From patchwork Wed Nov 4 07:36:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102858 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4448.1793777792286109070 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=c+jlO8JC; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6249; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Q4eAqSWEboS8IFNTs4CJbLxD7qCTmLiWtAM4GLFJLOo=; b=c+jlO8JCwDBTe1fhhKp7uIg2lctGwrxvdGLkcRoMLTf8fLsbza3TCtKS Pz0F3YDpZAx81IEw6LfNcge6qpFjUc8hIVuBX/H30JOQIguY/9P4i0Ye4 1gP3tuUO5RYLzK1EKKjLZiurunQ+QuyqpcmyazjJRAPmw7WDkCIDBj840 1lqbccB7ZH0bXyFNkdv7K4ThUgbGv+ysBW5oH6Zb/UUcyqS/QbwwWzk35 LzkWA8/E0G44SSJHAx14pH6lmNwurNR/OrdUwG19XfGIjerZTzoYY7AMI CNT1WXb4lzUmoRuUx56YFcLSjKZDwntkfvBVSLfEgMxT4NIUNWgFYt+O3 g==; X-CSE-ConnectionGUID: GzNA8Mc6RE2nOhHWm6Hi1w== X-CSE-MsgGUID: aH28ZiBXQtSmUsVQELKrdA== X-IPAS-Result: A0AaAADZ3+pq/4r/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWQOeIIF+DwEBAQ9EDQQBAYUFAo4cAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBrl6GzeBeTOBAYMpAT8CAkABUNszAQsUAYE4AYU/iCNdGAGEfScbG4FyhH6BBYFcAgGBR4ZeBIIigQyBWh5ljBgCiEJIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGYLGgVhCAINDHQ5EDAeJC8FHCZAGwoUGA1IESw3FRkEPm4Hki2CWTcBYRoJAQkBKQEBBIFkGjsLHpM3j2SCIYE1n1wKKIN4jCSVOhozhVulFguYfY4KlTcyG02EaYFoPIFZcBU7gmcJFjQZD44uCwuBeIFohkDIGyYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:YnbyO6JOYxi/0c7gFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENShGADy 2BLX22BO/+KZmTyftAgPt+xoEwCv5PWmoIwSAMd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmYvajh8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1BHmcfbagTpNxaW2dp9 dwnLW4tb0mc0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2N0Sojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeSxaoaNI4DRLSlTtk+4/ DL0/k7JOw0hMeGE9wOo1lG2isaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1/fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:shkGJajqcmwxQJyBxt/qYl6vEHBQXvgji2hC6mlwRA09TyVXra +TdZMgpHjJYVkqOU3I9ersBEDEewK/yXcX2/h0AV7dZmnbUQKTRekIh7cKgQeQfhEWndQy6U 4PScRD4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGsddB8MTMHfiLqWwLzM2fKYEKA == X-Talos-CUID: 9a23:H19oWGvVlfRF9IfdYM2fHgQ56IsKYFv0nFLbfXWVU2BOSJ2qTAGw+fp7xp8= X-Talos-MUID: 9a23:/iXLNwqreTOzUwolwgcezzhCbpda4o6eMVw2lKgdhfCpEQ9qNx7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="544240143" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 1E286180001F2; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id B9FF5CBF201; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 01/12] curl: fix CVE-2026-86414 Date: Tue, 3 Nov 2026 23:36:16 -0800 Message-Id: <20261104073627.302002-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249335 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Reject origin-authentication challenges during HTTP CONNECT while preserving 407 proxy authentication. Cover both the HTTP/1 and HTTP/2 tunnel implementations in curl 8.19.0. Retain upstream test2173 with this version's receive-error result. [1] https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166dff211f930d52 [2] https://curl.se/docs/CVE-2026-86414.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-86414.patch | 155 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 156 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86414.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-86414.patch b/meta/recipes-support/curl/curl/CVE-2026-86414.patch new file mode 100644 index 00000000000..13bf17dcc1b --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-86414.patch @@ -0,0 +1,155 @@ +From 2956af6c7451029fb12c12f8166dff211f930d52 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 3 Sep 2026 17:54:45 +0200 +Subject: [PATCH] HTTP-CONNECT: do not react to 401 responses + +When a proxy answers with a 401 on a CONNECT, ignore Authentication +headers and fail the connect. + +Add test2173 to verify. + +Closes #22817 + +CVE: CVE-2026-86414 +Upstream-Status: Backport [https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166dff211f930d52] + +Backport Changes: +- Omitted the on_resp_header_udp() hunk: curl 8.19.0 has no separate + CONNECT-UDP response handler. +- Applied the Curl_http_proxy_inspect_tunnel_response() change to + inspect_response() in lib/cf-h2-proxy.c, where curl 8.19.0 handles + HTTP/2 CONNECT responses. It uses ts->resp from the tunnel state + instead of upstream's resp argument. +- Registered test2173 in the older compact TESTCASES list without + upstream's extra blank continuation line. +- Changed test2173's expected error from 7 (CURLE_COULDNT_CONNECT) + to 56 (CURLE_RECV_ERROR). curl 8.19.0 reports this rejected CONNECT + as a receive error; upstream reports it as a connection failure. + +(cherry picked from commit 2956af6c7451029fb12c12f8166dff211f930d52) +Signed-off-by: Darsh Kelaiya +--- + lib/cf-h1-proxy.c | 3 +-- + lib/cf-h2-proxy.c | 5 +--- + tests/data/Makefile.am | 1 + + tests/data/test2173 | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 71 insertions(+), 6 deletions(-) + +diff --git a/lib/cf-h1-proxy.c b/lib/cf-h1-proxy.c +index 69e050b..fc68957 100644 +--- a/lib/cf-h1-proxy.c ++++ b/lib/cf-h1-proxy.c +@@ -277,8 +277,7 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf, + struct SingleRequest *k = &data->req; + (void)cf; + +- if((checkprefix("WWW-Authenticate:", header) && (401 == k->httpcode)) || +- (checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode))) { ++ if(checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode)) { + + bool proxy = (k->httpcode == 407); + char *auth = Curl_copy_header_value(header); +diff --git a/lib/cf-h2-proxy.c b/lib/cf-h2-proxy.c +index 4275e1e..719f9b8 100644 +--- a/lib/cf-h2-proxy.c ++++ b/lib/cf-h2-proxy.c +@@ -788,10 +788,7 @@ static CURLcode inspect_response(struct Curl_cfilter *cf, + return CURLE_OK; + } + +- if(ts->resp->status == 401) { +- auth_reply = Curl_dynhds_cget(&ts->resp->headers, "WWW-Authenticate"); +- } +- else if(ts->resp->status == 407) { ++ if(ts->resp->status == 407) { + auth_reply = Curl_dynhds_cget(&ts->resp->headers, "Proxy-Authenticate"); + } + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index e157596..95a8fe4 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -257,6 +257,7 @@ test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \ + test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \ + test2088 test2089 test2090 test2091 \ + test2100 test2101 test2102 test2103 test2104 \ ++test2173 \ + \ + test2200 test2201 test2202 test2203 test2204 test2205 \ + \ +diff --git a/tests/data/test2173 b/tests/data/test2173 +new file mode 100644 +index 0000000..fb85f40 +--- /dev/null ++++ b/tests/data/test2173 +@@ -0,0 +1,68 @@ ++ ++ ++ ++ ++HTTP ++HTTP GET ++HTTP CONNECT ++HTTP Basic auth ++proxytunnel ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 200 OK ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: test-server/fake swsclose ++Content-Type: text/html ++Funny-head: yesyes ++Content-Length: 9 ++ ++contents ++ ++ ++HTTP/1.1 401 Tricking You ++WWW-Authenticate: Basic ++ ++ ++ ++HTTP/1.1 401 Tricking You ++WWW-Authenticate: Basic ++ ++ ++ ++ ++# Client-side ++ ++ ++http ++http-proxy ++ ++ ++HTTP over proxy-tunnel with site wrong 401 response ++ ++ ++http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT --user 'iam:my:;self' --anyauth ++ ++ ++proxy ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1 ++Host: test.%TESTNUMBER:%HTTPPORT ++User-Agent: curl/%VERSION ++Proxy-Connection: Keep-Alive ++ ++ ++ ++ ++ ++56 ++ ++ ++ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index adee64a0188..9b28b9d7c98 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -48,6 +48,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-82208.patch \ file://CVE-2026-80230.patch \ file://CVE-2026-80231.patch \ + file://CVE-2026-86414.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102859 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4449.1793777792288252086 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KdPN9mtw; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4075; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=yw+weWoz43mjezmGSJXO2/jK5SrsfGkuNxHW2U11OXk=; b=KdPN9mtww7Gln3q6rPqtPAJLz8hQWOOGvxPSo0FM8CV2M2PuHRANMF+S kz/UcRgo8XVORzQvZoQQJPc+0rkAZ5l2b0MRQtTzaCX8OyYD+4xfMPyxf iAekWZzS3JUSKmNpp+h4nWUl3y/Fn/0ErebpAg+bzZVTmmQ99CZmazJLz 6Z972rsX5W+OAAeqjTL1H2FyIsYLtWDrLicdY0xeOGHHB8T40bZE4cUp6 ZvR56XhtLO7jRa2ePmY636Py+KPrApsRCeFagRNdT/ML3uJH5io3TyM4n iR7X6brl5Cq2mIw5TCUdTmueuByjRQGeDFl4e2bC+1ZHMpqcQzfJW7T17 w==; X-CSE-ConnectionGUID: +KkSoW2DQ7+ACcm/zm0zRg== X-CSE-MsgGUID: fxD0WNZITE+dbgRQGOrZlQ== X-IPAS-Result: A0BIAgDZ3+pq/4//Ja1aHgEBCxIMggULgld1YENJlksDniAUgWoPAQEBD0QNBAEBhQUCjhwCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxEGuXobN4F5M4EBgykBPwICQAFQ2zMBCxQBgTiFQIgjXRgBhH0nGxuBcoEVg2mBBYFcAgGBRoZfBIIigQyBWh6MfQKIQkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZgsaBWEIAg0MdDkQMB4kLwUcJkAbChQYDUgRLDcVGQQ+bgeSLYMKB1kILQEpAQGCPSmSe5JBoREKKIN4jCSVOhozqnELmH2OCpYETYRpgWg8gVlwFYMiCRY0GQ+OOYNrhkDIGyYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:WRHdn6AFwTtiUhVW/3jiw5YqxClBgxIJ4kV8jS/XYbTApDgjg2YFy GJMXTyFbvaNZjOmf4x3bomyp0MEsMLWz4RiOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9gGYuWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEgNZtN0YJZ6EhpaVeKmpLs u4dcCI3YUXW7w626OrTpuhEnM8vKozveYgYoHwllW+fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY0BPjDS0Un1lM/BJEzmO6pl3DXeDxDo1XTrq0yi4TW5FEti+Cya4aLJrRmQ+1bjmrAm UT03ljUQR0QO+am5h2fwHaV07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KKpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:SPoyD63xcoaAg6hfFcc5jwqjBJAkLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmtBFeb7NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPGdXg2UK1XYANu5deXcGPTV7OQ== X-Talos-CUID: 9a23:t5Msc2Cyq682gbv6E2pE93UTJZoJSyKe5VzbJgiqDD57crLAHA== X-Talos-MUID: 9a23:el513Qvafc5Ob4hhDc2niiFObPhO0YWSJQMBm5o8guajLx50AmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543073464" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 21683180003AC; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id BCB0DCBF202; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 02/12] curl: fix CVE-2026-86409 Date: Tue, 3 Nov 2026 23:36:17 -0800 Message-Id: <20261104073627.302002-3-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249336 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Clear CURLAUTH_AWS_SIGV4 when CURLOPT_AWS_SIGV4 is reset to NULL. Retain the upstream handle-reuse regression in test1978, using the existing test_setopt() helper. [1] https://github.com/curl/curl/commit/c3c70440e8d9938c0bb732595751e8aebc614f24 [2] https://curl.se/docs/CVE-2026-86409.