From patchwork Fri Oct 30 08:53:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 102443 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.32]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7137.1793350436979968775 for ; Fri, 30 Oct 2026 01:53:57 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=EUFceno3; spf=pass (domain: est.tech, ip: 40.107.159.32, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=E/rZqQY7GW6ZgVkhYqlRWxRYlYN8R4hzvOMozEi3Ciu5PU5zRnZaBonvbMKNS1xjCPnvrMgU9C92OuJCZpXGpb+X+NzjfskYbMp744XXj9W2xphuMJ/ov6+LOR4tMtCcqmYyjcaE7WOAZYu8kNUxroWEhG25prjJs9MLn9VNE/oD29lDXS3zmfOj4exUyhWYJEvNvRonlbh8/R67a2/xK4U2Cn79hhXQtmPEMJyEzoxVEDyyZW0oQDNGsQKcn/FPJ0fvVrTk1AuCLqUNgPtpvpkeFdFcnebZXApY/4N1MKIAf0fuKnAAJCLgTQAF98pJe7pxeJmF3nw0bNxCFMKlfA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=b1B6Nq9Bt7ETgTlO4jwLk2enWZliy6exJPCuA5n5FT0=; b=ffPDqbOk5W0Uznx7uQE6sT4eMlkk0pWATs8Qr4JF6HP/sz0mGRwnGOD/ieC+2EkGfDuRKfC1b1Flmgfsu3+nEhJo2/7HoeMn1KwFpDYyf4nA2Wfxsc8amrwcDRNaH3gAWw/eqfn/+hlppuzFx8XPIesucgj1+YzlSj0ytq5V0KqkuTu/WPUmG4UB6HFY2IOSAxwvP3gUygGSjPiqJ/420yFUnuCCp9tqdFotpr5LciRq/hsG2tTH+gR7xBsZAZGNW25wxDqGP7e1T3ewZVeUX4FPjt3OvxQsCKWBklzHRc+VbUcBc14KCeUllt3eJJI8Keu1rkPZUHI/rFVxAVu9DQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=b1B6Nq9Bt7ETgTlO4jwLk2enWZliy6exJPCuA5n5FT0=; b=EUFceno3RV1+cF67FCWWasSr8LjFfA4IK/FbCqz6oW1tt4ASJ6kXqVmMojmoihQoDEw3TN3wJ4E68TIKv/WstVp0/8A9iiRslTa7wSyxqmu7h3mg3eeTLxALdTwGuL5lvfQImMyDnKY0anUIl7oDZGj2JB1si6nlabYoC2yTn/Dmk0SjQhYe0jT0GdJYL4nayIdmhXEVowmFru9xE1kszV+oJQMscgS4fKaKLPBRliy5Bt3M7bFCD8IC/WCTafU08ahdpuwPlJbtll0YBwIcLBZxd4vdBycjgeHa8XppgIifaJ8YVWi0fkjA/lZeSEcW7bSTiUgHQ4ex1KYYEG8svQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM9P189MB1666.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:305::16) by PAVP189MB2434.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:305::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Fri, 30 Oct 2026 08:53:51 +0000 Received: from AM9P189MB1666.EURP189.PROD.OUTLOOK.COM ([fe80::806f:3b74:7216:3e92]) by AM9P189MB1666.EURP189.PROD.OUTLOOK.COM ([fe80::806f:3b74:7216:3e92%6]) with mapi id 15.21.0569.009; Fri, 30 Oct 2026 08:53:51 +0000 From: Adarsh Jagadish Kamini To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 1/2] curl: fix CVE-2026-87864 Date: Fri, 30 Oct 2026 09:53:50 +0100 Message-ID: <20261030085350.13089-1-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: DU2PR04CA0040.eurprd04.prod.outlook.com (2603:10a6:10:234::15) To AM9P189MB1666.