWLbvBDPvb3+NE9oXnmIF1Z/EV5 RmwDy+L8MJr6+zi9eAVPPZTMiOC5pq9vhqwq0tJPldu9kbIlQTxplEZrh Rp7IgHlTWoShIkxDfVVsKlH1wvNVyqA2WZHoUNC9wYRKo68oydGxTNn+5 1ZoXVeEih1R1qAckIjsOsxJVIg0TTnzOCHTtBvaPQC+9bhrtozBYCGzta 6aMXrJjZWlTlz5S4rMRAZKVKSWbrI+Y+3K75qr2L8JMHW/5Z+vm/T0Ckm Q==; X-CSE-ConnectionGUID: QUhTqkL1SVWpiUGdEWPq7Q== X-CSE-MsgGUID: 0fgEcte1Tcu3WP6CfX0eqQ== X-IPAS-Result: A0BJAgDGKNtq/4v/Ja1aglmCV3VgQ0mWSwOeHBSBag8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgQCYMCAYJ0AxEGtXUbN4F5M4EBgykBPwICQAFQ2zIBCxQBgTiFQIgjXRgBhHwnGxuBcoR+gQWBXAIBgUaGXgSCDRV6EoFaHo1uAoZzSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoEWIxk2a4EJXYErKWABIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGi4LgRo4PAkmQRUMZgsaBWIIAg0MfzkQHxgNSBEsNxUZBD5uB5FvgwQFAloHAisBKQKCDi+TJweSN6EPCiiDdowilToaM6pvC5h9jgqVaBtNhGmBaDyBWXAVgyIJFjQZD44uCwuDYIZAyBonMgIJMgEBBwIHDgMLgWiQACqBVAEB IronPort-Data: A9a23:egSm4KjnkegOlNLtK3sqUORHX161DhEKZh0ujC45NGQN5FlHY01je htvC2yOPK2PMGGncowgb4XloEsE7MWAm4BmQQVopShhES1jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/jY8E8HUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUhx+ZLGGJqr McmFygMUz+Pqt2O2e2CH7wEasQLdKEHPasFsX1miDWcBvE8TNWbGePB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWYQZ/5JEWxI9EglHzcDBcoVOErII84nPYy0p6172F3N/9J4faGJwPxRjGz o7A1zz3DTwRKNHG9TGYqU2U2MTBrXv2QbtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJ4Auoz7gfLwa3S7A+dLnMBTzpMLtI83PLaXhQw3 VOP2tesDjt1vfjNEzSW96yfqnW5Pi19wXI+WBLohDAtu7HLyLzfRDqVJjq/OMZZVuHIJAw= IronPort-HdrOrdr: A9a23:cQgIb6E2qpSfLO8YpLqEyseALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1rZ 0QEJRWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:c8wR+GNIg1222O5DYRRnyFcXPpkeTELFzUr/L2KHMX82cejA X-Talos-MUID: 9a23:Uxh66QYHPAVyTuBT7zHjqTp+OZ5U6Ln1N3hTups248SdDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,174,1787011200"; d="scan'208";a="538512366" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 23 Oct 2026 09:33:35 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 02F41180007FC; Fri, 23 Oct 2026 09:33:35 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 9E252CBF202; Fri, 23 Oct 2026 02:33:34 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, Darsh Kelaiya Subject: [OE-core][wrynose][PATCH v2 2/5] curl: fix CVE-2026-11564 Date: Fri, 23 Oct 2026 02:33:28 -0700 Message-Id: <20261023093331.1886272-3-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261023093331.1886272-1-dkelaiya@cisco.com> References: <20261023093331.1886272-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 23 Oct 2026 09:33:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248491 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Retain the curl 8.19.0 option-completion API and existing opt-in automatic client certificate behavior. Reset native CA options per transfer without adding the newer initial-origin restriction. [1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891 [2] https://curl.se/docs/CVE-2026-11564.html Signed-off-by: Darsh Kelaiya --- Changes in v2: - Clarify that Schannel selection remains opt-in and disabled by default, preserving the existing CURLSSLOPT_AUTO_CLIENT_CERT flag. - Document the per-transfer native-CA reset and omitted newer initial-origin restriction. Schannel redirect behavior has not been runtime tested. --- .../curl/curl/CVE-2026-11564.patch | 139 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 140 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch new file mode 100644 index 0000000000..86f0181630 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch @@ -0,0 +1,139 @@ +From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Mon, 8 Jun 2026 10:11:30 +0200 +Subject: [PATCH] ssl native_ca_store: always reinit + +Add bit `native_ca_store_opt` to keep the setting of +CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy +transfer if a native CA store shall be used or not. + +This avoids `native_ca_store` getting stuck on TRUE after being set +once. + +Closes #21902 + +CVE: CVE-2026-11564 +Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891] + +Backport Changes: +- Applied the option-completion helper to lib/vtls/vtls.c because curl + 8.19.0 does not have lib/vtls/vtls_config.c. +- Kept auto_client_cert derived from CURLSSLOPT_AUTO_CLIENT_CERT, as + in the old set_ssl_options(). This preserves the existing Schannel + opt-in behavior; automatic selection remains disabled by default. +- Omitted the initial-origin restriction from the newer origin-aware + configuration, introduced by [1]. + Curl 8.19.0 has no equivalent origin state. This backport resets + native CA options per transfer without adding that restriction. + +[1] https://github.com/curl/curl/commit/d3391229b0a0eb04f1ffe85f1483a890c5e00009 + +(cherry picked from commit d69bfad3fa3daf5e72331f6870667607828d5891) +Signed-off-by: Darsh Kelaiya +--- + lib/doh.c | 3 ++- + lib/setopt.c | 20 ++------------------ + lib/vtls/vtls.c | 21 +++++++++++++++++++++ + 3 files changed, 25 insertions(+), 19 deletions(-) + +diff --git a/lib/doh.c b/lib/doh.c +index 4488d42..80da94b 100644 +--- a/lib/doh.c ++++ b/lib/doh.c +@@ -397,7 +397,8 @@ static CURLcode doh_probe_run(struct Curl_easy *data, + } + + (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS, +- (long)data->set.ssl.primary.ssl_options); ++ ((long)data->set.ssl.primary.ssl_options & ++ ~CURLSSLOPT_AUTO_CLIENT_CERT)); + + doh->state.internal = TRUE; + doh->master_mid = data->mid; /* master transfer of this one */ +diff --git a/lib/setopt.c b/lib/setopt.c +index 7e6960c..3603912 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -407,22 +407,6 @@ static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg) + } + #endif /* !CURL_DISABLE_RTSP */ + +-#ifdef USE_SSL +-static void set_ssl_options(struct ssl_config_data *ssl, +- struct ssl_primary_config *config, +- long arg) +-{ +- config->ssl_options = (unsigned char)(arg & 0xff); +- ssl->enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST); +- ssl->no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE); +- ssl->no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN); +- ssl->revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT); +- ssl->native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA); +- ssl->auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT); +- ssl->earlydata = !!(arg & CURLSSLOPT_EARLYDATA); +-} +-#endif +- + static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option, + long arg) + { +@@ -1002,11 +986,11 @@ static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option, + s->use_ssl = (unsigned char)arg; + break; + case CURLOPT_SSL_OPTIONS: +- set_ssl_options(&s->ssl, &s->ssl.primary, arg); ++ s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff); + break; + #ifndef CURL_DISABLE_PROXY + case CURLOPT_PROXY_SSL_OPTIONS: +- set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg); ++ s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff); + break; + #endif + case CURLOPT_SSL_ENABLE_NPN: +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index 6dcc67d..35cb4f0 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -306,6 +306,22 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc) + #endif + } + ++static void ssl_easy_config_compl_options(struct ssl_config_data *sslc) ++{ ++ uint8_t options = sslc->primary.ssl_options; ++ /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it. ++ * If not, we switch it on for supported backends if no custom ++ * ca settings exist. */ ++ sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); ++ sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST); ++ sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN); ++ sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE); ++ sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT); ++ sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA); ++ ++ sslc->auto_client_cert = !!(options & CURLSSLOPT_AUTO_CLIENT_CERT); ++} ++ + CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + { + struct ssl_config_data *sslc = &data->set.ssl; +@@ -314,6 +330,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + CURLcode result; + #endif + ++ ssl_easy_config_compl_options(sslc); ++ + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +@@ -360,6 +378,9 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + + #ifndef CURL_DISABLE_PROXY + sslc = &data->set.proxy_ssl; ++ /* no initial origin for proxy, it is not changed for redirects */ ++ ssl_easy_config_compl_options(sslc); ++ + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index af76f5d53b..322304f47d 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -41,6 +41,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-8926-dependent.patch \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \ + file://CVE-2026-11564.patch \ file://CVE-2026-80230.patch \ " From patchwork Fri Oct 23 09:33:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101774 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3158.1792748016320966398 for ; Fri, 23 Oct 2026 02:33:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=b3DWSMiQ; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=13765; q=dns/txt; s=iport01; t=1792748016; x=1793957616; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=pf0wZ1kDMf8Mb44kWGPboxSBDbzseOJHZh9QTvnrANs=; b=b3DWSMiQf/Ptcy2h+js8Mlk+qT0YRkiZDWdtiEKRpEkAedJNIIiVA92C s9prbrgbmFpI6F4Mv+JCL0zGkaiL+2f2qCioe/WRbMu5BpAI/YodHZuaf AlmodLib34QsRS52ciKy4xZXeQz/CYUckyIRvwpHO1VEtm+VLk2qhOC8W Moae7bc90SElkOughbJya1M/25b7VDxWBYK/SQGI2CyrP3aXItsszy/H1 rvrqvtmtvo07h9dx4i4Rzdll1Lptlca0pYsv55+p7lVHSBYT1bv/QMOat kK0XANW8Hek+P/gRitvkwCIhMQhi0hsKLv94CZyIa9j6gQZLdoWnIhOHs w==; X-CSE-ConnectionGUID: DcndmAS9TSSLoMQl2TjD/g== X-CSE-MsgGUID: aazlBlr+RmucRMyb/K9BRw== X-IPAS-Result: A0BHAgBDKdtq/5H/Ja1aHgEBCxIMggULgld1YENJlksDnhyBfg8BAQEPRA0EAQGFBQKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEQa1eRs3gXkzgQGDKQE/AgJAAVDWWoRYAQsUAYE4hUCII10YAYR8JxsbgXKCUIIugQWBXAIBgUeGXQSCInoSgVoYBmWNCQKGc0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BFiMZNmuBCV2BKylgASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExouC4EaODwJJkEVDGYLGgViCAINDH85EB8YDUgRLDcVGQQ+bgeRb4MEBwFgLQEKHwEBF4FmBQIEHxYLFgijG4IhoQ8KKIN2jCKVOhozhASBV5JAklQLmH2OCpVoaIRpgWg8gVMGcBU7gmcJFjQZD44rDguBeIFohkDIGicyAgkyAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:iilpYak4cccXPfSxdt7xq6ro5gzvJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJMXTuAOfqLNzb2e98gOdjl8EIG65HXx4Q2TwRt/n1nF1tH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsfnb9HuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FaET/OpyKFofy ccjDDcoVxTZu+Cah73uH4GAhux7RCXqFJkUtnclyXTSCuwrBMiTBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZz/7C7pm9AusrnX8fjlRqUOcjaE2+GPUigd21dABNfKIIIHTGpsOzxfwS mTu9m3rBjseLp+lzCeOyFe9jKjszAnBR9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM/JBFOQ87keGzazb6gKxHW0FSjMHZsZOiSMtbSYh2 lnMm5biAiZi9eXFD3mc7byT6zi1PED5MFM/WMPNdiNdi/GLnW35pkunogpLeEJtsuDIJA== IronPort-HdrOrdr: A9a23:8NVkpak2ZHbdbuBFbZOUikLhSZjpDfIO3DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAH0++8YTzranGfg2J9dOMEKK Y= X-Talos-CUID: 9a23:+JANwmib1rejln9kHZUHR1u7sjJuXnbbwHL5GB6EMl1NT5isTQWs+o8jnJ87 X-Talos-MUID: 9a23:Jsu+xw+ZZtV+WHxLpblT21iQf85h8aCEDFpOq5AbsPOhJCY3GGa3tiviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,174,1787011200"; d="scan'208";a="525176399" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 23 Oct 2026 09:33:35 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 070FA180001C2; Fri, 23 Oct 2026 09:33:35 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id A60B6CBF203; Fri, 23 Oct 2026 02:33:34 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, Darsh Kelaiya Subject: [OE-core][wrynose][PATCH v2 3/5] curl: fix CVE-2026-80255 Date: Fri, 23 Oct 2026 02:33:29 -0700 Message-Id: <20261023093331.1886272-4-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261023093331.1886272-1-dkelaiya@cisco.com> References: <20261023093331.1886272-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 23 Oct 2026 09:33:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248494 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Apply prerequisite [3] to reject TABs in attribute values, then prerequisite [4] for per-attribute name/value validation. Carry them as separate dependent_p1 and dependent_p2 patches before the main TAB-handling fix. Preserve test 1685 and the invalid_octets() adaptation required by the older parser. Keep test 2885's SecureHttpOnly regression case alongside the upstream TAB-before-Secure case and normal Secure control. [1] https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a [2] https://curl.se/docs/CVE-2026-80255.html [3] https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d [4] https://github.com/curl/curl/commit/67300814294ab0aa311b8568b460619ecc522949 Signed-off-by: Darsh Kelaiya --- Changes in v2: - Reject malformed attribute names/values before dispatch so a cookie cannot lose its Secure flag. - Carry the TAB-value fix and adapted validation in separate dependent_p1 and dependent_p2 patches before the main fix. - Extend test 2885 with the malformed attribute case, retaining the TAB-before-Secure and normal Secure controls. --- .../curl/CVE-2026-80255-dependent_p1.patch | 139 ++++++++++++++++++ .../curl/CVE-2026-80255-dependent_p2.patch | 81 ++++++++++ .../curl/curl/CVE-2026-80255.patch | 115 +++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 3 + 4 files changed, 338 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch new file mode 100644 index 0000000000..ca7737e5dd --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch @@ -0,0 +1,139 @@ +From 8e8bdd36048c146fe843d8948a912fbd398d1c5d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 1 Apr 2026 08:09:47 +0200 +Subject: [PATCH] cookie: fix rejection when tabs in value + +A previous refactor changed the TAB check so that the octet could be +accepted in the 'path', which would cause an invalid line in the saved +cookie file so not possible to read the cookie back. Not terrible +because the path cannot contain a raw tab anyway so it would never match +anyway. + +Add test 1685 to verify + +Reported-by: Izan on hackerone + +Closes #21185 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d] + +Backport Changes: +- Registered test 1685 in the older curl 8.19.0 test-list row. + +(cherry picked from commit 8e8bdd36048c146fe843d8948a912fbd398d1c5d) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 14 ++++++------- + tests/data/Makefile.am | 2 +- + tests/data/test1685 | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 65 insertions(+), 8 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 4d53cc4..cd95130 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -461,6 +461,13 @@ parse_cookie_header(struct Curl_easy *data, + sep = TRUE; /* a '=' was used */ + if(!curlx_str_cspn(&ptr, &val, ";\r\n")) + curlx_str_trimblanks(&val); ++ ++ /* Reject cookies with a TAB inside the value */ ++ if(curlx_strlen(&val) && ++ memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { ++ infof(data, "cookie contains TAB, dropping"); ++ return CURLE_OK; ++ } + } + else + curlx_str_init(&val); +@@ -489,13 +496,6 @@ parse_cookie_header(struct Curl_easy *data, + return CURLE_OK; + } + +- /* Reject cookies with a TAB inside the value */ +- if(curlx_strlen(&val) && +- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { +- infof(data, "cookie contains TAB, dropping"); +- return CURLE_OK; +- } +- + /* Check if we have a reserved prefix set. */ + if(!strncmp("__Secure-", curlx_str(&name), 9)) + co->prefix_secure = TRUE; +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index ea700cd..5bb4f7e 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -226,7 +226,7 @@ test1660 test1661 test1662 test1663 test1664 test1665 \ + \ + test1670 test1671 \ + \ +-test1680 test1681 test1682 test1683 \ ++test1680 test1681 test1682 test1683 test1685 \ + \ + test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \ + test1708 test1709 test1710 test1711 test1712 \ +diff --git a/tests/data/test1685 b/tests/data/test1685 +new file mode 100644 +index 0000000..b98dc20 +--- /dev/null ++++ b/tests/data/test1685 +@@ -0,0 +1,57 @@ ++ ++ ++ ++ ++HTTP ++cookies ++ ++ ++ ++# Server-side ++ ++ ++HTTP/1.0 200 OK swsclose ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Type: text/html ++Set-Cookie: name=content; path=/we%TABwant ++Set-Cookie: accept=this; path=/only/this ++ ++boo ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++ ++HTTP, reject cookie with tab in path ++ ++ ++http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt ++ ++ ++ ++cookies ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis ++ ++ ++ diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch new file mode 100644 index 0000000000..8950b28784 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch @@ -0,0 +1,81 @@ +From 67300814294ab0aa311b8568b460619ecc522949 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 3 Jun 2026 08:10:14 +0200 +Subject: [PATCH] cookie: refactor parse_cookie_header + +- introduce a few static helper functions +- simplify the bad octet checks +- simplify the too long cookie/value check + +Closes #21854 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/67300814294ab0aa311b8568b460619ecc522949] + +Backport Changes: +- Kept parse_cookie_header() in its curl 8.19.0 form instead of + extracting parse_first_pair(), parse_flag(), parse_domain(), + parse_maxage() and parse_expires(). +- Applied the control-octet checks to that existing parser: reject + TAB in invalid_octets(), validate every attribute name/value, + and remove the duplicate first-pair checks. +- Kept the older cookie name/value length limits; omitted upstream's + separate simplification of those limits. + +(cherry picked from commit 67300814294ab0aa311b8568b460619ecc522949) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index cd95130..b3b1ebd 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -354,9 +354,9 @@ static bool bad_domain(const char *domain, size_t len) + static bool invalid_octets(const char *ptr, size_t len) + { + const unsigned char *p = (const unsigned char *)ptr; +- /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */ ++ /* Reject all bytes \x01 - \x1f + \x7f */ + while(len && *p) { +- if(((*p != 9) && (*p < 0x20)) || (*p == 0x7f)) ++ if((*p < 0x20) || (*p == 0x7f)) + return TRUE; + p++; + len--; +@@ -457,15 +457,18 @@ parse_cookie_header(struct Curl_easy *data, + bool sep = FALSE; + curlx_str_trimblanks(&name); + ++ if(invalid_octets(curlx_str(&name), curlx_strlen(&name))) { ++ infof(data, "invalid octets in name, cookie dropped"); ++ return CURLE_OK; ++ } ++ + if(!curlx_str_single(&ptr, '=')) { + sep = TRUE; /* a '=' was used */ + if(!curlx_str_cspn(&ptr, &val, ";\r\n")) + curlx_str_trimblanks(&val); + +- /* Reject cookies with a TAB inside the value */ +- if(curlx_strlen(&val) && +- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { +- infof(data, "cookie contains TAB, dropping"); ++ if(invalid_octets(curlx_str(&val), curlx_strlen(&val))) { ++ infof(data, "invalid octets in value, cookie dropped"); + return CURLE_OK; + } + } +@@ -476,8 +479,6 @@ parse_cookie_header(struct Curl_easy *data, + /* The first name/value pair is the actual cookie name */ + if(!sep || + /* Bad name/value pair. */ +- invalid_octets(curlx_str(&name), curlx_strlen(&name)) || +- invalid_octets(curlx_str(&val), curlx_strlen(&val)) || + !curlx_strlen(&name)) { + infof(data, "invalid octets in name/value, cookie dropped"); + return CURLE_OK; +-- +2.35.6 + diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch new file mode 100644 index 0000000000..43ef27f9bc --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch @@ -0,0 +1,115 @@ +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Thu, 27 Aug 2026 08:33:30 +0200 +Subject: [PATCH] cookie: improve TAB handling + +For entries with a leading tab. Verified in test 2885. + +Reported-by: Stanislav Fort +Closes #22699 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a] + +Backport Changes: +- Extended test 2885 to reject SecureHttpOnly, alongside the + upstream TAB-before-Secure case and normal Secure control. +- Registered test 2885 in the older curl 8.19.0 test-list layout. + +(cherry picked from commit 4f6aa41a0145e930e766775dbe860883d350aa0a) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 2 +- + tests/data/Makefile.am | 2 +- + tests/data/test2885 | 53 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 55 insertions(+), 2 deletions(-) + create mode 100644 tests/data/test2885 + +diff --git a/lib/cookie.c b/lib/cookie.c +index b3b1ebd..a8959a6 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data, + struct Curl_str val; + + /* we have a = pair or a stand-alone word here */ +- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) { ++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) { + bool sep = FALSE; + curlx_str_trimblanks(&name); + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 5bb4f7e..e157596 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -272,7 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \ + test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \ + test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \ + test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \ +-\ ++test2885 \ + test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \ + test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \ + test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \ +diff --git a/tests/data/test2885 b/tests/data/test2885 +new file mode 100644 +index 0000000..2635b6f +--- /dev/null ++++ b/tests/data/test2885 +@@ -0,0 +1,53 @@ ++ ++ ++ ++ ++HTTP ++cookies ++ ++ ++ ++ ++ ++HTTP/1.1 200 OK ++Content-Length: 0 ++Set-Cookie: thisis=SECRET;%TABSecure ++Set-Cookie: malformed=SECRET; Secure%TABHttpOnly ++Set-Cookie: also=notab; Secure ++ ++ ++ ++ ++ ++ ++cookies ++ ++ ++https ++ ++ ++Cookies with TAB before 'secure' ++ ++ ++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure ++ ++ ++ ++ ++ ++GET /%TESTNUMBER HTTP/1.1 ++Host: cookie.example:%HTTPSPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++ ++ ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET ++ ++ ++ +-- +2.35.6 + diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 322304f47d..096e27570c 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -42,6 +42,9 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \ file://CVE-2026-11564.patch \ + file://CVE-2026-80255-dependent_p1.patch \ + file://CVE-2026-80255-dependent_p2.patch \ + file://CVE-2026-80255.patch \ file://CVE-2026-80230.patch \ " From patchwork Fri Oct 23 09:33:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101776 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3157.1792748016125528739 for ; Fri, 23 Oct 2026 02:33:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=BgNZXkk/; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3598; q=dns/txt; s=iport01; t=1792748016; x=1793957616; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=S+AbpjFlnweKAkImhqGh9pZIpCqar8+gd86utumaLxI=; b=BgNZXkk/ToJrplAEM3mUnb197JHIiNvQgYMEIuNJLVOpXJs8ibgqwIx6 kvsOHhhbgKpFtkXxo8MffnPhXFC69qZd7aVLazM2E8aVw0b1uI/T3bSIa ERz0JBnMgQC2v4n/sYVxfdqTdmEzMKKl7JBQvpltAqewg5B/qy3UKm+XY 52zbuWFZEYQLc0Vu0kUDiPZKooyDaDYsWVhrt/pVpDqq7Rm4d0aMaIRJc nkLWNLyluJWSoUV2DVuCIddGTQ1ocWII2TTjfVw2w8Z1eUeci6VZ6YNsP CuY/l4RLibV92ozwsorWRUTxyYLu6QJPPsoMWIFqHjgxhjMzm5iFAdQXi w==; X-CSE-ConnectionGUID: nhHahPTsR8Sk0L0YDebXmg== X-CSE-MsgGUID: qIbm68MTTK6BTW4+90CTCg== X-IPAS-Result: A0BIAgBDKdtq/4r/Ja1aglmCV3VgQ0mWSwOeHIF+DwEBAQ9EDQQBAYUFAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBrV5GzeBeTOBAYMpAT8CAkABUNsyAQsUAYE4hUCII10YAYR8JxsbgXKEfoEFgVwCAYgkBIIiehKBWh6NbgKGc0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BFiMZNmuBCV2BKylgASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExouC4EaODwJJkEVDGYLGgViCAINDH85EB8YDUgRLDcVGQQ+bgeRb4MKAWEaEwEpAoIsEZMmkj+hDwoog3aMIpU6GjOqbwuYfY4KllCEaYFoPIFZcBWDIgkWNBkPjjmDa4ZAyBonMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:W7xuYaAiAgycPhVW/0fiw5YqxClBgxIJ4kV8jS/XYbTApGtxhWEAy WcYCmnUOKnfZWHxc9knOdy19U4CvMDcnYVqOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf/gGYoWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TExfVOBUEOAZYiqt10WUUWx NAVIgAIYUXW7w626OrTpuhEnM8vKozveYgYoHwllWifBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGE/BPjDS0Un1lM/BJEzmO6pl3DXeDxDo1XTrq0yi4TW5FEqgeO9aoGNKrRmQ+1Mv0yd+ DLjw1jaXDsmC4DcmGKuzlmj07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQiG+DtxgaHdFXFeIz7CmWz6vQ7kCXHAA5oiVpctcqsooyADctz FLMx4qvDj10u7rTQnWYnluJkQ6P1eEuBTdqTUc5ocEturEPfKlbYsrzc+te IronPort-HdrOrdr: A9a23:y0jPWq0trVHCA1nTHo1/2QqjBJAkLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmtBFeb7NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPGdXg2UK1XYANu5deXcGPTV7OQ== X-Talos-CUID: 9a23:6kzLM2i96BODefarCjWSjeuGsTJudH39xXfoH1SCWV1qEJnNeHOd8pNhnJ87 X-Talos-MUID: 9a23:CRrHKAk/GvZbr8izEpZidnp7Fc1tvfSLNHwuz786hJXHZHRbBxyS2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,174,1787011200"; d="scan'208";a="539382308" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 23 Oct 2026 09:33:35 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 13CCC1800032A; Fri, 23 Oct 2026 09:33:35 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id AD9E4CBF204; Fri, 23 Oct 2026 02:33:34 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, Darsh Kelaiya Subject: [OE-core][wrynose][PATCH v2 4/5] curl: fix CVE-2026-82208 Date: Fri, 23 Oct 2026 02:33:30 -0700 Message-Id: <20261023093331.1886272-5-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261023093331.1886272-1-dkelaiya@cisco.com> References: <20261023093331.1886272-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 23 Oct 2026 09:33:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248492 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a [2] https://curl.se/docs/CVE-2026-82208.html Signed-off-by: Darsh Kelaiya --- Changes in v2: - Explain that curl 8.19.0 already supplies char * from data->set.str; upstream supplies const char * from CURL_EASY_STR. - Clarify that the ECH call and error handling are unchanged and both store-setup security hunks are retained. --- .../curl/curl/CVE-2026-82208.patch | 54 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 55 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch new file mode 100644 index 0000000000..1ff3794c17 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch @@ -0,0 +1,54 @@ +From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Wed, 26 Aug 2026 13:46:13 +0200 +Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice + +The flag preventing a rerun was not set when a cached_store +was used. + +CURL_UNCONST an ech string for my old wolfssl version + +Closes #22689 + +CVE: CVE-2026-82208 +Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a] + +Backport Changes: +- Omitted CURL_UNCONST(b64val) in wolfSSL_SetEchConfigsBase64(). In + curl 8.19.0, b64val is already char * from + data->set.str[STRING_ECH_CONFIG]; upstream uses const char * from + CURL_EASY_STR. The old pointer already matches the wolfSSL argument + type, so the ECH call and error handling need no change. + +(cherry picked from commit ed0338befd1d865a8ea1fbaa90013a096dedd07a) +Signed-off-by: Darsh Kelaiya +--- + lib/vtls/wolfssl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c +index 74bd247..fdf33a8 100644 +--- a/lib/vtls/wolfssl.c ++++ b/lib/vtls/wolfssl.c +@@ -597,9 +597,6 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf, + bool imported_native_ca = FALSE; + bool imported_ca_info_blob = FALSE; + +- /* We do not want to do this again, no matter the outcome */ +- wssl->x509_store_setup = TRUE; +- + #ifndef NO_FILESYSTEM + /* load native CA certificates */ + if(ssl_config->native_ca_store) { +@@ -802,6 +799,9 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf, + WOLFSSL_X509_STORE *cached_store; + bool cache_criteria_met; + ++ /* We do not want to do this again, no matter the outcome */ ++ wssl->x509_store_setup = TRUE; ++ + /* Consider the X509 store cacheable if it comes exclusively from a CAfile, + or no source is provided and we are falling back to wolfSSL's built-in + default. */ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 096e27570c..e8e4a7e998 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -45,6 +45,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80255-dependent_p1.patch \ file://CVE-2026-80255-dependent_p2.patch \ file://CVE-2026-80255.patch \ + file://CVE-2026-82208.patch \ file://CVE-2026-80230.patch \ " From patchwork Fri Oct 23 09:33:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 101775 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3157.1792748016125528739 for ; Fri, 23 Oct 2026 02:33:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Eg2zhSo2; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11799; q=dns/txt; s=iport01; t=1792748016; x=1793957616; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Fpa8YRCxD3LIiMuHT9kEix/YUSOcfwB0eMjQwXJ94xE=; b=Eg2zhSo2WFGjRAybkGxkaF2nDFHrpdOpHv1MxI6hywoNuO80t4B/zX3o cd+GyACcQ7bjaIWJxF8JXzYBPp4VdaYZxGbcmkop8+pMmtSi4iJMPYx1U frWl/lwooSMMVuFWgtZrTYpwYxGwQ0VSEc4JZavv1CgJHP+1ehQAVqe7x vY0+YEoyuBwcWzNIPNV11NVM40cDVWh7HMD5Y7FVkqY/H2TGFKH6fJEk0 X7xsKbxuNLfUaMlRbr1W4RHckdkmxOcnn0USQF3uvocdQTHE/yTShwpIe CqMPL2scKHOP6Exzz0WE5a4YWY4rV6s3FHOwa3uAqCEObVNDLXhlHm35Q g==; X-CSE-ConnectionGUID: kEQs4S3OQ3yrtW+q+pmG0g== X-CSE-MsgGUID: PfGfI+kVRnKU5r7juDW7ew== X-IPAS-Result: A0BIAgBDKdtq/5D/Ja1aglmCV3VgQ0mWSwORSoxSgX4PAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxEGtXkbN4F5M4EBgykBPwICQAFQ2zIBCxQBgTiFQIgjXRgBhHwnGxuBcoEVg2mBBYFcAgGIJASCDRWBDIFaHmWNCQKGc0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BFiMZNmuBCV2BKylgASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExouC4EaODwJJkEVDGYLGgViCAINDH85EB8YDUgRLDcVGQQ+bgeRb4I8GzIBAQFgAgcREwEpAgRPgWcDIQiSfZI/oQ8KKIN2jCKVOhozhASUF5JUC5h9ggFYizGVNAI9XYRpgWg8gVlwFTuCZwkWNBkPji4LC4NghkDHeSEnMgIJMgEBBwIHDgMLgWiQACqBVAEB IronPort-Data: A9a23:PSn2sa8Eten7wa6XnWJZDrUD7n+TJUtcMsCJ2f8bNWPcYEJGY0x3y mMZCGqBOvaIY2ugeNgnOY20/U0B6sfVn4dkHgRt/H9EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajhPs/7rRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k1ELQDpt0sJlgV5 OYEF3MULQiGqLq5lefTpulE3qzPLeHxN48Z/3UlxjbDALN+HtbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0En1lQ/UPrSmM+khXT7ejxJoXqepLE85C7YywkZPL3FbYGEIYzQHpwM9qqej lrI0GrYQRIkDtq89GefrXCxqtCQkDyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXY0St1ZFet84waLxaPQyx2cB2wJCDBbAOHKr+csTjAsk 1vMlNTzCHk37/ueSGmW8fGfqjba1TUpEFLurBQsFWMti+QPaqlp5v4TZr6PyJKIs+A= IronPort-HdrOrdr: A9a23:vjfM3qCnveTYkEXlHemO55DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygck79 YCT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a585+oJjsaE52JKGxCe3+mLnE= X-Talos-CUID: 9a23:uRlCSWj6EFLTvLIh6qCgESfKLDJucVDk1yvreGiBUndzVILWUByI/Yw8nJ87 X-Talos-MUID: 9a23:nTOS3gmmAvcX8eYhZ8VGdnpaOuhmwuetNnoLsqhboZaGKABPZDqC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,174,1787011200"; d="scan'208";a="539382311" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 23 Oct 2026 09:33:35 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 64B78180003E4; Fri, 23 Oct 2026 09:33:35 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id B487ECBF21E; Fri, 23 Oct 2026 02:33:34 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, Darsh Kelaiya Subject: [OE-core][wrynose][PATCH v2 5/5] curl: fix CVE-2026-80231 Date: Fri, 23 Oct 2026 02:33:31 -0700 Message-Id: <20261023093331.1886272-6-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261023093331.1886272-1-dkelaiya@cisco.com> References: <20261023093331.1886272-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 23 Oct 2026 09:33:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248495 From: Darsh Kelaiya Apply the native CA connection-reuse fix [1] after CVE-2026-11564. Store the effective native CA setting in the primary SSL configuration and include it in connection matching and cloning. Update each affected TLS backend to read the connection setting using the curl 8.19.0 layout. The upstream advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 [2] https://curl.se/docs/CVE-2026-80231.html Signed-off-by: Darsh Kelaiya --- Changes in v2: - Explain the older struct/function locations and GnuTLS helpers. - Document that the omitted hunk only updates a flag access in a later SecTrust session-reuse exception absent from curl 8.19.0. - Clarify that the existing cached-session verification check remains. --- .../curl/curl/CVE-2026-80231.patch | 225 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80231.patch b/meta/recipes-support/curl/curl/CVE-2026-80231.patch new file mode 100644 index 0000000000..e0e3dd180f --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80231.patch @@ -0,0 +1,225 @@ +From 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 25 Aug 2026 13:47:11 +0200 +Subject: [PATCH] vtls: move 'native_ca_store' ssl_config_data => + ssl_primary_config + +And include it as key for connection reuse matching. + +Reported-by: Stanislav Fort + +Closes #22668 + +CVE: CVE-2026-80231 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42] + +Backport Changes: +- Moved native_ca_store from ssl_config_data to ssl_primary_config + in lib/urldata.h, where curl 8.19.0 defines both structs. Upstream + makes this change in lib/vtls/vtls_config.h. +- Added the field to match_ssl_primary_config() and + clone_ssl_primary_config(), and updated option completion in + lib/vtls/vtls.c. Upstream keeps these functions in + lib/vtls/vtls_config.c. +- Updated the native-CA read in Curl_gtls_verifyserver(), which is + the 8.19.0 location of upstream's gtls_verify_cert() check. The + older call site uses glts_apple_verify(); upstream calls + Curl_vtls_apple_verify(). +- Omitted the ossl_apply_session() hunk: it changes a flag access inside + a SecTrust session-reuse exception added by [1]. Curl 8.19.0 has + neither that exception nor the scs->sectrust_verified field. + Its ossl_init_session_and_alpns() rejects cached sessions when + verifypeer is set and SSL_get_verify_result() is not X509_V_OK. + Kept that existing check; there is no native-CA access to update. + +[1] https://github.com/curl/curl/commit/75c2c881af3201bc35d582eb4304e9b8ce3436ea + +(cherry picked from commit 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42) +Signed-off-by: Darsh Kelaiya +--- + lib/urldata.h | 2 +- + lib/vtls/gtls.c | 6 +++--- + lib/vtls/openssl.c | 7 +++---- + lib/vtls/rustls.c | 2 +- + lib/vtls/vtls.c | 8 +++++--- + lib/vtls/wolfssl.c | 5 ++--- + 6 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/lib/urldata.h b/lib/urldata.h +index dce181d..0bc9ade 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -249,6 +249,7 @@ struct ssl_primary_config { + BIT(verifypeer); /* set TRUE if this is desired */ + BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */ + BIT(verifystatus); /* set TRUE if certificate status must be checked */ ++ BIT(native_ca_store); /* use the native CA store of operating system */ + BIT(cache_session); /* cache session or not */ + }; + +@@ -264,7 +265,6 @@ struct ssl_config_data { + BIT(no_partialchain); /* do not accept partial certificate chains */ + BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation + list errors */ +- BIT(native_ca_store); /* use the native CA store of operating system */ + BIT(auto_client_cert); /* automatically locate and use a client + certificate for authentication (Schannel) */ + BIT(custom_cafile); /* application has set custom CA file */ +diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c +index bfeb948..f19940a 100644 +--- a/lib/vtls/gtls.c ++++ b/lib/vtls/gtls.c +@@ -451,7 +451,7 @@ static CURLcode gtls_populate_creds(struct Curl_cfilter *cf, + } + + infof(data, "SSL Trust Anchors:"); +- if(ssl_config->native_ca_store) { ++ if(config->native_ca_store) { + #ifdef USE_APPLE_SECTRUST + infof(data, " Native: Apple SecTrust"); + creds_are_empty = FALSE; +@@ -655,7 +655,7 @@ CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf, + !conn_config->CApath && + !conn_config->ca_info_blob && + !ssl_config->primary.CRLfile && +- !ssl_config->native_ca_store && ++ !conn_config->native_ca_store && + !conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */ + + if(cache_criteria_met) +@@ -1659,7 +1659,7 @@ CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf, + infof(data, " SSL certificate verified by GnuTLS"); + + #ifdef USE_APPLE_SECTRUST +- if(!verified && ssl_config->native_ca_store) { ++ if(!verified && config->native_ca_store) { + result = glts_apple_verify(cf, data, peer, &chain, &verified); + if(result && (result != CURLE_PEER_FAILED_VERIFICATION)) + goto out; /* unexpected error */ +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 1cf357c..e162114 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -3034,7 +3034,6 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf, + X509_STORE *store) + { + struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf); +- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data); + CURLcode result = CURLE_OK; + const char * const ssl_cafile = + /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */ +@@ -3043,7 +3042,7 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf, + bool have_native_check = FALSE; + + octx->store_is_empty = TRUE; +- if(ssl_config->native_ca_store) { ++ if(conn_config->native_ca_store) { + #ifdef USE_WIN32_CRYPTO + bool added = FALSE; + result = ossl_windows_load_anchors(cf, data, store, &added); +@@ -3352,7 +3351,7 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf, + !conn_config->CApath && + !conn_config->ca_info_blob && + !ssl_config->primary.CRLfile && +- !ssl_config->native_ca_store; ++ !conn_config->native_ca_store; + + ERR_set_mark(); + +@@ -4834,7 +4833,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, + infof(data, "SSL certificate verified via OpenSSL."); + + #ifdef USE_APPLE_SECTRUST +- if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) { ++ if(!verified && conn_config->verifypeer && conn_config->native_ca_store) { + /* we verify using Apple SecTrust *unless* OpenSSL already verified. + * This may happen if the application intercepted the OpenSSL callback + * and installed its own. */ +diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c +index 564b10a..8961943 100644 +--- a/lib/vtls/rustls.c ++++ b/lib/vtls/rustls.c +@@ -1035,7 +1035,7 @@ static CURLcode cr_init_backend(struct Curl_cfilter *cf, + rustls_client_config_builder_dangerous_set_certificate_verifier( + config_builder, cr_verify_none); + } +- else if(ssl_config->native_ca_store) { ++ else if(conn_config->native_ca_store) { + result = init_config_builder_platform_verifier(data, config_builder); + if(result != CURLE_OK) { + rustls_client_config_builder_free(config_builder); +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index 35cb4f0..a3ed81b 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -198,6 +198,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data, + if((c1->version == c2->version) && + (c1->version_max == c2->version_max) && + (c1->ssl_options == c2->ssl_options) && ++ (c1->native_ca_store == c2->native_ca_store) && + (c1->verifypeer == c2->verifypeer) && + (c1->verifyhost == c2->verifyhost) && + (c1->verifystatus == c2->verifystatus) && +@@ -251,6 +252,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source, + dest->verifypeer = source->verifypeer; + dest->verifyhost = source->verifyhost; + dest->verifystatus = source->verifystatus; ++ dest->native_ca_store = source->native_ca_store; + dest->cache_session = source->cache_session; + dest->ssl_options = source->ssl_options; + +@@ -312,7 +314,7 @@ static void ssl_easy_config_compl_options(struct ssl_config_data *sslc) + /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it. + * If not, we switch it on for supported backends if no custom + * ca settings exist. */ +- sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); ++ sslc->primary.native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); + sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST); + sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN); + sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE); +@@ -335,7 +337,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +- sslc->native_ca_store = TRUE; ++ sslc->primary.native_ca_store = TRUE; + #endif + #ifdef CURL_CA_PATH + if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH]) { +@@ -384,7 +386,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +- sslc->native_ca_store = TRUE; ++ sslc->primary.native_ca_store = TRUE; + #endif + #ifdef CURL_CA_PATH + if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) { +diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c +index fdf33a8..c901ebf 100644 +--- a/lib/vtls/wolfssl.c ++++ b/lib/vtls/wolfssl.c +@@ -593,13 +593,12 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf, + /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */ + (ca_info_blob ? NULL : conn_config->CAfile); + const char * const ssl_capath = conn_config->CApath; +- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data); + bool imported_native_ca = FALSE; + bool imported_ca_info_blob = FALSE; + + #ifndef NO_FILESYSTEM + /* load native CA certificates */ +- if(ssl_config->native_ca_store) { ++ if(conn_config->native_ca_store) { + #ifdef WOLFSSL_SYS_CA_CERTS + if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) { + infof(data, "error importing native CA store, continuing anyway"); +@@ -810,7 +809,7 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf, + !conn_config->CApath && + !conn_config->ca_info_blob && + !ssl_config->primary.CRLfile && +- !ssl_config->native_ca_store; ++ !conn_config->native_ca_store; + + cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data) + : NULL; diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index e8e4a7e998..adee64a018 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -47,6 +47,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80255.patch \ file://CVE-2026-82208.patch \ file://CVE-2026-80230.patch \ + file://CVE-2026-80231.patch \ " SRC_URI:append:class-nativesdk = " \