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-86409.patch | 88 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 89 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86409.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-86409.patch b/meta/recipes-support/curl/curl/CVE-2026-86409.patch new file mode 100644 index 00000000000..bdfee79dc6a --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-86409.patch @@ -0,0 +1,88 @@ +From 534252a345be58d6d1a79eee697244f27524b7d2 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Wed, 26 Aug 2026 09:41:03 +0200 +Subject: [PATCH] setopt: make NULL `CURLOPT_AWS_SIGV4` disable aws-sigv4 auth + +Disable `CURLAUTH_AWS_SIGV4` when `CURLOPT_AWS_SIGV4` is set to NULL. +Syncing behavior with `CURLAUTH_HTTPSIG`. + +Reported-by: Stanislav Fort + +Closes #22681 + +CVE: CVE-2026-86409 +Upstream-Status: Backport [https://github.com/curl/curl/commit/c3c70440e8d9938c0bb732595751e8aebc614f24] + +Backport Changes: +- Use test_setopt() in lib1978.c instead of easy_setopt(), matching + the curl 8.19.0 test harness. + +(cherry picked from commit c3c70440e8d9938c0bb732595751e8aebc614f24) +Signed-off-by: Darsh Kelaiya +--- + lib/setopt.c | 2 ++ + tests/data/test1978 | 19 +++++++++++++++++++ + tests/libtest/lib1978.c | 5 +++++ + 3 files changed, 26 insertions(+) + +diff --git a/lib/setopt.c b/lib/setopt.c +index 3603912..ae77ae8 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -1992,6 +1992,8 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option, + */ + if(s->str[STRING_AWS_SIGV4]) + s->httpauth = CURLAUTH_AWS_SIGV4; ++ else ++ s->httpauth &= ~(uint32_t)CURLAUTH_AWS_SIGV4; + break; + #endif + case CURLOPT_REFERER: +diff --git a/tests/data/test1978 b/tests/data/test1978 +index 3ad4c67..8b6e6af 100644 +--- a/tests/data/test1978 ++++ b/tests/data/test1978 +@@ -69,6 +69,25 @@ header-no-value: + header-some-no-value: + header-some-no-value: value + ++PUT /%TESTNUMBER/testapi/test HTTP/1.1 ++Host: 127.0.0.1:9000 ++x-amz-meta-test: test2 ++some-other-header: value ++x-amz-meta-test: test1 ++duplicate-header: duplicate ++x-amz-meta-test: test3 ++X-amz-meta-test2: test2 ++x-amz-meta-blah: blah ++x-Amz-meta-test2: test1 ++x-amz-Meta-test2: test3 ++curr-header-no-colon: value ++next-header-no-colon: value ++duplicate-header: duplicate ++header-no-value: ++header-no-value: ++header-some-no-value: ++header-some-no-value: value ++ + + + +diff --git a/tests/libtest/lib1978.c b/tests/libtest/lib1978.c +index 4f3ef11..d3f5c7d 100644 +--- a/tests/libtest/lib1978.c ++++ b/tests/libtest/lib1978.c +@@ -91,6 +91,11 @@ static CURLcode test_lib1978(const char *URL) + test_setopt(curl, CURLOPT_CONNECT_TO, connect_to); + + result = curl_easy_perform(curl); ++ if(result) ++ goto test_cleanup; ++ ++ test_setopt(curl, CURLOPT_AWS_SIGV4, NULL); ++ result = curl_easy_perform(curl); + + test_cleanup: + +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 9b28b9d7c98..be140ccc485 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -49,6 +49,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80230.patch \ file://CVE-2026-80231.patch \ file://CVE-2026-86414.patch \ + file://CVE-2026-86409.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102856 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4377.1793777792143251242 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=JhJsleK4; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5602; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=qBt6PjDtMGyLCQPVmI/HEGM9RMhYQBlsrR4it2HgFS0=; b=JhJsleK4um7EIZPDDsrH8z3MvYZci9rb03ZwevVcFKZJB6yEvOSFTsGY vF/fj/guU26k/0eMazsL1Rz+cNxtVs+I1zGz0ez/EMuf2m6a/t/Uul+IE 3UllyQG4b6yKElGBGgWXrN9RqyvWT6gwEjqZ7gcyD626lA2zolMM78p5J moVbC13YoDz01/zSXUdZmsJB+FrPO2+eb9LLMEiO865/jiQKpTqoAOrlW kE3tEhG2zEVypDfc4rjZAOcMO1iAuI2qZEiEdYTsLQXlKIicqHRCFmuM5 i+o9wOZbXrvKinvHmH/MISyXqe+Vr74WhOB8tKpAc8MJPt9ouee5VYrWJ w==; X-CSE-ConnectionGUID: kPC6lIhuTrmCJXpErrCS4Q== X-CSE-MsgGUID: loFWbvXdQJ6p2YiS7UM2mg== X-IPAS-Result: A0AnAADZ3+pq/4v/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOeIBSBag8BAQEPRA0EAQGFBQKOHAImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyARgBLRAcAwECLysjCBmDAgGCdAMRBrl6GzeCLIEBgykBPwICQAFQ2zMBCxQBgTgBhT+II10YAYR9JxsbgXKBFYNpgQWBAFwCAYFFAoZeBIIigQyBWh5ljBgCiEJIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGYLGgVhCAINDHQ5EDAeJC8FHCZAGwoUGA1IESw3FRkEPm4Hki2DEVkIIAQJASkBAYF9BTspoxuCIaERCiiDeIwklToaM4VbpRYLmH2OCpZRhGmBaDyBWXAVO4JnCRY0GQ+OOYIDgWiGQMgbJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:T4zoX6k6WsFVLqW3XgUqejvo5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIaC2rXOayLMDP0fopxbtyw9x5Uu5DXmtIwHFNo+CFgE1tH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs/nb8nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FY4g0bhzIGFTy eYdAxI9dj2ZncmNnIvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaz/7C7pm9AusrnX8fjlRqUOcjaE2+GPUigd21dABNfKIII3VHZ0FwhjwS mTu+2PXPRsEBNCm62SdqEOtvbDyuHn+V9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:1couz6/bIP0Zvkb8P1huk+D6I+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 4ZSdkcNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYKcemvAJsQlzuQzW2gYzRLeDU= X-Talos-CUID: 9a23:UhhmfGD306LHNtX6Eypf3xAQO8A4TmfY51XgO2KiE01SFITAHA== X-Talos-MUID: 9a23:qdDrlQ8i63tuHVdVCJnuh+OQf8NvzZukFnABqLdYo5O1NBcvBhLHiTviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="529700846" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 2396918000353; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id C10C8CBF203; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 03/12] curl: fix CVE-2026-87862 Date: Tue, 3 Nov 2026 23:36:18 -0800 Message-Id: <20261104073627.302002-4-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249333 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Use an exact-host lookup when importing HSTS entries so a parent policy cannot suppress a child policy with a later expiry. Adapt the fix to hsts_add()/Curl_hsts() and register upstream test3109. [1] https://github.com/curl/curl/commit/a1614c3bcf1593eb524b37792124357d97a5429c [2] https://curl.se/docs/CVE-2026-87862.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-87862.patch | 147 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 148 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87862.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-87862.patch b/meta/recipes-support/curl/curl/CVE-2026-87862.patch new file mode 100644 index 00000000000..313b767ea86 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-87862.patch @@ -0,0 +1,147 @@ +From a1614c3bcf1593eb524b37792124357d97a5429c Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 8 Sep 2026 09:07:13 +0200 +Subject: [PATCH] hsts: on load, only remove exact duplicates + +Added test3109: verify HSTS when parent+subdomain expires before child + +Reported-by: Stanislav Fort +Closes #22869 + +CVE: CVE-2026-87862 +Upstream-Status: Backport [https://github.com/curl/curl/commit/a1614c3bcf1593eb524b37792124357d97a5429c] + +Backport Changes: +- Apply the exact-host lookup in curl 8.19.0's hsts_add() using + Curl_hsts(); upstream uses hsts_add_host_expire() and hsts_check(). +- Register test3109 in the older grouped tests/data/Makefile.am list. + +(cherry picked from commit a1614c3bcf1593eb524b37792124357d97a5429c) +Signed-off-by: Darsh Kelaiya +--- + lib/hsts.c | 2 +- + tests/data/Makefile.am | 2 +- + tests/data/test3109 | 86 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 88 insertions(+), 2 deletions(-) + create mode 100644 tests/data/test3109 + +diff --git a/lib/hsts.c b/lib/hsts.c +index 03f51f8..5ad5bd4 100644 +--- a/lib/hsts.c ++++ b/lib/hsts.c +@@ -423,7 +423,7 @@ static CURLcode hsts_add(struct hsts *h, const char *line) + subdomain = TRUE; + } + /* only add it if not already present */ +- e = Curl_hsts(h, curlx_str(&host), curlx_strlen(&host), subdomain); ++ e = Curl_hsts(h, curlx_str(&host), curlx_strlen(&host), FALSE); + if(!e) + result = hsts_create(h, curlx_str(&host), curlx_strlen(&host), + subdomain, expires); +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index e157596..f39d613 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -279,7 +279,7 @@ test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \ + test3024 test3025 test3026 test3027 test3028 test3029 test3030 test3031 \ + test3032 test3033 test3034 test3035 \ + \ +-test3100 test3101 test3102 test3103 test3104 test3105 \ ++test3100 test3101 test3102 test3103 test3104 test3105 test3109 \ + \ + test3200 test3201 test3202 test3203 test3204 test3205 test3206 test3207 test3208 \ + test3209 test3210 test3211 test3212 test3213 test3214 test3215 test3216 \ +diff --git a/tests/data/test3109 b/tests/data/test3109 +new file mode 100644 +index 0000000..d256a40 +--- /dev/null ++++ b/tests/data/test3109 +@@ -0,0 +1,86 @@ ++ ++ ++ ++ ++HTTP ++HTTP proxy ++HSTS ++ ++ ++ ++ ++ ++# we use this as response to a CONNECT ++ ++HTTP/1.1 200 OK ++Server: fake ++ ++ ++ ++ ++HTTP/1.1 200 OK ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Type: text/html ++Content-Length: 0 ++ ++ ++ ++ ++ ++ ++http ++http-proxy ++https ++ ++ ++HSTS ++proxy ++https ++Debug ++ ++ ++# October 1, 2024 ++ ++CURL_HSTS_HTTP=yes ++CURL_TIME=1727733600 ++ ++ ++# the child name has a later expiury than the parent so it must not be removed ++# before ++ ++.example.test "20241010 09:42:27" ++.child.example.test "20251010 09:42:27" ++ ++ ++ ++HSTS parent expires before child ++ ++ ++-x http://%HOSTIP:%PROXYPORT http://child.example.test:%HTTPSPORT/%TESTNUMBER --hsts %LOGDIR/input%TESTNUMBER --insecure ++ ++ ++test-duphandle ++ ++ ++ ++ ++ ++ ++HTTP/1.1 200 OK%CR ++Server: fake%CR ++%CR ++HTTP/1.1 200 OK ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Type: text/html ++Content-Length: 0 ++ ++ ++ ++ ++# Your HSTS cache. https://curl.se/docs/hsts.html ++# This file was generated by libcurl! Edit at your own risk. ++.example.test "20241010 09:42:27" ++.child.example.test "20251010 09:42:27" ++ ++ ++ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index be140ccc485..3828c26f507 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -50,6 +50,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80231.patch \ file://CVE-2026-86414.patch \ file://CVE-2026-86409.patch \ + file://CVE-2026-87862.