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:305::16) Return-Path: adarsh.jagadish.kamini@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM9P189MB1666:EE_|PAVP189MB2434:EE_ X-MS-Office365-Filtering-Correlation-Id: 05910d00-15ed-4bc7-b9e4-08df366351fb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|10067099003|260925021911599003|260925022911599003|260925021311599003|11063799006|261028144727099003|261009223027099003|261022105027099003|261022113327099003|261022075727099003|261022115727099003|261021121427099003|261021123027099003|261021130227099003|261021133027099003|261021135927099003|56012099006|261026140227099003|261026135527099003|261026121527099003|261026130827099003|12006099003|13003099007|18002099003; X-Microsoft-Antispam-Message-Info: eYDcGNV6vjBfnQ6uu+K92inN0gHDEEV6TGlK4iA6aUYf22QNTPPRNHvyS3zW0F1H9yvbFhUdtLl5ujlfL2Box5zGmefVT8qIZpp3NhkWqwkGUMwjZzuP0LBLxevVSNSf3rjeT9Kxh0+hRalX7LfPS9+iyLJQGFZ/6Dh/cwZuJXIGVmEbUA/qCUH9WHv4R1pWP/P6B7HwI2+dItII4Z1aVatZgNWGWqDmigTrkWfEKT6zpsbiEKDMHbzcATwvi9VNa5VTjZv4q4Uj+ZquxanJVjyBTcklsF757rCvPlXEe03L+MWVbVa29W8rVxWPHLKHYCNGEZzL45U9YtydmklajiJD0/r8Knk57YgcjzuQg/3Lyc3/2Ax9/oVjIWRn1p6Vp3auEfppOaXllWLvF6uNAv5l51PZSdI4kNIrDkfk4W/YWuWNMML5CAEzcVmiNfBmE0KldYEJURBDPBEXDcQDyi6ea06vtR87dG5n8y10Up3v2B7XCHZK88VFP3xApRr8bHH6BgiM4V1+ipNbaLai9RprAJplu7mGZ+z//spttJOrPL6AmktdaCVQdS0C/5kXB7JtsjVbz5+Gxyqzyy7j+T+QuUos2U7FHBj+hkTTfK0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9P189MB1666.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(10067099003)(260925021911599003)(260925022911599003)(260925021311599003)(11063799006)(261028144727099003)(261009223027099003)(261022105027099003)(261022113327099003)(261022075727099003)(261022115727099003)(261021121427099003)(261021123027099003)(261021130227099003)(261021133027099003)(261021135927099003)(56012099006)(261026140227099003)(261026135527099003)(261026121527099003)(261026130827099003)(12006099003)(13003099007)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: diQagyV8p5+VQzd5HsnJdLEvCqVJ9FaekMCIzVi0lPp85/X8ztC13VGFvHJ0O4FDb9+4Uqc655hkq7MjL/pa9DifQLYO3QZLLeqNzzO17GJIMz5mhYYCB1WPVqWcN4iqSqphl6fs0R3KrzuqJB3TjHNncIwxj8q2Kib/+/RGWph9aMlOPsxvDUdRP+I9OqnaGE0nV7GY5WYC1g6JI7/NcT9f+VrVaZVBBKI9/M/jRQVXp6DzO5BEHg8Zx4rlR25vsVDt2wxkIXMGdbT2NK1YJq1AOAGE3sTrzVkaqEdgC9FDUtr8BSBwqhM50ewoB41UyVon6rstGgWkgfS1QBRqsZc0e8XDvCzEokdgqMgCtaODZZBof0oJMxcAD+IyieeAB8jzCF+DvdH8zBNcdEnvja8W0rSQZWL3M6nIc75tfG85Vs1dpGhP4N3G8fHCJvD5XvgRyd6lVwvtCbJ01xbNDMKNTQZ6rKl/vfIKeEf7x0tF9LndSm/kRNExafUGtPJpGWo0vQX1LT7KC6Y1wpfgSLUvoYY/GA9VZoOKAtZuQglNciWgtH/ew2X/T0CyzWa6rh/vyZpRcz8GGefRfFY8TwuuInUCNSg1K+PST9S8f2Orj4myAbELCk+sXOKhNBMk43RIzykUVPI14CmNbg1iRYYr0RDfLszOXaR8u5XGF/46qnzcmyP/k6oNzizYeclq6CVgKaUTAIjmUCxTHyO+rHA6WvWZ6eZ1VxX1rxM+wDZIpFIBGM8prIME9TJHLekaZUK6K33eUwhJ8HvLNab9REmMVUkkxRPlWs3SJWYazMLhO70TbNKNLcHPVcbRW1UT5OW1q1ShT879DMxVxuyz4vqDjaekc3LuztSExlGLRzJuB65s9taGxexQwxx9x1pxk0FhN/FL8w5r2c3+vfkIq2jpb78c93uOo4LeP7YN9T0HJ0bX8eoUmz+l1ubpBCpwRKUkjPWonAUA+pbSZGHyVfrXw1BtJ70kIv5slPzvS7fOsH4KBZvf+asdX/r1rSqmqL3TtO5uhLjb///IsUCogi8ZgorjwFfcEj/dxsTyxubaOmOcq3XqTme+ufve4uzbx+4sPHiiXOMxK73MxA2mRG1Fpyvs39q3FL7JcG5VCfkj7yg0+/KPd6uNaLDaixxVZWyIPhQxtmFqr/lRGON4ux5WYXrexjZ+ACPEUv1wA9T4yf17b0VYe4T1LI7Z1ycsm3aRev76W+wGihapyW5tzdNtdgv4Wuwcho7AeyHKJIXK1BM7WJF9e88vNCDqoPv2RLnR2h+ZzTfaqE8ksMe1P/+v/xkefHuUs5RUnq5bj4SJ2T9dwqmaXr7UUF5UBB3lnmhEt+MK8NBm+XdRKir82a8u4DQ3vs64fh9W2uboqpr09X1SKliug3Oof6CNeZ3C1fAxVuunSF6phkv/Nt9kP3VTczaRQ4GFn1DpeV35F3wP354G4YtEa9cyozrgc17s1M+sj/S4YnolVCm6XtIGket+xBuqw3Obx48biHvn9OtKUtDzFl35oRwq1H3W7zvbr1lg7G+lShkPxDpuLUtb9AF87ad1FQyufdYw0q1euyIkNi3/ax/dfwYGxoVUg51Nae6q3gqlFmET0kMkaTZlY2OEnMzGeARxfyfMPCxibk2CmeKvdPzUmqjbmmiUVRxpajXms0+N53L6NHc4V1USDEVfDkNeXnG/mROh3eyBwxlZehbVWMmipeZcfbYQP14sff8B5/6VgGVhKbz5gqIHy1NhzciD9K9DPyzaN2Z4BtI= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 05910d00-15ed-4bc7-b9e4-08df366351fb X-MS-Exchange-CrossTenant-AuthSource: AM9P189MB1666.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 08:53:51.6194 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6PFxiuIak/hRXmWyoxryxP339jVK/c4ip3WBgepePqQ/ulxUUaA/0BDWFsxGDAEqHgnUKDYrqH8oQhJhHJng5HEpzEPaPLMVwe9D+8uvYf0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVP189MB2434 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 30 Oct 2026 08:54:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249006 Backport patch to fix CVE-2026-87864. References: https://nvd.nist.gov/vuln/detail/CVE-2026-87864 Upstream fix: https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797 Tested with ptest: Before: PASSED: 1006, FAILED: 0, SKIPPED: 0, ABORTED: 0 After: PASSED: 1006, FAILED: 0, SKIPPED: 0, ABORTED: 0 Signed-off-by: Adarsh Jagadish Kamini --- .../curl/curl/CVE-2026-87864.patch | 52 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87864.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-87864.patch b/meta/recipes-support/curl/curl/CVE-2026-87864.patch new file mode 100644 index 0000000000..01efc71c4a --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-87864.patch @@ -0,0 +1,52 @@ +From ca1b787c594b2f1b2fc7227b75d2166551aca32d Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 27 Aug 2026 09:47:53 +0200 +Subject: [PATCH] imap: APPEND CRLF fix + +Deny an APPEND operation with CRLF conversion requested as we are unable +to predict the final upload size and APPEND requires us to announce it +before starting the upload. + +The check for unknown sizes had already been there, but the crlf +conversion that renders a known size unknown was not accounted for. + +Closes #22702 + +CVE: CVE-2026-87864 +Upstream-Status: Backport [https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/imap.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/imap.c b/lib/imap.c +index 0546595f89..f37568fb20 100644 +--- a/lib/imap.c ++++ b/lib/imap.c +@@ -884,7 +884,6 @@ static CURLcode imap_perform_append(struct Curl_easy *data, + result = Curl_creader_set_mime(data, postp); + if(result) + return result; +- data->state.infilesize = Curl_creader_client_length(data); + } + else + #endif +@@ -894,9 +893,15 @@ static CURLcode imap_perform_append(struct Curl_easy *data, + return result; + } + +- /* Check we know the size of the upload */ ++ /* Check we know the size of the upload. This