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102864 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4378.1793777792173650437 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=D3ZFzJPM; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2768; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=dUTw7FyjsVjQJoBryVdem7RZOSM3KvNSpXSvWMlSasg=; b=D3ZFzJPMzuts+TPIPOIdRstIbIBi5qHlg4ro3deJ4gf1nMOphYV9UINM oT5+P52sXl9F0JyvdTBSEnSaKjYeCBAACN9Ox6P2fcT/VcVlOjT2j35hG eu0Yn6i3I8zs9bb445QZSdzxNpdIkBJjYGdXO6ADQYtPHHDPXmVbNJLuf HnohwVNOMv4ofpa4uWIEZ5wJi7uil7e2EXHRjb9pwW0eqm4MpGWznIsCL q5g6Ubto7xH8BUTh7BIrKQ5WQVVabQt1P6HAB5FRCdaFaCSW/7DmNS5Do 5OARXLh8ocSxOYRT2326OATT9vIf03Vch4QwXuo1pAW+uwwkmkWjboKME g==; X-CSE-ConnectionGUID: yktsZ9nnS4ygJSHwKeOp+w== X-CSE-MsgGUID: sPMvuwuhSTWfqtqBVdo9AA== X-IPAS-Result: A0BIAgDZ3+pq/5X/Ja1aglmCV3VgQ0mWSwOeIIF+DwEBAQ9EDQQBAYUFAo4cAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBrl6GzeBeTOBAYMpAT8CAkABUNszAQsUAYE4hUCII10YAYR9JxsbgXKEfoEFgVwCAYE3dYV5BIIigQyBWh6MfQKIQkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZgsaBWEIAg0MdDkQMB4kLwUcJkAbChQYDUgRLDcVGQQ+bgeSLYMRYS0BKQKCPZMnkj6hEQoog3iMJJU6GjOqcQuYfY4KllGEaYFoPIFZcBWDIgkWNBkPjjmDa4ZAyBsmMgIJMgEBBwIHDgMLgWiQAYF9AQE IronPort-Data: A9a23:wOe6sajpTkWdiYd34tSnY6qAX161MREKZh0ujC45NGQN5FlHY01je htvWm/Va6zZMDP0edh+Pou080oG7MODy9QySQE/+yBmRSJjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvrY8EkHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUJ+fpsMzBI8 8dEOT8vVTCcpO+R2PGkH7wEasQLdKEHPasFsX1miDWcBvE8TNWaGePB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgZ/5JEWxI9EglHzcDBcoVOErII84nPYy0p6172F3N/9J4DRHp4JzxfIz o7A13/BJw8HK8Gf8ga6/Guwn8XxkSSqcatHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBF2QHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn2891te5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:OScUaKNLFaV3u8BcTuOjsMiBIKoaSvp037Dk7S9MoHtuA6ulfq +V/cjzuSWYtN9VYgBDpTniAtjlfZqjz/5ICOAqVN/INjUO+lHYSb2KhrGN/9SPIUHDH5ZmpM RdWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IHjJ7MHd3ATV0mmhD0JczqmLg== X-Talos-CUID: 9a23:Z/uM2GrRQUxniiaiVhDQAtvmUdEmbmbvnXHWGBOpBkRSaKK2RHiIu7wxxg== X-Talos-MUID: 9a23:VabOPgQyi+7Jxvo7RXT3vBR8Kdh145+SN04UjYwshcWDZAVZbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543334998" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 261FB180001C1; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id C6D48CBF204; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 04/12] curl: fix CVE-2026-92387 Date: Tue, 3 Nov 2026 23:36:19 -0800 Message-Id: <20261104073627.302002-5-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249331 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Limit each Curl_pp_readresp() call to ten new socket reads so an unfinished response cannot monopolize the multi interface. [1] https://github.com/curl/curl/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db [2] https://curl.se/docs/CVE-2026-92387.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-92387.patch | 43 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92387.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-92387.patch b/meta/recipes-support/curl/curl/CVE-2026-92387.patch new file mode 100644 index 00000000000..d997aa478a3 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-92387.patch @@ -0,0 +1,43 @@ +From 753735af87f5c30cb6f60a70342f8bc4bc5fd5db Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Sun, 13 Sep 2026 16:12:01 +0200 +Subject: [PATCH] pingpong: add a max loop counter for Curl_pp_readresp + +To make sure it cannot get stuck in this function. + +Reported-by: Joshua Rogers +Closes #22932 + +CVE: CVE-2026-92387 +Upstream-Status: Backport [https://github.com/curl/curl/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db] + +(cherry picked from commit 753735af87f5c30cb6f60a70342f8bc4bc5fd5db) +Signed-off-by: Darsh Kelaiya +--- + lib/pingpong.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/pingpong.c b/lib/pingpong.c +index 4ede0a5..b32651a 100644 +--- a/lib/pingpong.c ++++ b/lib/pingpong.c +@@ -253,6 +253,7 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data, + CURLcode result = CURLE_OK; + size_t gotbytes; + char buffer[900]; ++ int maxloops = 10; + + *code = 0; /* 0 for errors or not done */ + *size = 0; +@@ -270,6 +271,9 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data, + pp->nfinal = 0; /* now gone */ + } + if(!pp->overflow) { ++ if(!maxloops--) /* don't get stuck */ ++ return CURLE_OK; ++ + result = pingpong_read(data, sockindex, buffer, sizeof(buffer), + &gotbytes); + if(result == CURLE_AGAIN) +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 3828c26f507..c4a1167d1ba 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -51,6 +51,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-86414.patch \ file://CVE-2026-86409.patch \ file://CVE-2026-87862.patch \ + file://CVE-2026-92387.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102853 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4450.1793777792374864041 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KzGf0+Hv; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2724; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ubPshhCaiUWFfZrM3yscc8lZVYh4TAJ9cgCl4gfuMFs=; b=KzGf0+HvBPkIJiSNX8wDQ8UFOP7F88c6JpOH5tHTZ/9sl/kyC5zjGX66 ENbDrCd1dXpF5dVBeFQjmbCjPyvEdt4Wnb9TNeoUSXnB8M0U/GWptrUv8 lGTH3GUnNi8YcTR0+yYwCBWnTutcGxXS7VYRyfPmX+0N4P/mwL+GRCnaF 9XWRIwOBl+zYbc6AsCMSNUqoMEaNYBm5XuhBkJ289GJoTWqxV595yrixy JvAffKMyomQleBdVPXxHMIw4dtMjnPmWuy8ijIi7FG4h1cW7lRay+OTL2 eo4DaVqsKCxNklesOtq2xWGCrPaSBAs02duHaq5my6AYXUO4H6bGE9MAA g==; X-CSE-ConnectionGUID: siJYRzyDQp+1MBEGhW2RDg== X-CSE-MsgGUID: rGrQLJ0sTD+zot5r7mlnTg== X-IPAS-Result: A0BHAgDD3upq/5T/Ja1aglmCV3VgQ0mWSwOeIIF+DwEBAQ9EDQQBAYUFAo4cAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAzIBGAEtEBwDAQIvKyMIGYMCAYJ0AxEGuXcbN4IsgQGDKQE/AgJAAVDbMwELFAGBOIVAiCNdGAGEfScbG4FygRWDaYEFgVwCAYIshXkEgiKBDIFaHox9AohCSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxmCxoFYQgCDQx0ORAwHiQvBRwmQBsKFBgNSBEsNxUZBD5uB5Itgn8SYS0BExYCBII5pWWhEQoog3iMJJU6GjOqcQuYfY4KllGEaYFoPIFZcBWDIgkWNBkPjjmDa4ZAyBsmMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:11Ru06NbDn1upUHvrR30lsFynXyQoLVcMsEvi/4bfWQNrUoggzQGm mdNUT+CafaOY2v0KdBzb4S/pksAv5fTmoNrT3M5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2UsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+5vLnAML5w0w/40WERk2 NMYF2o3Qh/W0opawJrjIgVtrt4oIM+uOMYUvWttiGiAS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzPHwsYDUXUrsTIJ49keOhh2j2WzZZs1mS46Ew5gA/ySQsjOSxb4uEJoTiqcN9hGmCn 0bkp3/FLlIIM8DC02WA9nSQibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++NukCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:dPIgbau0OrnPDUb8g0O8KEAH7skDVNV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaDZ2JK2xCe36m+oocfng+OaYE X-Talos-CUID: 9a23:qQlkRGFOMo67fG2wqmJ89WwlINI0XkTFjy71CWKXCVkzcpGaHAo= X-Talos-MUID: 9a23:8YZV+wwLSDV/GVdAl0tmfT9ufGiaqL6BEnkps80dh+XHJytsZi3CiTCxfoByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="544479940" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 7EE7318000274; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id CA9E5CBF21E; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 05/12] curl: fix CVE-2026-86412 Date: Tue, 3 Nov 2026 23:36:20 -0800 Message-Id: <20261104073627.302002-6-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249334 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Ignore individual cookie parsing failures while loading a cookie file, except for out-of-memory errors. Preserve line-reading errors and the older Curl_cookie_add() call interface. [1] https://github.com/curl/curl/commit/6ded3e594455d6f018fab5f2f5d916eb9bc4ef94 [2] https://curl.se/docs/CVE-2026-86412.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-86412.patch | 34 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86412.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-86412.patch b/meta/recipes-support/curl/curl/CVE-2026-86412.patch new file mode 100644 index 00000000000..2a846fdbed5 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-86412.patch @@ -0,0 +1,34 @@ +From 6ded3e594455d6f018fab5f2f5d916eb9bc4ef94 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Sat, 5 Sep 2026 16:08:55 +0200 +Subject: [PATCH] cookie: ignore individual cookie errors when loading + +Closes #22840 + +CVE: CVE-2026-86412 +Upstream-Status: Backport [https://github.com/curl/curl/commit/6ded3e594455d6f018fab5f2f5d916eb9bc4ef94] + +(cherry picked from commit 6ded3e594455d6f018fab5f2f5d916eb9bc4ef94) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index a8959a6..8d9acf1 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -1130,8 +1130,9 @@ static CURLcode cookie_load(struct Curl_easy *data, const char *file, + + result = Curl_cookie_add(data, ci, headerline, TRUE, lineptr, NULL, + NULL, TRUE); +- /* File reading cookie failures are not propagated back to the +- caller because there is no way to do that */ ++ /* Ignore individual cookie problems unless we ran out of memory */ ++ if(result != CURLE_OUT_OF_MEMORY) ++ result = CURLE_OK; + } + } while(!result && !eof); + curlx_dyn_free(&buf); /* free the line buffer */ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index c4a1167d1ba..7749c1907f9 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -52,6 +52,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-86409.patch \ file://CVE-2026-87862.patch \ file://CVE-2026-92387.patch \ + file://CVE-2026-86412.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102857 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4378.1793777792173650437 for ; Tue, 03 Nov 2026 23:36:33 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hePNxCPM; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7919; q=dns/txt; s=iport01; t=1793777793; x=1794987393; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=IFCyaAba7qk8WPDInLTUxIZE+fw31SHlgdIyuHRXElc=; b=hePNxCPMilWAf96sw33sNtibZu5NYO0emMWmThByiZRkjv3pakijE221 /tQ+mnemu7kOMgljG4Dwo1snZgLkprgoT30Gzf/r97H9NY7YOa2FQAr2N FcmtqitXSpM1URa4fMxGrBUJfJnqRDH83V7FH/mKGMMSaWYiEBSm0igvT sDgwVs92XY4KK59f6ZllpeIkyG6rGt1ciZ4WzexBzEWpTM/3MCDONX0ft wWYcCxLSizK62e67w0m5yc1kHn1nTi6mK2m4sFr4yrBvWiNCkyMBqew/P Y6Q0Fgs1qzDfcW2jzswpEX9aR0LvEZGZezp1GFbI4DDUHcSBAG/cGvdob Q==; X-CSE-ConnectionGUID: Zma9x68cQOmpsbLHNhNasQ== X-CSE-MsgGUID: pF94FacoRBO7ueh7VcZmLA== X-IPAS-Result: A0BIAgDZ3+pq/43/Ja1aHgEBCxIMggULgld1YENJlksDgROdDYF+DwEBAQ9EDQQBAYUFAo4cAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBAJgn0EAQGCOgM3AxEGuXobN4F5M4EBgykBPwICQAFQ2zMBCxQBgTiFQIgjXRgBhH0nGxuBcoEVgnN2gQWBXAIBgSaGfwSCIoEMgVoejH0CiEJIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGYLGgVhCAINDHQ5EDAeJC8FHCZAGwoUGA1IESw3FRkEPm4Hki2DCgcWSy0BKQEBIHhUUSkUoweCIaERCiiDeIwklToaM4QEgVeSQpJUC5h9izeCU5VpaIRpgWg8DYFMcBWDIgkWNBkPjisOC4NghkDIGyYyAgkyAQEHAgcOAwuBaJAAgR5gAQE IronPort-Data: A9a23:BI29matVTEbKiZ8ahYO8tyr4dufnVAdfMUV32f8akzHdYApBsoF/q tZmKWCFOPmIazD8Ltx/aY2y9koA65bQm9ZqHldo+Co3Fn5GgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb80s11BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIwyON+UHEQp fchDzUVdRqnp8S25rugc7w57igjBJGD0II3oHpsy3TdSP0hW52GG/mM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtOYH49tL/Aan3Xfz5VrFuUtKMf6GnIxws327/oWDbQUoHWHp4Owx7A/ woq+UzhLEBGGtWUzgCv1S2xi++QoyjJXaY7QejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dUL FYZ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YdLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWja1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:1v75Ha5CQdOXf2A16APXwOrXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPN 9bAstDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhFQpcUAUdAZ0++/YTzra3FLeA== X-Talos-CUID: 9a23:29nKgWG+Aq3HB8xtqmJV8UdFCp51eUT6yW/LKWuYL2ZPQaasHAo= X-Talos-MUID: 9a23:l8RVFQgpRPPL3IPpT7QGk8MpLOk5v4qnA0c3u7JZpsSEahJ7CTK5pWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543335001" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 7EB0A18000182; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id CE5B6CBF234; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 06/12] curl: fix CVE-2026-92386 Date: Tue, 3 Nov 2026 23:36:21 -0800 Message-Id: <20261104073627.302002-7-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249341 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Include the upstream correction [3] to accept every cookie-jar record that curl can serialize. The original MAX_COOKIE_LINE + 48 allowance is too small for long paths and domains. Keep both commits in separate patches and include the test1902/lib1902.c regression coverage. [1] https://github.com/curl/curl/commit/445aa87e13f91c94bc742f54343a2eac924e1765 [2] https://curl.se/docs/CVE-2026-92386.html [3] https://github.com/curl/curl/commit/7d64440abba37e3d8039fe663d3edc84f582ce92 Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-92386_p1.patch | 33 ++++ .../curl/curl/CVE-2026-92386_p2.patch | 146 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 2 + 3 files changed, 181 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92386_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92386_p2.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-92386_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-92386_p1.patch new file mode 100644 index 00000000000..69fcedd4faf --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-92386_p1.patch @@ -0,0 +1,33 @@ +From 445aa87e13f91c94bc742f54343a2eac924e1765 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 16 Sep 2026 11:09:18 +0200 +Subject: [PATCH] cookie: accept slightly longer lines in cookie jars + +Closes #22964 + +CVE: CVE-2026-92386 +Upstream-Status: Backport [https://github.com/curl/curl/commit/445aa87e13f91c94bc742f54343a2eac924e1765] + +(cherry picked from commit 445aa87e13f91c94bc742f54343a2eac924e1765) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 8d9acf1..b88ff56 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -1115,7 +1115,9 @@ static CURLcode cookie_load(struct Curl_easy *data, const char *file, + if(fp) { + struct dynbuf buf; + bool eof = FALSE; +- curlx_dyn_init(&buf, MAX_COOKIE_LINE); ++ /* accept a little longer lines so that a full cookie fits and does not ++ abort the file read */ ++ curlx_dyn_init(&buf, MAX_COOKIE_LINE + 48); + do { + result = Curl_get_line(&buf, fp, &eof); + if(!result) { +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl/CVE-2026-92386_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-92386_p2.patch new file mode 100644 index 00000000000..4228387ae63 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-92386_p2.patch @@ -0,0 +1,146 @@ +From 7d64440abba37e3d8039fe663d3edc84f582ce92 Mon Sep 17 00:00:00 2001 +From: Zheng Yu +Date: Wed, 14 Oct 2026 18:13:59 -0700 +Subject: [PATCH] cookie: reload complete self-generated cookie jar rows + +Closes #23407 + +CVE: CVE-2026-92386 +Upstream-Status: Backport [https://github.com/curl/curl/commit/7d64440abba37e3d8039fe663d3edc84f582ce92] + +Backport Changes: +- Match the two spaces before URL in the deleted CURLOPT_COOKIEJAR + line in lib1902.c; upstream's deleted line uses one space. + +(cherry picked from commit 7d64440abba37e3d8039fe663d3edc84f582ce92) +Signed-off-by: Darsh Kelaiya +--- + lib/cookie.c | 9 ++++++--- + tests/data/test1902 | 5 ++++- + tests/libtest/lib1902.c | 39 ++++++++++++++++++++++++++++++++++----- + 3 files changed, 44 insertions(+), 9 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index b88ff56..de40297 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -37,6 +37,7 @@ + #include "curl_memrchr.h" + #include "parsedate.h" + #include "curlx/strdup.h" ++#include "curlx/dynbuf.h" + #include "llist.h" + #include "curlx/strparse.h" + +@@ -1115,9 +1116,11 @@ static CURLcode cookie_load(struct Curl_easy *data, const char *file, + if(fp) { + struct dynbuf buf; + bool eof = FALSE; +- /* accept a little longer lines so that a full cookie fits and does not +- abort the file read */ +- curlx_dyn_init(&buf, MAX_COOKIE_LINE + 48); ++ /* get_netscape_format() uses curl_maprintf(), which returns at most ++ DYN_APRINTF - 1 bytes. cookie_output() adds a newline (CRLF on Windows), ++ and this dynbuf needs one more byte for its null-terminator. This is a ++ cap, not an allocation. */ ++ curlx_dyn_init(&buf, DYN_APRINTF + 2); + do { + result = Curl_get_line(&buf, fp, &eof); + if(!result) { +diff --git a/tests/data/test1902 b/tests/data/test1902 +index a794fd4..876384d 100644 +--- a/tests/data/test1902 ++++ b/tests/data/test1902 +@@ -3,6 +3,7 @@ + + + cookies ++cookiejar + + + +@@ -10,7 +11,7 @@ cookies + + + +-set COOKIEFILE and COOKIEJAR but make no transfer ++reload a long cookie jar line without a transfer + + + cookies +@@ -27,6 +28,7 @@ lib%TESTNUMBER + # https://curl.se/docs/http-cookies.html + # This file was generated by libcurl! Edit at your own risk. + ++example.com FALSE /%repeat[6000 x q]% FALSE 0 long value + example.com FALSE / FALSE 0 has_js 1 + + +@@ -38,6 +40,7 @@ example.com FALSE / FALSE 0 has_js 1 + # https://curl.se/docs/http-cookies.html + # This file was generated by libcurl! Edit at your own risk. + ++example.com FALSE /%repeat[6000 x q]% FALSE 0 long value + example.com FALSE / FALSE 0 has_js 1 + + +diff --git a/tests/libtest/lib1902.c b/tests/libtest/lib1902.c +index da3b23a..4af6249 100644 +--- a/tests/libtest/lib1902.c ++++ b/tests/libtest/lib1902.c +@@ -27,19 +27,48 @@ static CURLcode test_lib1902(const char *URL) + { + CURLcode result = CURLE_OK; + CURL *curl; ++ struct curl_slist *cookies = NULL; ++ struct curl_slist *cookie; ++ bool long_found = FALSE; ++ bool short_found = FALSE; ++ size_t count = 0; + + curl_global_init(CURL_GLOBAL_ALL); + + curl = curl_easy_init(); +- if(curl) { +- easy_setopt(curl, CURLOPT_COOKIEFILE, URL); +- easy_setopt(curl, CURLOPT_COOKIEJAR, URL); ++ if(!curl) { ++ result = TEST_ERR_EASY_INIT; ++ goto test_cleanup; ++ } ++ easy_setopt(curl, CURLOPT_COOKIEFILE, URL); ++ easy_setopt(curl, CURLOPT_COOKIEJAR, URL); ++ ++ /* The original case: no transfer means no cookie jar write. */ ++ curl_easy_cleanup(curl); ++ curl = curl_easy_init(); ++ if(!curl) { ++ result = TEST_ERR_EASY_INIT; ++ goto test_cleanup; ++ } + +- /* Do not perform any actual network operation, +- the issue occur when not calling curl.*perform */ ++ /* Explicitly reload the same jar, also without starting a transfer. */ ++ easy_setopt(curl, CURLOPT_COOKIEFILE, URL); ++ easy_setopt(curl, CURLOPT_COOKIELIST, "RELOAD"); ++ result = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies); ++ if(result) ++ goto test_cleanup; ++ for(cookie = cookies; cookie; cookie = cookie->next) { ++ if(strstr(cookie->data, "\tlong\tvalue")) ++ long_found = strlen(cookie->data) > 5048; ++ if(strstr(cookie->data, "\thas_js\t1")) ++ short_found = TRUE; ++ count++; + } ++ if(count != 2 || !long_found || !short_found) ++ result = TEST_ERR_FAILURE; + + test_cleanup: ++ curl_slist_free_all(cookies); + curl_easy_cleanup(curl); + curl_global_cleanup(); + return result; +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 7749c1907f9..3e804a26f3a 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -53,6 +53,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-87862.patch \ file://CVE-2026-92387.patch \ file://CVE-2026-86412.patch \ + file://CVE-2026-92386_p1.patch \ + file://CVE-2026-92386_p2.