takes all readers ++ * into account. Especially crlf conversions which make the size ++ * unpredictable, e.g. -1. */ ++ data->state.infilesize = Curl_creader_total_length(data); + if(data->state.infilesize < 0) { +- failf(data, "Cannot APPEND with unknown input file size"); ++ if(data->set.crlf) ++ failf(data, "Cannot APPEND with CRLF conversion making size unknown"); ++ else ++ failf(data, "Cannot APPEND with unknown input file size"); + return CURLE_UPLOAD_FAILED; + } + diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index c2697d6dd8..ac25f7f156 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -39,6 +39,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-9546-01.patch \ file://CVE-2026-9546-02.patch \ file://CVE-2026-80230.patch \ + file://CVE-2026-87864.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Fri Oct 30 08:54:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 102444 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.56]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7140.1793350450465239353 for ; Fri, 30 Oct 2026 01:54:11 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=du1JGLIj; spf=pass (domain: est.tech, ip: 52.101.83.56, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=s8lmRRIOAYS5KCs+jbz7/ZwcOWvdmaCI3vlg8197t4Vdt0oc0aJQ6Ss/8g9z6uVP8P2FI6eL3VOlA8K3OWL2kwlLIZCUYf8gQjDu8N8GCW4aZzAOU9DJxJ+1cv5YAb6N62/q3Ijzw19t92g77xwegg0FA0dPeCnZV+87Fcnd791z89fr3Z8aP8BMQdsdwr/bojJELnK3ERXdnvV8HwJbxnFOThAXXdxIwXk06ggZ3oELtSjJEUnUYds+RJz5SAM3F1t4NX/xpt0aQLxaq0+euvnmnJ1jQ2xQXeJvcr/k7JFN+38SDBZLzHJkLNfaMyiS/YR0225ZCF0WfzE3S8FX4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bVgVafiLNYAULHHmQk9wTo3pN/rqEuZ1cpwxJFmasiU=; b=uUea297MkK2Mseh/WKY9L0A/6qVZ1IeMNblE+3iaoE+ikTvAy+4jX8TwEgE4s4PbNbKctHj5d9Qh0B0lOEk866Jt9hqljMYBbxM9BbRm38lNfjNQdaZELZ6UJriWeqXDyOLMkH9EdW/9hPMc2jIi43ZNQomVT+4nOnzUzdZLaj7iSC7t6DP0x9kxR8GX3DC3GOZowpmAFGcuQHGDslaa/1QD4py/C135MSuJWdH80RfkV9i0nf4w5HgVAo/awpLRfP6tPaHGwxuBRsrim/WjMWXuEkczVJ2ezup9ca2e27aRK7BBHEAZRWqQRuaGfKv8xZp2NG1sAHe3Fg0fcNwU3g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bVgVafiLNYAULHHmQk9wTo3pN/rqEuZ1cpwxJFmasiU=; b=du1JGLIjnjbal5D039b1FgNg0K1TBbSq2znkiCoCePDFRHUXtRsL4yjPokKLD3CgJX/bg3DIEEIdf9aDb4zQcwtNlp8sWgSy4tYOpDPl9a2pgcealzPbLMZBnM/nQiAhK0HYWELHSBfty9YBH2ya4HYARVvytYTDr6Uw08vfvHXXVrrEV8yoszLGSutau3R2sIdYw/Df2u+QsobrparSWuWF52Y2hOQJ4qogb3F8oVYKhjT8oavU3f08muNfBTPW1Z3u00mEhjKI3sqxwczZc9OpE4gRyNTSxfKhigQo9E42fxZ7k4PYh/TD0kOyE871W1WFenxM8bu5Y/voEd1bgQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM9P189MB1666.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:305::16) by PAVP189MB2434.