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102854 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4378.1793777792173650437 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=WfcO5z6B; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2820; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=G0QuiXYK6zGn6Uq72mYYVRdt7Ey5/MSbHoM0oY55xeA=; b=WfcO5z6Bp2/FuSPwxWG0MTXDvslgQwuLdXsxp65v7Caee/1TAPCfTeIe KOx90/bevlIfpWnhoBOa1Ff4+dXS5zvwxE2TkSLk87G3eeg0VhJzeRu0e 2+AGeTXeTxzSs+/pCwm2htjwN77GJg7QKpCd3iSig0PoNqn3+J61GxTGM wtpmu8QLXCzeXRzUckpfWcXFUkpuVsKM4PK4NaLWUzWzZPEMxFjIRYrvv 5xLtuRiVVR8RCXYgjtmntFAYaK7aKLIusdBKkqKhd+/hVPD4doUt27B6G WyMK1d3OqvT8vvnC5SIa0mGBstFzNaXx5LmHEJ8Q9HLYyhhi0ysw1GLrh w==; X-CSE-ConnectionGUID: fei6qAxQQPC+TyBC8inO+A== X-CSE-MsgGUID: /AInLt+PScKaAzEvWqVudA== X-IPAS-Result: A0BIAgDZ3+pq/5P/Ja1aglmCV3VgQ0mWSwOeIIF+DwEBAQ9EDQQBAYUFAo4cAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRBrl6GzeBeTOBAYMpAT8CAkABUNszAQsUAYE4hUCII10YAYR9JxsbgXKEfoEFgVwCAYEmgQaFeQSCIoEMgVoejH0CiEJIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGYLGgVhCAINDHQ5EDAeJC8FHCZAGwoUGA1IESw3FRkEPm4Hki2DEQFgLQEpAoIFLQgDpWWhEQoog3iMJJU6GjOqcQuYfY4KllGEaYFoPIFZcBWDIgkWNBkPjjmDa4ZAyBsmMgIJMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:6Af0P64wgNXyzCvTzqdvlgxRtGnGchMFZxGqfqrLsTDasY5as4F+v mNNWD+PPfvYazenKd8jYInno0IE7ZfVnIdiSgE9rSAxZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqaztMsPrZwP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eM4AZpP9eEVh3z ddbFCEnRUCCgcX16efuIgVsrpxLwMjDJogTvDRkiDreF/tjGMiFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEQUrsUIMpWcOOAinrydzRZuVu9rqss6G+Vxwt0uFToGIeJIYfRGJ0NxC50o EqB1kX/Jg1ZDOeU6jOs4F+yufbxgC/SDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzFcCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3uz8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:A3KP86G2AIb+gOw3pLqEyseALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1rZ 0QEJRWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:o12I4m3K8N3tK/reLAMr+rxfFM0kLGT03E7pG2T7NXdDY+2UT3jT0fYx X-Talos-MUID: 9a23:Fkbe+gWnRGWX2dPq/HjFpTdGKIRQ2K+NAWkfvIs5oveZOQUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543335002" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 801EA18000241; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id D2683CBEF8A; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 07/12] curl: fix CVE-2026-107928 Date: Tue, 3 Nov 2026 23:36:22 -0800 Message-Id: <20261104073627.302002-8-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249339 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Reject a GnuTLS send result larger than the supplied buffer before advancing the buffer pointer or subtracting the remaining length. The advisory's trigger requires GnuTLS and WebSockets. [1] https://github.com/curl/curl/commit/64fb3e7a7b116f690966054f281624152d4a7651 [2] https://curl.se/docs/CVE-2026-107928.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-107928.patch | 40 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-107928.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-107928.patch b/meta/recipes-support/curl/curl/CVE-2026-107928.patch new file mode 100644 index 00000000000..67f66f097ca --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-107928.patch @@ -0,0 +1,40 @@ +From 64fb3e7a7b116f690966054f281624152d4a7651 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Wed, 7 Oct 2026 11:22:39 +0200 +Subject: [PATCH] gnutls: hardening + +Check the result code of `gnutls_record_send()` for sanity also in +production builds. + +Closes #23297 + +CVE: CVE-2026-107928 +Upstream-Status: Backport [https://github.com/curl/curl/commit/64fb3e7a7b116f690966054f281624152d4a7651] + +(cherry picked from commit 64fb3e7a7b116f690966054f281624152d4a7651) +Signed-off-by: Darsh Kelaiya +--- + lib/vtls/gtls.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c +index f19940a..b87b27d 100644 +--- a/lib/vtls/gtls.c ++++ b/lib/vtls/gtls.c +@@ -2064,8 +2064,13 @@ static CURLcode gtls_send(struct Curl_cfilter *cf, + nwritten = gnutls_record_send(backend->gtls.session, buf, remain); + + if(nwritten >= 0) { ++ if((size_t)nwritten > remain) { ++ DEBUGASSERT(0); ++ failf(data, "gnutls_record_send(len=%zu) returned %zd", ++ remain, nwritten); ++ return CURLE_SEND_ERROR; ++ } + *pnwritten += (size_t)nwritten; +- DEBUGASSERT((size_t)nwritten <= remain); + buf = (char *)CURL_UNCONST(buf) + (size_t)nwritten; + remain -= (size_t)nwritten; + } +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 3e804a26f3a..9a85d470dc5 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -55,6 +55,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-86412.patch \ file://CVE-2026-92386_p1.patch \ file://CVE-2026-92386_p2.patch \ + file://CVE-2026-107928.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102855 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4376.1793777792133403964 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=i66/pNjx; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3448; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=w286nHn+9z5T97dX/D4zr9DN3M8ZPsnacoq9hdSjeAg=; b=i66/pNjxusx5Y/COc/Jozft/o5nkntzneCuOSgZqc/mG/mVJ5wbDaFMa 1pzXNFLcSPdBxpWxTtCL4RVD0eRUulpDt6Lg20X/c17CGADXtj9/JDGKg WXH3LrMl0tOQe9YebHUy0bIti2tgBoI5sn64tkj7WDLTir+A2m4vtlIg6 tGlvI+NNi1pGTy4amoepF7fBverWNiI0hzmi+z5jLPHUjs8+M5xgatTVS daj0yk2LdfXFy+nYZJ6UIrE9a+HKVxY95aTaRL2vSMGTkWofN1eVEIfxf IEQ4Y2tjFJOTmkO1lWtSDpurfDm998l0YRouqFRvkXK2fredZUbuqySS2 g==; X-CSE-ConnectionGUID: ubCcraziS5eKv+pr39i1eQ== X-CSE-MsgGUID: 7BxWUecYQPGjgss0yCjXmg== X-IPAS-Result: A0BJAgDZ3+pq/4v/Ja1aglmCV3VgQ0mWSwOeIBSBag8BAQEPRA0EAQGFBQKOHAImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAhYZKyMIGYMCAYJ0AxEGuXobN4F5M4EBgykBPwICQAFQ2zMBCxQBgTiFQIgjXRgBhH0nGxuBcoEVg2mBBYFcAgGBGIEGhgcEgiKBDIFaHox9AohCSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxmCxoFYQgCDQx0ORAwHiQvBRwmQBsKFBgNSBEsNxUZBD5uB5ItgxEBYC0BKQKCBS4KkyaSP6ERCiiDeIwklToaM6pxC5h9jgqWAk+EaYFoPIFZcBWDIgkWNBkPjjmDa4ZAyBsmMgIJMgEBBwIHDgMLgWiRHmABAQ IronPort-Data: A9a23:Sl5IbKmVInPHFSinsoCe29To5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIcDWjUPf2OamWgeN8iOt+08UwB6pTQyoc1QQBkqygwQVtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs/nb8nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FZAS0e1tCHNPz qEVCy5OdgrY1uPvzYvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaz/7C7pm9AusrnX8fjlRqUOcjaE2+GPUigd21dABNfKIJofbGZoLxRzwS mTuoE7pPSwXP+2m8RWH/Wm33v7knxP+V9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Oxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:Hs52taAhySsVCujlHemO55DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygck79 YCT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a585+oJjsaE52JKGxCe3+mLnE= X-Talos-CUID: 9a23:u7xkumFvoT2e70FNqmJ6/mUfAMk3c0aAwVTOYFeiUjdoEbCsHAo= X-Talos-MUID: 9a23:eP+itghaI3trBMTeR6upbcMpa+143JmjA3E0qboEtNKfbT1bOQeYg2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543947632" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 821F018000211; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id D61D9CBEF98; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 08/12] curl: fix CVE-2026-87864 Date: Tue, 3 Nov 2026 23:36:23 -0800 Message-Id: <20261104073627.302002-9-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249340 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Determine the IMAP APPEND length after configuring all upload readers. Reject uploads whose final length becomes unknown because of CRLF conversion before sending the APPEND command. [1] https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae7979070793a66 [2] https://curl.se/docs/CVE-2026-87864.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-87864.patch | 55 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 56 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87864.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-87864.patch b/meta/recipes-support/curl/curl/CVE-2026-87864.patch new file mode 100644 index 00000000000..0effc5ac8ac --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-87864.patch @@ -0,0 +1,55 @@ +From 3b547de301342b347fb3c6ea6ae7979070793a66 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 27 Aug 2026 09:47:53 +0200 +Subject: [PATCH] imap: APPEND CRLF fix + +Deny an APPEND operation with CRLF conversion requested as we are unable +to predict the final upload size and APPEND requires us to announce it +before starting the upload. + +The check for unknown sizes had already been there, but the crlf +conversion that renders a known size unknown was not accounted for. + +Closes #22702 + +CVE: CVE-2026-87864 +Upstream-Status: Backport [https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae7979070793a66] + +(cherry picked from commit 3b547de301342b347fb3c6ea6ae7979070793a66) +Signed-off-by: Darsh Kelaiya +--- + lib/imap.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/imap.c b/lib/imap.c +index 0546595..f37568f 100644 +--- a/lib/imap.c ++++ b/lib/imap.c +@@ -884,7 +884,6 @@ static CURLcode imap_perform_append(struct Curl_easy *data, + result = Curl_creader_set_mime(data, postp); + if(result) + return result; +- data->state.infilesize = Curl_creader_client_length(data); + } + else + #endif +@@ -894,9 +893,15 @@ static CURLcode imap_perform_append(struct Curl_easy *data, + return result; + } + +- /* Check we know the size of the upload */ ++ /* Check we know the size of the upload. This takes all readers ++ * into account. Especially crlf conversions which make the size ++ * unpredictable, e.g. -1. */ ++ data->state.infilesize = Curl_creader_total_length(data); + if(data->state.infilesize < 0) { +- failf(data, "Cannot APPEND with unknown input file size"); ++ if(data->set.crlf) ++ failf(data, "Cannot APPEND with CRLF conversion making size unknown"); ++ else ++ failf(data, "Cannot APPEND with unknown input file size"); + return CURLE_UPLOAD_FAILED; + } + +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 9a85d470dc5..e039207a0e4 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -56,6 +56,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-92386_p1.patch \ file://CVE-2026-92386_p2.patch \ file://CVE-2026-107928.patch \ + file://CVE-2026-87864.