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:305::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Fri, 30 Oct 2026 08:54:05 +0000 Received: from AM9P189MB1666.EURP189.PROD.OUTLOOK.COM ([fe80::806f:3b74:7216:3e92]) by AM9P189MB1666.EURP189.PROD.OUTLOOK.COM ([fe80::806f:3b74:7216:3e92%6]) with mapi id 15.21.0569.009; Fri, 30 Oct 2026 08:54:05 +0000 From: Adarsh Jagadish Kamini To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 2/2] curl: fix CVE-2026-92388 Date: Fri, 30 Oct 2026 09:54:03 +0100 Message-ID: <20261030085403.13165-1-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: LO4P265CA0222.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:33a::10) To AM9P189MB1666.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:305::16) Return-Path: adarsh.jagadish.kamini@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM9P189MB1666:EE_|PAVP189MB2434:EE_ X-MS-Office365-Filtering-Correlation-Id: 32ce3f53-d617-4acf-0efa-08df36635a13 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|10067099003|260925021911599003|260925022911599003|260925021311599003|11063799006|3023799007|261028144727099003|261009223027099003|261022105027099003|261022113327099003|261022075727099003|261022115727099003|261021121427099003|261021123027099003|261021130227099003|261021133027099003|261021135927099003|56012099006|261026140227099003|261026135527099003|261026121527099003|261026130827099003|12006099003|18002099003; X-Microsoft-Antispam-Message-Info: eafMCqrJB6NTwxZAUBCXPxzIffcSyKyVYUNjjfrg3dhFAMSSVPdpKeVvTfWCHxJ1lviZPa+ltvnYi9JdB5tMHoSk2+BYcMw13FG66kJvqmxC2Oj7hraAV3asw7mg9sTgC1l+5NPeMFKSKlu+njF21mPRtulR587XWl+mJ/TI9sXTAxmd044FuavZH5qM+x4aMzOUrBdIcQNG6Ud/gbM0Pf8M5qQSRcccO6klIXNeoh+1YnKyi3LZdnRa2hThm3QK7ajvNFMBpgvvblcvryVb8m2jPswMfw8IODVflCz3LFdkWG6rW8FdJBI99MIphdgbpLnY+FL3aCCqADUuXudbr+90xGSr7MUX3qE0AfYQEt/gchkK5wLtbUJtQ0dI4Wa7AELQy1i+/L2OGUnbRUZxzw9BjBsPlxOXB515tjfGBR4p3WZEcOkEWArtXvWt1INkjSkVukTRZ0I8k1zc+hp+e5PheXGhvOD0UHayBtBc62FJ7E2t2EF93wUDHSYt64Fyb2MpE9/7WJIPzT2mf8Gzvc3TIVKLiI6kvuJzqAgBPuZWbV3VFn43XCbT+LjuD5izpr50IMeAfGSIkOAmFJSHzYqH/3jBFhCtelYLASVA54w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9P189MB1666.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(10067099003)(260925021911599003)(260925022911599003)(260925021311599003)(11063799006)(3023799007)(261028144727099003)(261009223027099003)(261022105027099003)(261022113327099003)(261022075727099003)(261022115727099003)(261021121427099003)(261021123027099003)(261021130227099003)(261021133027099003)(261021135927099003)(56012099006)(261026140227099003)(261026135527099003)(261026121527099003)(261026130827099003)(12006099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Xt2mN84fcTo7T4UV9y+rTlZiYDYy/i/b4gOo3/Iuz0S0yPazBCSeYOl4KQUu0CBHxbWIxrwv3TxOMnaZGqqLcOopMnxcZA3OsJrnHLgwRksBxhxvOUYMEC2WeQV7Wwiig7EryoP9Aw/98aO3Rmxm+6im87L8iEJ1HSf55FbUYx2oVKcLnBOg3xOa8TRGxXPocDpK5C1fy/dIzlNWpyvfsO/biA7+Gq0mFXBzg2magC3BHMHG4wh9lNNbZ54OY6gpxfxb1iDqFn2Yj4HWDlJ5Y+dK7QzfVvS9wNSOHXaPkLSeC7OBovaL1quOyuCgDkZ2R2VWTyGf2NzGm26ErJX9k1NNzCwjD7y1I0a2yQ+oZcqmfLfPicX3hEpSPaQtEzu+fU21vUdk6UY57gE+ACGwcQZuMwp3j+kkBie+C+85KxECmwp4GPV65Kn7hqvvkeTM/jEvTpYITlymFo6z6F0v1AZAed98/82YBXD8Jcc7LbhyzcjkRYzFkqZXUm84FmPUoFOhBgqveUUCCmlrpOot0Hwa8xDAH8ZFAxwPaRoKaojL0LQehSo1mXVDeQF6h7AsKL5e89lZVfdvdXWVE3U/BqKYBDG/NqQu3kuD/hpUP1les5W6ZhLQqVDuv/NjnPAiBevDMkuZk17ApEzSFP3cUOCHA7mNVmLMdHBqqjubSlowzRXJaLYq0I38u6zxE2CFLF439n/SrP+9DhRiuB0YSBQXEvBgfVG78ewVknCg7wmAir0MfTUQJJkNYP4IFG7UiNzo2cErCy5s9+HjkwmXvVnKGCeShgRtSAfDODEWTOgg6xonMz2sNl0+AL8CsJZIYgGw30+mEXm3C6gv/DUDDhofsf80gcBiN6Y0q6ZEd997GTw3pvr8nw8XiN+75Fp1kfEg3188fD51OeEiiLu7Lm5HfGlUZXu9lx6R4a2Fm25s3Yhxiy9rfJDivhMWXr7MG6jZyjPCcGrb4mHv2nSA7x8RrypOPDY4YT+oFGP3b+DIrpaflO0NwPZz3FArftJWJL2+VnA4SUbBLx2REnFdo9VpF6zi5wWSCBQvt7j6CY1fZx+2MykWuNDyfYOBPQ+H1WEGyjSWvhL8d0z0/DCPpyGqDg4JWjwWCS3cfLqM2xMwlpnDYqjET9nRj2ON0B8pz6mXvYD+9tZ7Dzk4Gz6fa+yerqGcqjRtPkuBcPwI1c9vb8JnjJMTwxNu+rpQdU+RzY7NDyzLz1c/tGeFmZPTgagafqqXymBe5QvKWoN2XKOYdmGczwDMMdjPaY7IFKq6uAWw9jKSqn6DnixkBZt1SW8CusUf2LZxLitB56rID5MIWLWIQX5I/wOXvX5e/tFItTosqPVTsvfmbhsc0sWozL/NHfAJ6mbILb4gonZmLcr6nUdD8wvXJlSDTBmUqSOS8r7Q0axlmjEo3+2oVBQNzwTvkQnvpzYNvzxwbioAxH+XGUmsJI7waJuIXjtr5bELdPRFkxz86WrfZlTkgZyx/OIoUUnvuB1RUCYgVFTi7BeSJpFIAhD2eZbzAPeLkHqzcVpwplG9Pv8L+jDcFVbBPBF/p9mPdJ6XLTEspOp8YrtxotPzouGaDUzzLqUo0P7G8E3zimP54B0keFfLbv28z0utr+j/ahoRNxHllIBMc3dm5zThtZ6lTHV9Zrc0YwtVmF3QVRmdr3O8qJ+459LJ8lJCJQ7jG9WN/pVZKPeVyPDwunF23GvzSPqoA//2bJDWibgTmmJXt8eRa4S5lVYGcmLITAuckbokniEdEdzWrjE= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 32ce3f53-d617-4acf-0efa-08df36635a13 X-MS-Exchange-CrossTenant-AuthSource: AM9P189MB1666.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 08:54:05.3876 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jp+jfwUHoqTtVhMidxy2dPmDXLj+wzkOAYf7n/UAs2ReGbmQowNi5bQreiRvk0ZptEik2mHqL/VZa9kMo1vsIHWjGDvX2+r0DLY/a/C7UrA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVP189MB2434 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 30 Oct 2026 08:54:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249007 Backport patch to fix CVE-2026-92388. References: https://nvd.nist.gov/vuln/detail/CVE-2026-92388 Upstream fix: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212 https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9 Tested with ptest: Before: PASSED: 1006, FAILED: 0, SKIPPED: 0, ABORTED: 0 After: PASSED: 1006, FAILED: 0, SKIPPED: 0, ABORTED: 0 Signed-off-by: Adarsh Jagadish Kamini --- .../curl/curl/CVE-2026-92388-1.patch | 142 ++++++++++++++++++ .../curl/curl/CVE-2026-92388-2.patch | 31 ++++ meta/recipes-support/curl/curl_8.19.0.bb | 2 + 3 files changed, 175 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-2.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-92388-1.patch b/meta/recipes-support/curl/curl/CVE-2026-92388-1.patch new file mode 100644 index 0000000000..5dfd42c160 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-92388-1.patch @@ -0,0 +1,142 @@ +From 056e37ce04bd4d599dd014d305963d2194e30026 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 16 Sep 2026 15:17:37 +0200 +Subject: [PATCH] ftplistparser: no more overwriting set.write_func + +The entries in the 'set' struct should remain as set by the application. + +Closes #22969 + +Conflicts Resolved: + +lib/ftp-int.h (1 conflict): +- File does not exist in this branch; struct ftp_wc with its backup + member lives in lib/ftp.h instead. Applied the same removal of the + backup member to lib/ftp.h. + +Assisted-by: kiro:claude-sonnet-5 + +CVE: CVE-2026-92388 +Upstream-Status: Backport [https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212b90b35a93559163e] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/cw-out.c | 10 ++++++++-- + lib/ftp.c | 13 ------------- + lib/ftp.h | 5 ----- + lib/ftplistparser.c | 10 ++++++++++ + lib/ftplistparser.h | 5 +++++ + 5 files changed, 23 insertions(+), 20 deletions(-) + +diff --git a/lib/cw-out.c b/lib/cw-out.c +index 554c32e84e..2500ea8ab3 100644 +--- a/lib/cw-out.c ++++ b/lib/cw-out.c +@@ -148,8 +148,14 @@ static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype, + switch(otype) { + case CW_OUT_BODY: + case CW_OUT_BODY_0LEN: +- *pwcb = data->set.fwrite_func; +- *pwcb_data = data->set.out; ++ if(Curl_ftp_listmode(data)) { ++ *pwcb = Curl_ftp_parselist; ++ *pwcb_data = data; ++ } ++ else { ++ *pwcb = data->set.fwrite_func; ++ *pwcb_data = data->set.out; ++ } + *pmax_write = CURL_MAX_WRITE_SIZE; + /* if we ever want buffering of BODY output, we can set `min_write` + * the preferred size. The default should always be to pass data +diff --git a/lib/ftp.c b/lib/ftp.c +index 6047759e78..6b13fb6629 100644 +--- a/lib/ftp.c ++++ b/lib/ftp.c +@@ -3988,15 +3988,6 @@ static CURLcode init_wc_data(struct Curl_easy *data, + goto fail; + } + +- /* backup old write_function */ +- ftpwc->backup.write_function = data->set.fwrite_func; +- /* parsing write function */ +- data->set.fwrite_func = Curl_ftp_parselist; +- /* backup old file descriptor */ +- ftpwc->backup.file_descriptor = data->set.out; +- /* let the writefunc callback know the transfer */ +- data->set.out = data; +- + infof(data, "Wildcard - Parsing started"); + return CURLE_OK; + +@@ -4032,10 +4023,6 @@ static CURLcode wc_statemach(struct Curl_easy *data, + /* In this state is LIST response successfully parsed, so lets restore + previous WRITEFUNCTION callback and WRITEDATA pointer */ + struct ftp_wc *ftpwc = wildcard->ftpwc; +- data->set.fwrite_func = ftpwc->backup.write_function; +- data->set.out = ftpwc->backup.file_descriptor; +- ftpwc->backup.write_function = ZERO_NULL; +- ftpwc->backup.file_descriptor = NULL; + wildcard->state = CURLWC_DOWNLOADING; + + if(Curl_ftp_parselist_geterror(ftpwc->parser)) { +diff --git a/lib/ftp.h b/lib/ftp.h +index 20b360033e..b1d3706db2 100644 +--- a/lib/ftp.h ++++ b/lib/ftp.h +@@ -85,11 +85,6 @@ struct ftp_parselist_data; /* defined later in ftplistparser.c */ + + struct ftp_wc { + struct ftp_parselist_data *parser; +- +- struct { +- curl_write_callback write_function; +- FILE *file_descriptor; +- } backup; + }; + + typedef enum { +diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c +index f82895d57a..9c7ad6e9a0 100644 +--- a/lib/ftplistparser.c ++++ b/lib/ftplistparser.c +@@ -1010,6 +1010,16 @@ static CURLcode parse_winnt(struct Curl_easy *data, + return CURLE_OK; + } + ++/* returns TRUE if in wildcard listing mode */ ++bool Curl_ftp_listmode(struct Curl_easy *data) ++{ ++ if(data->state.wildcardmatch) { ++ struct WildcardData * const wildcard = data->wildcard; ++ return wildcard && (wildcard->state <= CURLWC_MATCHING); ++ } ++ return FALSE; ++} ++ + size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, + void *connptr) + { +diff --git a/lib/ftplistparser.h b/lib/ftplistparser.h +index 5d7aa492ba..942e102894 100644 +--- a/lib/ftplistparser.h ++++ b/lib/ftplistparser.h +@@ -27,6 +27,9 @@ + + #ifndef CURL_DISABLE_FTP + ++/* returns TRUE if in wildcard listing mode */ ++bool Curl_ftp_listmode(struct Curl_easy *data); ++ + /* WRITEFUNCTION callback for parsing LIST responses */ + size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, + void *connptr); +@@ -71,6 +74,8 @@ void Curl_wildcard_dtor(struct WildcardData **wcp); + struct Curl_easy; + + #else /* CURL_DISABLE_FTP */ ++#define Curl_ftp_listmode(x) FALSE ++#define Curl_ftp_parselist ZERO_NULL + #define Curl_wildcard_dtor(x) + #endif /* !CURL_DISABLE_FTP */ + diff --git a/meta/recipes-support/curl/curl/CVE-2026-92388-2.patch b/meta/recipes-support/curl/curl/CVE-2026-92388-2.patch new file mode 100644 index 0000000000..80381035ff --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-92388-2.patch @@ -0,0 +1,31 @@ +From 5f8207e667910351d7d5883910eac80f5b215b12 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Thu, 17 Sep 2026 14:32:52 +0200 +Subject: [PATCH] ftplistparser: only use the list parser in CURLWC_MATCHING + state + +Follow-up to ba8f8a7f27a5c5e1 + +Closes #22985 + +CVE: CVE-2026-92388 +Upstream-Status: Backport [https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc992e77b5f665d4] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/ftplistparser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c +index 9c7ad6e9a0..91b24251c9 100644 +--- a/lib/ftplistparser.c ++++ b/lib/ftplistparser.c +@@ -1015,7 +1015,7 @@ bool Curl_ftp_listmode(struct Curl_easy *data) + { + if(data->state.wildcardmatch) { + struct WildcardData * const wildcard = data->wildcard; +- return wildcard && (wildcard->state <= CURLWC_MATCHING); ++ return wildcard && (wildcard->state == CURLWC_MATCHING); + } + return FALSE; + } diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index ac25f7f156..850ca7dc3f 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -40,6 +40,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-9546-02.patch \ file://CVE-2026-80230.patch \ file://CVE-2026-87864.patch \ + file://CVE-2026-92388-1.patch \ + file://CVE-2026-92388-2.patch \ " SRC_URI:append:class-nativesdk = " \