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102860 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4451.1793777792423509325 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Gg6+6I/a; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3198; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=V8Ws33bq4BowSHvb7sQltZUGGDBvUgiRSR80Sy9Dk7w=; b=Gg6+6I/aGBbcvvi1U0YxfBE9vtnIcSMTh1d0FT1tTmvr3c94xQug0Wxf CJ0KryfnsiokygY7RFVP66hjp1/147j98cOWhNUMFgk1dPPvketOvkNpH D4OWZfdoTRLHkfQczBbXhKxb1gyIucvLPBT0FSLk4Ozm/lK/+W0Xw03e1 8nP4ZbkryYt85Oqnvs8Sps9UFpshhNt4sRVygZXzjQTtUiaC65MLKp6+V YlPHUYnCXsu1a/4t3MHOrzV3udk+3e7imbWldBuh4mvHPeIOzD0mOzjnG RHWsW0E+38uvUz4wHPiXdqTKdZ+VGBTiOfDMeF8yIvQePeCzRiy53+oqn A==; X-CSE-ConnectionGUID: Lw1w9G+uTTuIW4vASjdjCw== X-CSE-MsgGUID: 1K+1s45/QUaaibjj3kqTcw== X-IPAS-Result: A0BJAgBW3+pq/4z/Ja1aglmCGD91YENJlksDniCBfg8BAQEPRA0EAQGFBQKOHAImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgQCYIqWAGCdAMRBrl3GzeBeTOBAYMpAT8CAkABUNszAQsUAYE4hUCII10YAYR9JxsbgXKEfoEFgVwCAYglBIIigQyBWh6MfQKIQkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZgsaBWEIAg0MdDkQMB4kLwUcJkAbChQYDUgRLDcVGQQ+bgeSLYJxGQdhLQEpAoEgSFUpknuSQaERCiiDeIwklToaM6lLgSYLmH2OCpYCT4RpgWg8gVlwFYMiCRY0GQ+OOYNrhkDIGyYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:H7Gu66hzelAnlOExsHJKDmHHX161MREKZh0ujC45NGQN5FlHY01je htvXWiEO6qDNGLzKdx2YInj8U0GvsOGz4QxSlM9qy9nQShjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvrY8EkHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU85b9oUE4N6 MAkNREyMg6qvOC6wpmkH7wEasQLdKEHPasFsX1miDWcBvE8TNWbGOPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg9/5JEWxI9EglHzcDBcoVOErII84nPYy0p6172F3N/9J4DRGpkIxBbCz o7A1z3aQUgBaIHY8AeM+3OmhO2UnjrHU51HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmUHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:MkwzE6sLsLQiOX7vxztC/dJ27skDVNV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaDZ2JK2xCe36m+oocfng+OaYE X-Talos-CUID: 9a23:kFcfOGly1zhbmS/W+NgMejCdYPHXOVnClWiBDAylNVp0aYLJV3ar+q9muNU7zg== X-Talos-MUID: 9a23:iTZHiAQTqq3A6wd7RXS1p3I7L5s1pJ2TAUkMm5cE4MqdCSdvbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543745282" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 85994180005A7; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id DA408CBEFAB; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 09/12] curl: fix CVE-2026-92389 Date: Tue, 3 Nov 2026 23:36:24 -0800 Message-Id: <20261104073627.302002-10-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249337 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Reject TFTP packets and state transitions that conflict with the requested transfer direction. This prevents a download from using a reused handle's upload callback or data. [1] https://github.com/curl/curl/commit/63dd390fab905a239a97e2700532929343ebc4e9 [2] https://curl.se/docs/CVE-2026-92389.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-92389.patch | 56 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92389.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-92389.patch b/meta/recipes-support/curl/curl/CVE-2026-92389.patch new file mode 100644 index 00000000000..adbf62e94ab --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-92389.patch @@ -0,0 +1,56 @@ +From 44d91a58fabd1de3555e669e12d88040844be716 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 16 Sep 2026 23:46:44 +0200 +Subject: [PATCH] tftp: verify direction in a few places + +Closes #22974 + +CVE: CVE-2026-92389 +Upstream-Status: Backport [https://github.com/curl/curl/commit/63dd390fab905a239a97e2700532929343ebc4e9] + +(cherry picked from commit 63dd390fab905a239a97e2700532929343ebc4e9) +Signed-off-by: Darsh Kelaiya +--- + lib/tftp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/lib/tftp.c b/lib/tftp.c +index cc0769b..fca77b7 100644 +--- a/lib/tftp.c ++++ b/lib/tftp.c +@@ -361,6 +361,9 @@ static CURLcode tftp_tx(struct tftp_conn *state, tftp_event_t event) + char *bufptr; + bool eos; + ++ if(!data->state.upload) ++ return CURLE_TFTP_ILLEGAL; ++ + switch(event) { + + case TFTP_EVENT_ACK: +@@ -768,10 +771,14 @@ static CURLcode tftp_send_first(struct tftp_conn *state, + break; + + case TFTP_EVENT_ACK: /* Connected for transmit */ ++ if(!data->state.upload) ++ return CURLE_TFTP_ILLEGAL; + result = tftp_connect_for_tx(state, event); + break; + + case TFTP_EVENT_DATA: /* Connected for receive */ ++ if(data->state.upload) ++ return CURLE_TFTP_ILLEGAL; + result = tftp_connect_for_rx(state, event); + break; + +@@ -1074,6 +1081,8 @@ static CURLcode tftp_receive_packet(struct Curl_easy *data, + + switch(state->event) { + case TFTP_EVENT_DATA: ++ if(data->state.upload) ++ return CURLE_TFTP_ILLEGAL; + /* Do not pass to the client empty or retransmitted packets */ + if(state->rbytes > 4 && + (NEXT_BLOCKNUM(state->block) == getrpacketblock(&state->rpacket))) { +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index e039207a0e4..6cf6e328272 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -57,6 +57,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-92386_p2.patch \ file://CVE-2026-107928.patch \ file://CVE-2026-87864.patch \ + file://CVE-2026-92389.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Nov 4 07:36:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102863 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4452.1793777792484065324 for ; Tue, 03 Nov 2026 23:36:33 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=CrlGWnTI; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=13831; q=dns/txt; s=iport01; t=1793777793; x=1794987393; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=jELyVuRCIr3AaUGWAzvJBqOJFz1qipTK9uVY0Pnd9Nw=; b=CrlGWnTIncwaXmBDG6YPbesW/karyUbxZumskz+2XeePPcAxHwFiDM+u VYSukX2t9oR15eDnuhZcU31w5AsqnGIAl9dbLv+Q833HYYwN0leaH+Mxx +qzHe8r01gzL66q+el6IP8N2/EkXB5AOxeBgpwIOnKydqThQrHfVnWtJh /m7Pjs/Qk0yLmZAkBERhZIkkhSbPzWD8wR7+qYAuILHJHTj1XCBGpDa8F 4EKH/kmizBYB9I0tZYrryvejJ7RoZCfW71L+j/DJBAWQ7CKyzep09Ij2D s0m5nNlqDFy65u+Uxl46S5zWsmRmfGtxJT09umUSJX5BfwZAVjnnsVoYa w==; X-CSE-ConnectionGUID: kiy3oGpCRL6nanRQQWK0RQ== X-CSE-MsgGUID: J8S99k5DQPabfx9IArXiZw== X-IPAS-Result: A0ADAABQ4Opq/5L/Ja1aGgEBAQEBAQEBAQEDAQEBARIBAQEBAgIBAQEBgXwFAQEBAQsBglZ1YENJjHKJWQOBE50NFIFqDwEBAQ9EDQQBAYFxASCCcwKOHAImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGFQEHMg2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEQa5fBs3gXkzgQGDKQE/AgJAAVDbMwELFAGBOAGFP4gjXRgBhH0nGxuBcoEVgnN2gQWBMioCAYEiJYZeBIIigQyBWh4yMwmMDwKIQkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZgsaBWEIAg0MdDkQMB4kLwUcJkAbChQYDUgRLDcVGQQ+bgeSLYJkLQEeEikGASEMAQciAhcYYgpnOwseknQRkBaCIYE1n1wKKIN4jCSVOhozhASBV5JCklQLmH2OCpVpGQJNhGmBaDyBWXAVgyIJFjQZD4M4iHeBfA4LgXiBaIRQcX/IGyYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:JkKeBaMAxAp7uH3vrR30lsFynXyQoLVcMsEvi/4bfWQNrUpx3zEHn TdLDTuOPq7cYzH1c99+O9u+8BwCupTWxoQxT3M5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2UsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6/ZvHRoxEpUzwMIpB2hIz 8UhFxNVVCnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmIS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMnwsYDUXUrsTIJ49keOhh2j2WzZZs1mS46Ew5gA/ySQsjOO8YYGFK4biqcN9vBaj9 zPFokjAOhgQOszO6BOfwnOembqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MskCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXOIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:KckHwKAlZ7OrHDvlHemO55DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygck79 YCT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a585+oJjsaE52JKGxCe3+mLnE= X-Talos-CUID: 9a23:QA+VK2hyz4EISZGIn31P+OtaqDJucXzMl3D/O2SCLThvQbuvcGav2/teqp87 X-Talos-MUID: 9a23:SQX4pwY2tajpneBTlW/X1WBhaetR262kBlBcsLwci8i2Knkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543993892" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 87B2F180004AA; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id DDF45CBEFBF; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 10/12] curl: fix CVE-2026-87865 Date: Tue, 3 Nov 2026 23:36:25 -0800 Message-Id: <20261104073627.302002-11-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249343 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Match hashed known_hosts entries against the requested host before selecting the host-key algorithm. Adapt the connection fields and SSH test fixture to curl 8.19.0. Include the upstream follow-up [3] to cache key types already absent for this host, avoiding repeated full-file scans introduced by [1]. Keep both upstream commits in separate patches and retain test3500. Install test3500.pl into ptest so the hashed-host regression can run from the target package. [1] https://github.com/curl/curl/commit/323c184b6bdf5b1988a10c0a61560666e1588149 [2] https://curl.se/docs/CVE-2026-87865.html [3] https://github.com/curl/curl/commit/dc055e8a9eefe65cf63cb0396668a37c0b7c474a Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-87865_p1.patch | 225 ++++++++++++++++++ .../curl/curl/CVE-2026-87865_p2.patch | 89 +++++++ meta/recipes-support/curl/curl_8.19.0.bb | 4 + 3 files changed, 318 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87865_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87865_p2.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-87865_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-87865_p1.patch new file mode 100644 index 00000000000..52cdd65e200 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-87865_p1.patch @@ -0,0 +1,225 @@ +From 323c184b6bdf5b1988a10c0a61560666e1588149 Mon Sep 17 00:00:00 2001 +From: Bobbeh Rhino +Date: Tue, 8 Sep 2026 06:33:27 -0400 +Subject: [PATCH] libssh2: match hashed known_hosts entries by host + +libssh2 does not expose the plaintext name for hashed entries. Check +each entry key against the requested hostname before using its key type. +Otherwise an unrelated hashed entry can select the wrong algorithm. + +Add an SFTP regression test 3500 with an unrelated hashed entry before +the requested host. + +Closes #22874 + +CVE: CVE-2026-87865 +Upstream-Status: Backport [https://github.com/curl/curl/commit/323c184b6bdf5b1988a10c0a61560666e1588149] + +Backport Changes: +- Use curl 8.19.0's conn->host.name and conn->remote_port instead of + conn->origin->hostname and conn->origin->port. The older connection + has no origin pointer; preserve the -1 lookup port for port 22. +- Register test3500 and test3500.pl in the older grouped TESTCASES + and EXTRA_DIST lists. +- Use curl_host_rsa_key.pub in test3500's precheck; curl 8.19.0 + generates that filename rather than the newer curl_host_key.pub. + +(cherry picked from commit 323c184b6bdf5b1988a10c0a61560666e1588149) +Signed-off-by: Darsh Kelaiya +--- + lib/vssh/libssh2.c | 16 +++++++-- + tests/data/Makefile.am | 2 ++ + tests/data/test3500 | 47 +++++++++++++++++++++++++ + tests/libtest/Makefile.am | 3 +- + tests/libtest/test3500.pl | 72 +++++++++++++++++++++++++++++++++++++++ + 5 files changed, 136 insertions(+), 4 deletions(-) + create mode 100644 tests/data/test3500 + create mode 100755 tests/libtest/test3500.pl + +diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c +index 3c25fe7..7c18ff4 100644 +--- a/lib/vssh/libssh2.c ++++ b/lib/vssh/libssh2.c +@@ -654,9 +654,19 @@ static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data, + break; + } + } +- else { +- found = TRUE; +- break; ++ else if(store->key) { ++ int keycheck = libssh2_knownhost_checkp( ++ sshc->kh, conn->host.name, ++ (conn->remote_port != PORT_SSH) ? conn->remote_port : -1, ++ store->key, strlen(store->key), ++ LIBSSH2_KNOWNHOST_TYPE_PLAIN | ++ LIBSSH2_KNOWNHOST_KEYENC_BASE64 | ++ (store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK), ++ NULL); ++ if(keycheck == LIBSSH2_KNOWNHOST_CHECK_MATCH) { ++ found = TRUE; ++ break; ++ } + } + } + } +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 9fd7ee7..7a9b8d0 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -287,6 +287,8 @@ test3209 test3210 test3211 test3212 test3213 test3214 test3215 test3216 \ + \ + test3303 test3304 \ + \ ++test3500 \ ++\ + test4000 test4001 + + EXTRA_DIST = $(TESTCASES) DISABLED data-xml1 data320.html \ +diff --git a/tests/data/test3500 b/tests/data/test3500 +new file mode 100644 +index 0000000..86f0c43 +--- /dev/null ++++ b/tests/data/test3500 +@@ -0,0 +1,47 @@ ++ ++ ++ ++ ++SFTP ++known_hosts ++libssh2 ++ ++ ++ ++# Server-side ++ ++ ++Test data ++for hashed known hosts ++ ++ ++ ++# Client-side ++ ++ ++sftp ++ ++ ++sftp ++libssh2 ++!badlibssh ++ ++ ++%PERL %SRCDIR/libtest/test3500.pl %LOGDIR/server/curl_host_rsa_key.pub %LOGDIR/known%TESTNUMBER "[%HOSTIP]:%SSHPORT" ++ ++ ++SFTP matches requested hashed known_hosts entry ++ ++ ++--knownhosts %LOGDIR/known%TESTNUMBER --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt ++ ++ ++Test data ++for hashed known hosts ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++ +diff --git a/tests/libtest/Makefile.am b/tests/libtest/Makefile.am +index e174698..82dbc62 100644 +--- a/tests/libtest/Makefile.am ++++ b/tests/libtest/Makefile.am +@@ -44,7 +44,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/include \ + include Makefile.inc + + EXTRA_DIST = CMakeLists.txt $(FIRST_C) $(FIRST_H) $(UTILS_C) $(UTILS_H) $(TESTS_C) \ +- test307.pl test610.pl test613.pl test1013.pl test1022.pl mk-lib1521.pl ++ test307.pl test610.pl test613.pl test1013.pl test1022.pl mk-lib1521.pl \ ++ test3500.pl + + CFLAGS += @CURL_CFLAG_EXTRAS@ + +diff --git a/tests/libtest/test3500.pl b/tests/libtest/test3500.pl +new file mode 100755 +index 0000000..d95f54c +--- /dev/null ++++ b/tests/libtest/test3500.pl +@@ -0,0 +1,72 @@ ++#!/usr/bin/env perl ++#*************************************************************************** ++# _ _ ____ _ ++# Project ___| | | | _ \| | ++# / __| | | | |_) | | ++# | (__| |_| | _ <| |___ ++# \___|\___/|_| \_\_____| ++# ++# Copyright (C) Daniel Stenberg, , et al. ++# ++# This software is licensed as described in the file COPYING, which ++# you should have received as part of this distribution. The terms ++# are also available at https://curl.se/docs/copyright.html. ++# ++# You may opt to use, copy, modify, merge, publish, distribute and/or sell ++# copies of the Software, and permit persons to whom the Software is ++# furnished to do so, under the terms of the COPYING file. ++# ++# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++# KIND, either express or implied. ++# ++# SPDX-License-Identifier: curl ++# ++########################################################################### ++use strict; ++use warnings; ++ ++use Digest::SHA qw(hmac_sha1); ++use MIME::Base64 qw(encode_base64); ++ ++sub errout { ++ print $_[0] . "\n"; ++ exit 1; ++} ++ ++if(@ARGV != 3) { ++ errout "Usage: $0 host-public-key known-hosts-file target"; ++} ++ ++my ($hostkey_file, $knownhosts_file, $target) = @ARGV; ++open(my $hostkey, "<", $hostkey_file) or errout "$!"; ++my $hostkey_line = <$hostkey>; ++close($hostkey) or errout "$!"; ++ ++my ($hostkey_algo, $hostkey_data) = split(/\s+/, $hostkey_line); ++if(!$hostkey_algo || !$hostkey_data) { ++ errout "Failed parsing SSH host public key"; ++} ++ ++my $rsa_key = ++ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgSyqrUP2xhqLqkyopVapoKeucYIp" . ++ "ZXeUqj+Q9WLWyXka5re62Y3R/lxZUXtkJjlpdD2LNMFenNlDQvPaXH5Utllt+c3z" . ++ "wOkOLy7RXX5S37SfQFm/0fPkZqoZfMDB6XDcwA4cakjCRn4oZyKs8dWAxoNaTtYc" . ++ "nKKMJ6rmc8PttykJw9fwiKAjPyYf21/BMvWIzu9req+TrDA/Jcd2UAug94CikJIX" . ++ "uwKmSYleAOo4eJWx8GyujgEgZn05eq+K1LSg9RqRVIxOdqjoE5K3abBfs0rmUuLd" . ++ "MFh7nHseTFXYbKzpz46V7iZMfFuoyURrzVsqGUm+/m7dxBM98In12kOm3"; ++my $ed25519_key = ++ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqmXRY8k+W9GtpWxYru6ELAXYHdXq" . ++ "jf33ziITGTiJUN"; ++my $other_key = $hostkey_algo eq "ssh-ed25519" ? $rsa_key : $ed25519_key; ++ ++my $salt = "curl-knownhosts-test"; ++my $salt64 = encode_base64($salt, ""); ++my $hash64 = encode_base64(hmac_sha1("unrelated.invalid", $salt), ""); ++my $target_hash64 = encode_base64(hmac_sha1($target, $salt), ""); ++ ++open(my $knownhosts, ">", $knownhosts_file) or errout "$!"; ++print $knownhosts "|1|$salt64|$hash64 $other_key\n"; ++print $knownhosts "|1|$salt64|$target_hash64 $hostkey_algo $hostkey_data\n"; ++close($knownhosts) or errout "$!"; ++ ++exit 0; +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl/CVE-2026-87865_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-87865_p2.patch new file mode 100644 index 00000000000..0bf7cfea3c6 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-87865_p2.patch @@ -0,0 +1,89 @@ +From dc055e8a9eefe65cf63cb0396668a37c0b7c474a Mon Sep 17 00:00:00 2001 +From: Bobbeh Rhino +Date: Tue, 8 Sep 2026 20:24:35 -0400 +Subject: [PATCH] libssh2: skip repeat checkp() for already-absent hashed key + types + +ssh_force_knownhost_key_type() called libssh2_knownhost_checkp() once +per hashed known_hosts entry, and each call itself rescans the whole +known_hosts set. Cache key types already confirmed absent for the +connecting host so repeat entries of the same type do not each trigger +another full scan. checkp() NOTFOUND for a given (host, port, type) is +independent of the key bytes passed in, so this is safe. + +Behavior for MATCH is unchanged, and only store->typemask is read +after a match, which is identical for any entry of the same type. + +Tests: runtests.pl 3500 1459 600, full SFTP/SCP keyword set (58/58), +checksrc.pl. + +Closes #22905 + +CVE: CVE-2026-87865 +Upstream-Status: Backport [https://github.com/curl/curl/commit/dc055e8a9eefe65cf63cb0396668a37c0b7c474a] + +Backport Changes: +- Use curl 8.19.0's conn->host.name and conn->remote_port instead of + conn->origin->hostname and conn->origin->port. The older connection + has no origin pointer; preserve the -1 lookup port for port 22. + +(cherry picked from commit dc055e8a9eefe65cf63cb0396668a37c0b7c474a) +Signed-off-by: Darsh Kelaiya +--- + lib/vssh/libssh2.c | 34 +++++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 11 deletions(-) + +diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c +index 7c18ff4..cb214e3 100644 +--- a/lib/vssh/libssh2.c ++++ b/lib/vssh/libssh2.c +@@ -622,6 +622,12 @@ static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data, + !data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256]) { + struct libssh2_knownhost *store = NULL; + struct connectdata *conn = data->conn; ++ /* key types already confirmed absent for this host, so repeat hashed ++ entries of the same type do not each force a fresh checkp() scan ++ of the whole known_hosts set. one slot per possible key type (indexed ++ by the type shifted down) so no entry ordering can overflow it */ ++ bool absent_type[(LIBSSH2_KNOWNHOST_KEY_MASK >> ++ LIBSSH2_KNOWNHOST_KEY_SHIFT) + 1] = { FALSE }; + /* lets try to find our host in the known hosts file */ + while(!libssh2_knownhost_get(sshc->kh, &store, store)) { + /* For non-standard ports, the name will be enclosed in */ +@@ -655,17 +661,23 @@ static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data, + } + } + else if(store->key) { +- int keycheck = libssh2_knownhost_checkp( +- sshc->kh, conn->host.name, +- (conn->remote_port != PORT_SSH) ? conn->remote_port : -1, +- store->key, strlen(store->key), +- LIBSSH2_KNOWNHOST_TYPE_PLAIN | +- LIBSSH2_KNOWNHOST_KEYENC_BASE64 | +- (store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK), +- NULL); +- if(keycheck == LIBSSH2_KNOWNHOST_CHECK_MATCH) { +- found = TRUE; +- break; ++ unsigned int type = (store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK) ++ >> LIBSSH2_KNOWNHOST_KEY_SHIFT; ++ if(!absent_type[type]) { ++ int keycheck = libssh2_knownhost_checkp( ++ sshc->kh, conn->host.name, ++ (conn->remote_port != PORT_SSH) ? conn->remote_port : -1, ++ store->key, strlen(store->key), ++ LIBSSH2_KNOWNHOST_TYPE_PLAIN | ++ LIBSSH2_KNOWNHOST_KEYENC_BASE64 | ++ (store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK), ++ NULL); ++ if(keycheck == LIBSSH2_KNOWNHOST_CHECK_MATCH) { ++ found = TRUE; ++ break; ++ } ++ else if(keycheck == LIBSSH2_KNOWNHOST_CHECK_NOTFOUND) ++ absent_type[type] = TRUE; + } + } + } +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 6cf6e328272..f2de4dfa042 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -58,6 +58,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-107928.patch \ file://CVE-2026-87864.patch \ file://CVE-2026-92389.patch \ + file://CVE-2026-87865_p1.patch \ + file://CVE-2026-87865_p2.patch \ " SRC_URI:append:class-nativesdk = " \ @@ -172,6 +174,8 @@ do_install_ptest() { cp ${S}/tests/*.p[lmy] ${D}${PTEST_PATH}/tests/ install -d ${D}${PTEST_PATH}/tests/libtest + install -m 0755 ${S}/tests/libtest/test3500.pl \ + ${D}${PTEST_PATH}/tests/libtest/ for name in $(makefile-getvar ${B}/tests/libtest/Makefile noinst_PROGRAMS noinst_LTLIBRARIES); do ${B}/libtool --mode=install install ${B}/tests/libtest/$name ${D}${PTEST_PATH}/tests/libtest done From patchwork Wed Nov 4 07:36:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102861 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4452.1793777792484065324 for ; Tue, 03 Nov 2026 23:36:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=d5HbFD3U; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2796; q=dns/txt; s=iport01; t=1793777792; x=1794987392; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=JqYHdcD1WayfWlwsqI+kFkwhC+E2/eXijqcNMujKI2k=; b=d5HbFD3UjcMpicBBbNmiOMiD9iYJ/JT4bKCPTRI2IZz2Q/yY0508nBT2 mZOEVYh9yzzfbmh+llU3Cym0SVCXjx5Ngs8r1QJhnDRVsMuhI8//g7pC2 tNOta2xtRdFYThULK/frIUDj2U05TAjeN4GtzTtGM0En3fTaepPHl0qMh A+6PYbQY1ljHFnfNBVHTRNMig6gIyDpnxkknL0yI7BC33h4dxviiyMuat lV3JmgxtTwDlJaAvWB07gjz+hiwy9lQViy/Njh6AciP5EuDM93T3wMhHd uacTrIPJbEG8J/aV0iSGZmK4Zfy2YNDhv1R9HAcFWwT4ruAAmi8IeyUk/ g==; X-CSE-ConnectionGUID: 233iqakrQLiZiDrvflfN9w== X-CSE-MsgGUID: +JM4e8NsS/+uEfYdXofa9g== X-IPAS-Result: A0BGAgBQ4Opq/5L/Ja1RCYJZgld1YENJlksDniAUgWoPAQEBD0QNBAEBhQUCjhwCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBMCAQMyARgBLRAgMSsrGYMCAYJ0AxEGuk6CLIEBgykBPwICQAFQ2zMBCxQBgTiFQIgjdQGEfScbG4FygRWDaYEFgVwCAYEzEmeFeQSCInoSgXhljBiIREiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZgsaBWEIAg0MdDkQMB4kLwUcJkAbChQYDUgRLDcVGQQ+bgeSLYIgcQFZBy0IIgKBbBgBOAulWqERCiiDeIwklToaM6pxCyOYWo4KlTcyG02EaYFoPIFZcBU7gmcJFjQZD445g2uGQMgbJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:XrrqTayHUkavss0nvTd6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkUBy mQZWD2BbP3fYTf8Kd4jYIi28EtU68DVy9IxSAto+VhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctajlMscpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJBttZowB8+VtOEVPx /00Mi4Dah6l1v3jldpXSsE07igiBNPgMIVavjRryivUSK53B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cPXWjOX9PYH46tOuri332cixRgFmUvqEwpWPUyWSd1ZCwbIGEK4faFJw9ckCw5 UDjo2mpJAohc5+C5DS0/kKriOaeknauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBVy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:66Ohj6GbGVBzRiXQpLqEyseALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1rZ 0QEJRWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:/snjtGsyJm6UPaTFIXmvleTF6It/KSbc1X7TOXacCFRoZKeLR1ue3vJ7xp8= X-Talos-MUID: 9a23:JfwKTQW9uvJ0QpHq/HzOoW1vZOFz2OPtFW0DoJk2vMeNZCMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543993891" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 8840D180005B8; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id E1962CBEF6B; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 11/12] curl: set CVE_STATUS for CVE-2026-19931 Date: Tue, 3 Nov 2026 23:36:26 -0800 Message-Id: <20261104073627.302002-12-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249338 From: Darsh Kelaiya Analysis: - The advisory [1] names [2] as its fixed-in commit. It moves connection maintenance to admin handles, preserving the identity used by authentication reuse checks. - Earlier, [4] added Negotiate/NTLM connection reuse checks, including an SSPI ambient-user check using recent_conn_id. Later, [5] removed that SSPI check; the other checks remain. - Curl 8.19.0 predates [4]. Applying [2] alone would not reproduce the later upstream behavior; a source fix needs backport analysis. - The advisory describes Negotiate reuse with empty credentials and lists curl 8.19.0 within the affected range [1]. - On Linux, this requires krb5 and negotiate-auth. Wrynose enables negotiate-auth but leaves krb5 disabled by default [3]. - Follow the merged GSS-API configuration check in [3]. Set not-applicable-config if either option is absent; otherwise keep unpatched while the source backport is deferred. - Record the CVE as not-applicable-config unless both required PACKAGECONFIG options are enabled; otherwise retain unpatched status. The CVE_STATUS decision is conditional, not hardcoded. Reference: [1] https://curl.se/docs/CVE-2026-19931.html [2] https://github.com/curl/curl/commit/7103a93b05bc69ea98ed9d05d02fa9eeba533f2f [3] https://github.com/openembedded/openembedded-core/commit/93c410c455b92a2b1fe3b77347e57d02f344056b [4] https://github.com/curl/curl/commit/1a17959fc7a80864c9c9b37097856bdb4a465cf8 [5] https://github.com/curl/curl/commit/1c58877705b172da892cb9c18c5edb572f2d1d73 Signed-off-by: Darsh Kelaiya --- meta/recipes-support/curl/curl_8.19.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index f2de4dfa042..f30750a6061 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -77,6 +77,7 @@ CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is CVE_STATUS[CVE-2026-12064] = "${@bb.utils.contains('PACKAGECONFIG', 'libssh2', 'unpatched', 'not-applicable-config: SCP/SFTP support is not enabled in PACKAGECONFIG', d)}" CVE_STATUS[CVE-2026-8458] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: applicable only with GSS-API-backed Negotiate authentication', d)}" CVE_STATUS[CVE-2026-82209] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl" +CVE_STATUS[CVE-2026-19931] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: GSS-API Negotiate is disabled', d)}" inherit autotools pkgconfig binconfig multilib_header ptest From patchwork Wed Nov 4 07:36:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102862 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4451.1793777792423509325 for ; Tue, 03 Nov 2026 23:36:33 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ZxDIQc4J; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3850; q=dns/txt; s=iport01; t=1793777793; x=1794987393; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=uQeVDVrd3qPC4IpnQoxT0LBsYT0FYs9ZP7XMcYG/gsU=; b=ZxDIQc4JzlzTL8gUB28vWFGwzp7UUg0q6hK2x0sftcbV/mJjvkFw82Jw F+LE/dODqeLYUu5IrFvJP6JH7KpTqKw6hn+fD+WwRFA511BKjRRt/kGI/ ohKGn1KHS33VBdGoUgabgkwqbbu7gaYRRqhVak3V8b1zGk36FyEKYGab5 +vN0nGM9i/Gej88va14a0zMS2g2FWxWFQxoIlOmG9hrNntSoDqZTp1XTC FF0sLtCE1E1vVWx6wEgINLQwntg6dfiacbjyyIsxC+8HYidHrCdN5FZ7U a4Qor56a/Q7P+1i4HQFV1rmc3sKqugljO4lG/My5tUGt+BUM7k7rlMbEp w==; X-CSE-ConnectionGUID: peB2Y1BfTOiO1KRVnGo+lw== X-CSE-MsgGUID: fUAt49MdTZK3Ni3C4n8PRw== X-IPAS-Result: A0BIAgBW3+pq/4z/Ja1aglmCV3VgQ0mWSwOeIIF+DwEBAQ9EDQQBAYUFAo4cAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBAJgwIBgnQDEQa5dxs3gXkzgQGDKQE/AgJAAVDbMwELFAGBOIVAiCNdGAGEfScbG4FygRWDaYEFgVwCAYFHhl4Egg0VgQyBWh6DB4l2AohCSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxmCxoFYQgCDQx0ORAwHiQvBRwmQBsKFBgNSBEsNxUZBD5uB5ItgxABAWAaEwETFgEBggM4ApMkHSmRe6ERCiiDeIwkg12RXRozqnELmH2OCpYETYRpgWg8gVlwFYMiCRY0GQ+OLgsLg2CGQMgbJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:Q3/yuaMrCIzvLjjvrR30lsFynXyQoLVcMsEvi/4bfWQNrUok0WZUm GZKDTrSPqvZZGP8L9EkPozk/RlS6pGAz9ZmTXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2UsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+1jJhsHZKcWxsF2Jjhtz 8IeBzdOag/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmCS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzNHwsYDUXUrsTIJ49keOhh2j2WzZZs1mS46Ew5gA/ySQsjOOybIePKofiqcN9kHuxu j6X2mjFMDJBEt3E4maDokqWmbqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MuECSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXPIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:r+dw4a5vXZhKqilaMwPXwOrXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPN 9bAstDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhFQpcUAUdAZ0++/YTzra3FLeA== X-Talos-CUID: 9a23:hKVUOG4kLP2OZjLKAdss7EM+QPF8WHPh63b3emyCN2BGT/6RVgrF X-Talos-MUID: 9a23:divpKQvgxjdG4qeppc2nigxLKJs5xqiSOmNWt5RdkJWCZRRKJGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,194,1787011200"; d="scan'208";a="543745283" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 04 Nov 2026 07:36:31 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 8B50A18000631; Wed, 4 Nov 2026 07:36:31 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id E8290CBEF6C; Tue, 3 Nov 2026 23:36:30 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 12/12] curl: fix CVE-2026-18924 Date: Tue, 3 Nov 2026 23:36:27 -0800 Message-Id: <20261104073627.302002-13-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261104073627.302002-1-dkelaiya@cisco.com> References: <20261104073627.302002-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 07:36:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249342 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Make accepted HTTP/2 push handles inherit their parent's share object. Use the curl 8.19.0 share setter to retain its locking, reference counting and shared-cache handling during cleanup. [1] https://github.com/curl/curl/commit/90325ff0444cbdff368bda5d26d6405a0bb6ee43 [2] https://curl.se/docs/CVE-2026-18924.html Signed-off-by: Darsh Kelaiya --- .../curl/curl/CVE-2026-18924.patch | 57 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 58 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-18924.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-18924.patch b/meta/recipes-support/curl/curl/CVE-2026-18924.patch new file mode 100644 index 00000000000..5d744138fa6 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-18924.patch @@ -0,0 +1,57 @@ +From 90325ff0444cbdff368bda5d26d6405a0bb6ee43 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 5 Aug 2026 10:02:53 +0200 +Subject: [PATCH] http2: make server push transfers inherit share from + parent + +Reported-by: Stephan Zeisberg +Closes #22488 + +CVE: CVE-2026-18924 +Upstream-Status: Backport [https://github.com/curl/curl/commit/90325ff0444cbdff368bda5d26d6405a0bb6ee43] + +Backport Changes: +- Use curl_easy_setopt(second, CURLOPT_SHARE, (CURLSH *)data->share) + instead of Curl_share_easy_link(), which is absent from curl 8.19.0. + The cast satisfies curl's CURLOPT_SHARE type check. The setter + locks the share, updates its dirty counter and links shared caches. +- Retain curl_easy_duphandle() instead of the later curl_easy_init() + change in [1], preserving curl 8.19.0's documented push-option + inheritance. In 8.19.0, duplication leaves second->share NULL. + The share setter increments share->dirty before the push callback. + When the pushed transfer joins the multi handle, conncache.c + selects data->share->cpool when connection sharing is enabled. + Curl_close() drops the use count on rejection or cleanup; + curl_share_cleanup() refuses to free a share still in use. The + share lifetime fix does not require the later handle-creation + change. + +[1] https://github.com/curl/curl/commit/fad90b666df98c93ee165341b0c8101c7b10ad7b + +(cherry picked from commit 90325ff0444cbdff368bda5d26d6405a0bb6ee43) +Signed-off-by: Darsh Kelaiya +--- + lib/http2.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/http2.c b/lib/http2.c +index e1c5798..ffeb0f4 100644 +--- a/lib/http2.c ++++ b/lib/http2.c +@@ -46,6 +46,7 @@ + #include "bufref.h" + #include "curlx/dynbuf.h" + #include "headers.h" ++#include "curl_share.h" + + #if (NGHTTP2_VERSION_NUM < 0x010c00) + #error too old nghttp2 version, upgrade! +@@ -709,6 +710,8 @@ static struct Curl_easy *h2_duphandle(struct Curl_cfilter *cf, + struct h2_stream_ctx *second_stream; + http2_data_setup(cf, second, &second_stream); + second->state.priority.weight = data->state.priority.weight; ++ if(data->share) ++ (void)curl_easy_setopt(second, CURLOPT_SHARE, (CURLSH *)data->share); + } + return second; + } diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index f30750a6061..f9cc46fdc32 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -38,6 +38,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80229.patch \ file://CVE-2026-9546-01.patch \ file://CVE-2026-9546-02.patch \ + file://CVE-2026-18924.patch \ file://CVE-2026-8926-dependent.patch \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \