* [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286
@ 2026-09-04 9:00 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04 9:00 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].
[1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
[2] https://curl.se/docs/CVE-2026-8286.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 61 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
new file mode 100644
index 0000000000..ec2f6165c3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
@@ -0,0 +1,60 @@
+From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+CVE: CVE-2026-8286
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
+
+Backport Changes:
+- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream may-TLS
+ and require-TLS distinction in ConnectionExists() and preserve the upstream
+ TLS configuration matching behavior.
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/url.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index dfcd6f4841..9e1ca0336c 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
+ /* plain HTTP with upgrade */
+ bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
+ (needle->handler->protocol & CURLPROTO_HTTP);
+- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+
+ *usethis = NULL;
+ *force_reuse = FALSE;
+@@ -1054,7 +1055,7 @@ ConnectionExists(struct Curl_easy *data,
+ continue;
+
+ if(!(needle->handler->flags & PROTOPT_SSL) &&
+- req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
++ require_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
+ continue;
+
+ if(needle->bits.conn_to_host != check->bits.conn_to_host)
+@@ -1202,8 +1203,8 @@ ConnectionExists(struct Curl_easy *data,
+ needle->remote_port != check->remote_port)
+ continue;
+
+- /* If talking TLS, check needs to use the same SSL options. */
+- if((needle->handler->flags & PROTOPT_SSL) &&
++ /* If talking/upgrading to TLS, check needs the same SSL options. */
++ if(((needle->handler->flags & PROTOPT_SSL) || may_tls) &&
+ !Curl_ssl_conn_config_match(data, check, FALSE)) {
+ DEBUGF(infof(data,
+ "Connection #%" CURL_FORMAT_CURL_OFF_T
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 365f02ad59..c006649a1b 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -41,6 +41,7 @@ SRC_URI = " \
file://CVE-2026-5545.patch \
file://CVE-2026-6253.patch \
file://CVE-2026-4873.patch \
+ file://CVE-2026-8286.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924
2026-09-04 9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-09-04 9:00 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04 9:00 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. Backporting it also protects downstream
configurations that enable libpsl.
[1] https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8
[2] https://curl.se/docs/CVE-2026-8924.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../curl/curl/CVE-2026-8924.patch | 127 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 128 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8924.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8924.patch b/meta/recipes-support/curl/curl/CVE-2026-8924.patch
new file mode 100644
index 0000000000..9f3ac9ae39
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8924.patch
@@ -0,0 +1,127 @@
+From b9eaedeb9d5440eae886c0b33f4ee48859d7123d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 16 May 2026 00:19:09 +0200
+Subject: [PATCH] cookie: trim trailing dots when checking PSL
+
+Verified with test 1629
+
+Closes #21636
+
+CVE: CVE-2026-8924
+Upstream-Status: Backport [https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8]
+
+Backport Changes:
+- curl 8.7.1 performs the PSL check inline in Curl_cookie_add(). Apply the
+ upstream trailing-dot length normalization at that equivalent code path.
+- Register test1629 in the target-generated Makefile.inc instead of the newer
+ Makefile.am list.
+
+(cherry picked from commit 51beed175dbfc37da3113f6acce60c630c070ce8)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/cookie.c | 13 ++++++++--
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test1629 | 53 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 65 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test1629
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 67494d2855..11081e0ba0 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1032,12 +1032,21 @@ Curl_cookie_add(struct Curl_easy *data,
+ char lcookie[256];
+ size_t dlen = strlen(domain);
+ size_t clen = strlen(co->domain);
++
++ /* trim trailing dots */
++ if(dlen && (domain[dlen - 1] == '.'))
++ dlen--;
++ if(clen && (co->domain[clen - 1] == '.'))
++ clen--;
++
+ if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
+ const psl_ctx_t *psl = Curl_psl_use(data);
+ if(psl) {
+ /* the PSL check requires lowercase domain name and pattern */
+- Curl_strntolower(lcase, domain, dlen + 1);
+- Curl_strntolower(lcookie, co->domain, clen + 1);
++ Curl_strntolower(lcase, domain, dlen);
++ lcase[dlen] = 0;
++ Curl_strntolower(lcookie, co->domain, clen);
++ lcookie[clen] = 0;
+ acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
+ Curl_psl_release(data);
+ }
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 461eb37b92..9fd47df771 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -207,7 +207,7 @@ test1598 \
+ test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \
+ test1608 test1609 test1610 test1611 test1612 test1613 test1614 test1615 \
+ \
+-test1620 test1621 \
++test1620 test1621 test1629 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
+ \
+diff --git a/tests/data/test1629 b/tests/data/test1629
+new file mode 100644
+index 0000000000..6ee479ba31
+--- /dev/null
++++ b/tests/data/test1629
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 6
++Set-Cookie: something=1; Domain=co.uk.; Path=/
++
++-foo-
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++PSL
++cookies
++</features>
++<server>
++http
++</server>
++<name>
++cookies with trailing dot after PSL domain
++</name>
++<command>
++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: foo.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++GET / HTTP/1.1
++Host: bar.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index c006649a1b..6516c95030 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -42,6 +42,7 @@ SRC_URI = " \
file://CVE-2026-6253.patch \
file://CVE-2026-4873.patch \
file://CVE-2026-8286.patch \
+ file://CVE-2026-8924.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927
2026-09-04 9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-09-04 9:00 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04 9:00 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. The test-only prerequisite uses [3] to provide
positive digest-auth feature detection on curl 8.7.1.
[1] https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567
[2] https://curl.se/docs/CVE-2026-8927.html
[3] https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../curl/curl/CVE-2026-8927-dependent.patch | 41 ++
.../curl/curl/CVE-2026-8927.patch | 375 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 2 +
3 files changed, 418 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
new file mode 100644
index 0000000000..35ff6a9413
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
@@ -0,0 +1,41 @@
+From 9c85f980c3350b59736e4844da34e7f4b726e9c5 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 25 Apr 2025 08:16:13 +0200
+Subject: [PATCH] tests/buildinfo: former "disabled" now provides more info
+
+This tool now contains ON/OFF information about features in the build.
+This way, runtests gets both positive and negative feature presence with
+this. Allows for more flexibility and avoids having to duplicate the
+names.
+
+Closes #17180
+
+CVE: CVE-2026-8927
+Upstream-Status: Backport [https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385]
+
+Backport Changes:
+- curl 8.7.1 uses the older disabled helper rather than buildinfo. Initialize
+ digest-auth positively in runtests.pl and retain the existing disabled-list
+ pass to clear it when CURL_DISABLE_DIGEST_AUTH is configured.
+- Scope the backport to the digest-auth detection needed by tests 1647 and
+ 1686; omit the buildinfo rename and unrelated feature-reporting changes.
+
+(cherry picked from commit 1968b32afd8e41fbb87f8911d15c552c6b705385)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ tests/runtests.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/runtests.pl b/tests/runtests.pl
+index ddfab20e86..b40df554b2 100755
+--- a/tests/runtests.pl
++++ b/tests/runtests.pl
+@@ -637,6 +637,8 @@ sub checksystemfeatures {
+ $feature{"Kerberos"} = $feat =~ /Kerberos/i;
+ # SPNEGO enabled
+ $feature{"SPNEGO"} = $feat =~ /SPNEGO/i;
++ # Digest auth enabled unless disabled by build
++ $feature{"digest-auth"} = 1;
+ # CharConv enabled
+ $feature{"CharConv"} = $feat =~ /CharConv/i;
+ # TLS-SRP enabled
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927.patch b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
new file mode 100644
index 0000000000..d2bb76e91e
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
@@ -0,0 +1,375 @@
+From 66ff71c5c22eed2dfb9c5dbd925e83e37e0d732d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 18 May 2026 23:47:11 +0200
+Subject: [PATCH] url: detect proxy changes read from environment
+
+When a proxy is set from an environment variable, detect if that proxy
+is not the same as previously and flush state.
+
+Verified by test1647: verify changing proxy with env variables and make
+sure Digest state is flushed in the second use
+
+Closes #21666
+
+CVE: CVE-2026-8927
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567]
+
+Backport Changes:
+- curl 8.7.1 predates the curlx allocation aliases, so the new envproxy state
+ uses the equivalent free() and strdup() calls.
+- curl 8.7.1 frees the parsed proxy string earlier. Keep it alive until the
+ shared cleanup path so the new Digest-state comparison can use it safely.
+- Include vauth/vauth.h explicitly because the target's existing url.c
+ includes do not declare Curl_auth_digest_cleanup().
+- Register test1647 and lib1647 in the target-version Makefile.inc lists,
+ independently of lib1588 from CVE-2026-7168, and adapt the newer libtest
+ entry point to the 8.7.1 test harness.
+- Use the target harness feature names digest-auth and lowercase debug. The
+ preceding test-only dependency backports positive digest-auth detection
+ from curl commit 1968b32afd8e while retaining disabled-build detection.
+
+(cherry picked from commit 5c225384b8d52c67ce8259c6e4203bc57aacb567)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/url.c | 13 +++-
+ lib/urldata.h | 1 +
+ tests/data/Makefile.inc | 2 +
+ tests/data/test1647 | 103 ++++++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc | 5 ++
+ tests/libtest/lib1647.c | 124 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 247 insertions(+), 1 deletion(-)
+ create mode 100644 tests/data/test1647
+ create mode 100644 tests/libtest/lib1647.c
+
+diff --git a/lib/url.c b/lib/url.c
+index 9e1ca0336c..fe7639713a 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -79,6 +79,7 @@
+ #include "share.h"
+ #include "content_encoding.h"
+ #include "http_digest.h"
++#include "vauth/vauth.h"
+ #include "http_negotiate.h"
+ #include "select.h"
+ #include "multiif.h"
+@@ -331,6 +332,9 @@ CURLcode Curl_close(struct Curl_easy **datap)
+ Curl_wildcard_dtor(&data->wildcard);
+ Curl_freeset(data);
+ Curl_headers_cleanup(data);
++#ifndef CURL_DISABLE_DIGEST_AUTH
++ free(data->state.envproxy);
++#endif
+ free(data);
+ return CURLE_OK;
+ }
+@@ -2535,7 +2539,6 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
+ curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype;
+ if(proxy) {
+ result = parse_proxy(data, conn, proxy, ptype);
+- Curl_safefree(proxy); /* parse_proxy copies the proxy string */
+ if(result)
+ goto out;
+ }
+@@ -2554,6 +2557,14 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
+ result = CURLE_UNSUPPORTED_PROTOCOL;
+ goto out;
+ #else
++#ifndef CURL_DISABLE_DIGEST_AUTH
++ if(!Curl_safecmp(data->state.envproxy, proxy)) {
++ /* proxy changed */
++ Curl_auth_digest_cleanup(&data->state.proxydigest);
++ free(data->state.envproxy);
++ data->state.envproxy = strdup(proxy);
++ }
++#endif
+ /* force this connection's protocol to become HTTP if compatible */
+ if(!(conn->handler->protocol & PROTO_FAMILY_HTTP)) {
+ if((conn->handler->flags & PROTOPT_PROXY_AS_HTTP) &&
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 4fc595a639..d2d9424197 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1247,6 +1247,7 @@ struct UrlState {
+ void (*prev_signal)(int sig);
+ #endif
+ #ifndef CURL_DISABLE_DIGEST_AUTH
++ char *envproxy; /* last proxy string used for proxy-related state */
+ struct digestdata digest; /* state data for host Digest auth */
+ struct digestdata proxydigest; /* state data for proxy Digest auth */
+ #endif
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 3ec7fa4e21..7452061ea9 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -210,6 +210,8 @@ test1620 test1621 test1629 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
+ \
++test1647 \
++\
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 \
+ test1660 test1661 test1662 \
+ \
+diff --git a/tests/data/test1647 b/tests/data/test1647
+new file mode 100644
+index 0000000000..ecd1cf01c7
+--- /dev/null
++++ b/tests/data/test1647
+@@ -0,0 +1,103 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<connect crlf="headers">
++HTTP/1.1 401 OK
++Content-Length: 21
++Server: no
++
++Denied access. Leave
++</connect>
++
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++https-proxy
++https
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest-auth
++debug
++</features>
++<setenv>
++http_proxy=%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPROXYPORT
++CURL_ENTROPY=99376
++</setenv>
++<name>
++HTTP proxy auth Digest, then change proxy with env var and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++
++<proxy crlf="headers">
++CONNECT another.example.com:%HTTPSPORT HTTP/1.1
++Host: another.example.com:%HTTPSPORT
++Proxy-Connection: Keep-Alive
++
++</proxy>
++
++# CONNECT fails
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 9d3356aaf5..639d010a00 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -64,6 +64,8 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
+ lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \
+ lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
+ \
++ lib1647 \
++ \
+ lib1662 \
+ \
+ lib1900 \
+@@ -540,6 +542,9 @@ lib1597_LDADD = $(TESTUTIL_LIBS)
+ lib1598_SOURCES = lib1598.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib1598_LDADD = $(TESTUTIL_LIBS)
+
++lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
++lib1647_LDADD = $(TESTUTIL_LIBS)
++
+ lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib1662_LDADD = $(TESTUTIL_LIBS)
+
+diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c
+new file mode 100644
+index 0000000000..2cf4c30da9
+--- /dev/null
++++ b/tests/libtest/lib1647.c
+@@ -0,0 +1,124 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = the first URL
++ * argv2 = URL2
++ * argv3 = credentials 1
++ * argv4 = credentials 2
++ */
++
++#include "test.h"
++#include "testutil.h"
++
++/* this is meant to pick up the proxy from the environment variable */
++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
++{
++ int res = CURLE_OK;
++
++ res_easy_setopt(curl, CURLOPT_URL, url);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++ if(res)
++ goto init_failed;
++
++ return CURLE_OK; /* success */
++
++init_failed:
++ return (CURLcode)res; /* failure */
++}
++
++static CURLcode run1647(CURL *curl, const char *url, const char *userpwd)
++{
++ CURLcode res = CURLE_OK;
++
++ res = init1647(curl, url, userpwd);
++ if(res)
++ return res;
++
++ return curl_easy_perform(curl);
++}
++
++int test(char *URL)
++{
++ int res = CURLE_OK;
++ CURL *curl = NULL;
++
++ if(test_argc < 5)
++ return TEST_ERR_MAJOR_BAD;
++
++ res_global_init(CURL_GLOBAL_ALL);
++ if(res)
++ return res;
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ start_test_timing();
++
++ curl_mprintf("--- First get '%s'\n", URL);
++ res = run1647(curl, URL, libtest_arg3);
++ if(res)
++ goto test_cleanup;
++
++ curl_mprintf("--- Then get '%s'\n", libtest_arg2);
++ res = run1647(curl, libtest_arg2, test_argv[4]);
++
++test_cleanup:
++
++ /* proper cleanup sequence - type PB */
++
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++ return res;
++}
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 6516c95030..f22e69fba4 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -43,6 +43,8 @@ SRC_URI = " \
file://CVE-2026-4873.patch \
file://CVE-2026-8286.patch \
file://CVE-2026-8924.patch \
+ file://CVE-2026-8927-dependent.patch \
+ file://CVE-2026-8927.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932
2026-09-04 9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-09-04 9:00 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
4 siblings, 0 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04 9:00 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].
[1] https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e
[2] https://curl.se/docs/CVE-2026-8932.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../curl/curl/CVE-2026-8932.patch | 342 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 343 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8932.patch b/meta/recipes-support/curl/curl/CVE-2026-8932.patch
new file mode 100644
index 0000000000..c845826cb3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8932.patch
@@ -0,0 +1,342 @@
+From fc625fa247f68bc6a44bda391cd8c09bfc5ce5d5 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Tue, 19 May 2026 11:47:50 +0200
+Subject: [PATCH] tls: fix incomplete mTLS config in conn reuse and session
+ cache
+
+cert_type, key, key_type, key_passwd and key_blob lived in
+ssl_config_data but not in ssl_primary_config, so they were invisible to
+match_ssl_primary_config() and to the TLS session cache peer key.
+
+Two easy handles sharing a connection pool could reuse each other's
+authenticated connections when they differed only on SSLKEY, SSLKEYTYPE,
+KEYPASSWD, SSLCERTTYPE or SSLKEYBLOB. The second handle would silently
+inherit the first handle's authenticated identity.
+
+Promote all five fields into ssl_primary_config so the conn-reuse
+predicate and session cache key cover the complete client credential
+set. Also replace the fixed ":CCERT" session cache marker with the
+actual clientcert path so sessions are not shared across different
+client certificates.
+
+Verified by test 3303 and 3304
+
+Reported-By: Joshua Rogers (AISLE Research)
+Closes #21667
+
+CVE: CVE-2026-8932
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e]
+
+Backport Changes:
+- curl 8.7.1 keeps the session cache in vtls.c and stores backend key properties
+ outside ssl_primary_config. Duplicate those pointers into the primary
+ configuration so the upstream match, clone, and free behavior covers
+ connection and session reuse without moving every backend access.
+- Omitted backend-only field-access moves in ldap.c, vssh/, and vtls backends
+ because the target keeps the original ssl_config_data members as aliases.
+- Adapt unit3303 to the target curlcheck and test-data harnesses and allocation
+ helpers, and extend it with unit3304's case-insensitive cert_type/key_type
+ checks.
+- Omit newer vtls_scache.c/vtls_scache.h and unit3304 because their peer-key
+ API does not exist in 8.7.1. The target session cache instead uses the clone
+ and match functions in vtls.c, which the adapted unit3303 exercises.
+
+(cherry picked from commit 7541ae569d82fb308a5e2d94916027da4fa3ba3e)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/urldata.h | 5 ++
+ lib/vtls/vtls.c | 25 ++++++++
+ tests/data/Makefile.inc | 3 +-
+ tests/data/test3303 | 23 ++++++++
+ tests/unit/Makefile.inc | 4 +-
+ tests/unit/unit3303.c | 127 ++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 185 insertions(+), 2 deletions(-)
+ create mode 100644 tests/data/test3303
+ create mode 100644 tests/unit/unit3303.c
+
+diff --git a/lib/urldata.h b/lib/urldata.h
+index d2d9424197..9015515e17 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -286,6 +286,11 @@ struct ssl_primary_config {
+ char *CAfile; /* certificate to verify peer against */
+ char *issuercert; /* optional issuer certificate filename */
+ char *clientcert;
++ char *cert_type; /* format for certificate (default: PEM) */
++ char *key; /* private key file name */
++ struct curl_blob *key_blob;
++ char *key_type; /* format for private key (default: PEM) */
++ char *key_passwd; /* plain text private key password */
+ char *cipher_list; /* list of ciphers to use */
+ char *cipher_list13; /* list of TLS 1.3 cipher suites to use */
+ char *pinned_key;
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index d13a3cb1b7..c89e8abcc6 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -187,10 +187,15 @@ match_ssl_primary_config(struct Curl_easy *data,
+ blobcmp(c1->cert_blob, c2->cert_blob) &&
+ blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
+ blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
++ blobcmp(c1->key_blob, c2->key_blob) &&
+ Curl_safecmp(c1->CApath, c2->CApath) &&
+ Curl_safecmp(c1->CAfile, c2->CAfile) &&
+ Curl_safecmp(c1->issuercert, c2->issuercert) &&
+ Curl_safecmp(c1->clientcert, c2->clientcert) &&
++ curl_strequal(c1->cert_type, c2->cert_type) &&
++ Curl_safecmp(c1->key, c2->key) &&
++ curl_strequal(c1->key_type, c2->key_type) &&
++ !Curl_timestrcmp(c1->key_passwd, c2->key_passwd) &&
+ #ifdef USE_TLS_SRP
+ !Curl_timestrcmp(c1->username, c2->username) &&
+ !Curl_timestrcmp(c1->password, c2->password) &&
+@@ -234,10 +239,15 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+ CLONE_BLOB(cert_blob);
+ CLONE_BLOB(ca_info_blob);
+ CLONE_BLOB(issuercert_blob);
++ CLONE_BLOB(key_blob);
+ CLONE_STRING(CApath);
+ CLONE_STRING(CAfile);
+ CLONE_STRING(issuercert);
+ CLONE_STRING(clientcert);
++ CLONE_STRING(cert_type);
++ CLONE_STRING(key);
++ CLONE_STRING(key_type);
++ CLONE_STRING(key_passwd);
+ CLONE_STRING(cipher_list);
+ CLONE_STRING(cipher_list13);
+ CLONE_STRING(pinned_key);
+@@ -257,12 +267,17 @@ static void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
+ Curl_safefree(sslc->CAfile);
+ Curl_safefree(sslc->issuercert);
+ Curl_safefree(sslc->clientcert);
++ Curl_safefree(sslc->cert_type);
++ Curl_safefree(sslc->key);
++ Curl_safefree(sslc->key_type);
++ Curl_safefree(sslc->key_passwd);
+ Curl_safefree(sslc->cipher_list);
+ Curl_safefree(sslc->cipher_list13);
+ Curl_safefree(sslc->pinned_key);
+ Curl_safefree(sslc->cert_blob);
+ Curl_safefree(sslc->ca_info_blob);
+ Curl_safefree(sslc->issuercert_blob);
++ Curl_safefree(sslc->key_blob);
+ Curl_safefree(sslc->curves);
+ Curl_safefree(sslc->CRLfile);
+ #ifdef USE_TLS_SRP
+@@ -297,6 +312,11 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD];
+ data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
+ data->set.ssl.key_blob = data->set.blobs[BLOB_KEY];
++ data->set.ssl.primary.cert_type = data->set.ssl.cert_type;
++ data->set.ssl.primary.key = data->set.ssl.key;
++ data->set.ssl.primary.key_type = data->set.ssl.key_type;
++ data->set.ssl.primary.key_passwd = data->set.ssl.key_passwd;
++ data->set.ssl.primary.key_blob = data->set.ssl.key_blob;
+
+ #ifndef CURL_DISABLE_PROXY
+ data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
+@@ -322,6 +342,11 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
+ data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
+ data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY];
++ data->set.proxy_ssl.primary.cert_type = data->set.proxy_ssl.cert_type;
++ data->set.proxy_ssl.primary.key = data->set.proxy_ssl.key;
++ data->set.proxy_ssl.primary.key_type = data->set.proxy_ssl.key_type;
++ data->set.proxy_ssl.primary.key_passwd = data->set.proxy_ssl.key_passwd;
++ data->set.proxy_ssl.primary.key_blob = data->set.proxy_ssl.key_blob;
+ #ifdef USE_TLS_SRP
+ data->set.proxy_ssl.primary.username =
+ data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index b68e6b4562..02189d8cc6 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -265,4 +265,5 @@ test3024 test3025 test3026 test3027 test3028 test3029 test3030 \
+ \
+ test3100 test3101 test3102 test3103 \
+ test3200 \
+-test3201 test3202
++test3201 test3202 \
++test3303
+diff --git a/tests/data/test3303 b/tests/data/test3303
+new file mode 100644
+index 0000000000..9b52bcb817
+--- /dev/null
++++ b/tests/data/test3303
+@@ -0,0 +1,23 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++unittest
++TLS
++mTLS
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++none
++</server>
++<features>
++unittest
++</features>
++<name>
++conn-reuse match distinguishes mTLS key, cert_type, key_type and key_passwd fields
++</name>
++</client>
++</testcase>
+diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc
+index 1926b49b3a..afbe29d2b7 100644
+--- a/tests/unit/Makefile.inc
++++ b/tests/unit/Makefile.inc
+@@ -39,7 +39,7 @@ UNITPROGS = unit1300 unit1302 unit1303 unit1304 unit1305 unit1307 \
+ unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 unit1656 \
+ unit1660 unit1661 \
+ unit2600 unit2601 unit2602 unit2603 \
+- unit3200
++ unit3200 unit3303
+
+ unit1300_SOURCES = unit1300.c $(UNITFILES)
+
+@@ -134,3 +134,5 @@ unit2602_SOURCES = unit2602.c $(UNITFILES)
+ unit2603_SOURCES = unit2603.c $(UNITFILES)
+
+ unit3200_SOURCES = unit3200.c $(UNITFILES)
++
++unit3303_SOURCES = unit3303.c $(UNITFILES)
+diff --git a/tests/unit/unit3303.c b/tests/unit/unit3303.c
+new file mode 100644
+index 0000000000..060a9361fc
+--- /dev/null
++++ b/tests/unit/unit3303.c
+@@ -0,0 +1,127 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "curlcheck.h"
++#include "urldata.h"
++
++#ifdef USE_SSL
++#include "vtls/vtls.h"
++#endif
++
++static CURLcode unit_setup(void)
++{
++ return curl_global_init(CURL_GLOBAL_ALL);
++}
++
++static void unit_stop(void)
++{
++ curl_global_cleanup();
++}
++
++UNITTEST_START
++#ifdef USE_SSL
++{
++ CURL *curl;
++ struct connectdata *conn;
++ struct ssl_primary_config *primary;
++ char *saved;
++ static char alt_passwd[] = "wrong";
++ static char alt_key[] = "other.key";
++ static char alt_ktype[] = "DER";
++ static char alt_ctype[] = "P12";
++ static char lc_ctype[] = "pem";
++ static char lc_ktype[] = "pem";
++
++ curl = curl_easy_init();
++ abort_unless(curl, "curl_easy_init failed");
++
++ curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
++ curl_easy_setopt(curl, CURLOPT_SSLKEY, "client.key");
++ curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "secret");
++ curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
++ curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
++
++ abort_unless(!Curl_ssl_easy_config_complete((struct Curl_easy *)curl),
++ "Curl_ssl_easy_config_complete failed");
++
++ conn = calloc(1, sizeof(*conn));
++ abort_unless(conn, "connection allocation failed");
++ abort_unless(!Curl_ssl_conn_config_init((struct Curl_easy *)curl, conn),
++ "Curl_ssl_conn_config_init failed");
++
++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "identical mTLS config should match");
++
++ primary = &((struct Curl_easy *)curl)->set.ssl.primary;
++
++ saved = primary->key_passwd;
++ primary->key_passwd = alt_passwd;
++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "different key_passwd must not reuse conn");
++ primary->key_passwd = saved;
++
++ saved = primary->key;
++ primary->key = alt_key;
++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "different key must not reuse conn");
++ primary->key = saved;
++
++ saved = primary->key_type;
++ primary->key_type = alt_ktype;
++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "different key_type must not reuse conn");
++ primary->key_type = saved;
++
++ saved = primary->cert_type;
++ primary->cert_type = alt_ctype;
++ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "different cert_type must not reuse conn");
++ primary->cert_type = saved;
++
++ primary->cert_type = lc_ctype;
++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "cert_type comparison must be case-insensitive");
++ primary->cert_type = saved;
++
++ primary->key_type = lc_ktype;
++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "key_type comparison must be case-insensitive");
++ primary->key_type = saved;
++
++ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++ FALSE),
++ "restored mTLS config should match");
++
++ Curl_ssl_conn_config_cleanup(conn);
++ free(conn);
++ curl_easy_cleanup(curl);
++}
++#endif /* USE_SSL */
++UNITTEST_STOP
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index f22e69fba4..6a2c44365b 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -45,6 +45,7 @@ SRC_URI = " \
file://CVE-2026-8924.patch \
file://CVE-2026-8927-dependent.patch \
file://CVE-2026-8927.patch \
+ file://CVE-2026-8932.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547
2026-09-04 9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 preceding siblings ...)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-09-04 9:00 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
4 siblings, 0 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04 9:00 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. Backporting it also protects downstream
configurations that enable the libssh backend.
[1] https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1
[2] https://curl.se/docs/CVE-2026-9547.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../curl/curl/CVE-2026-9547.patch | 33 +++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9547.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-9547.patch b/meta/recipes-support/curl/curl/CVE-2026-9547.patch
new file mode 100644
index 0000000000..992ed21e4c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-9547.patch
@@ -0,0 +1,33 @@
+From 3f73b2318b9e6358e33519fa49dc3e022aa28c41 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Fri, 22 May 2026 09:48:15 +0200
+Subject: [PATCH] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
+
+Host key type mismatch from libssh was incorrectly reported as missing,
+causing key callbacks to accept instead of reject.
+
+Reported by: Joshua Rogers (Aisle Research)
+Closes #21724
+
+CVE: CVE-2026-9547
+Upstream-Status: Backport [https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1]
+
+(cherry picked from commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/vssh/libssh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+index 39067a1db6..00dae896bb 100644
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -439,6 +439,8 @@ static int myssh_is_known(struct Curl_easy *data)
+ keymatch = CURLKHMATCH_OK;
+ break;
+ case SSH_KNOWN_HOSTS_OTHER:
++ keymatch = CURLKHMATCH_MISMATCH;
++ break;
+ case SSH_KNOWN_HOSTS_NOT_FOUND:
+ case SSH_KNOWN_HOSTS_UNKNOWN:
+ case SSH_KNOWN_HOSTS_ERROR:
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 6a2c44365b..e9ba10cb97 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -46,6 +46,7 @@ SRC_URI = " \
file://CVE-2026-8927-dependent.patch \
file://CVE-2026-8927.patch \
file://CVE-2026-8932.patch \
+ file://CVE-2026-9547.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064
2026-09-04 9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (3 preceding siblings ...)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-09-04 9:00 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
4 siblings, 0 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04 9:00 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. The config2setopts.c change is adapted to curl
8.7.1's equivalent url_proto() implementation in tool_operate.c while
preserving upstream out-of-memory error propagation.
[1] https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e
[2] https://curl.se/docs/CVE-2026-12064.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../curl/curl/CVE-2026-12064.patch | 258 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 259 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-12064.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-12064.patch b/meta/recipes-support/curl/curl/CVE-2026-12064.patch
new file mode 100644
index 0000000000..4444401864
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-12064.patch
@@ -0,0 +1,258 @@
+From 1bdb3dbcc85bd754b8f5af73159decd926a0b7a4 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 12 Jun 2026 09:01:22 +0200
+Subject: [PATCH] config2setopts: use default protocol properly
+
+Verified by test 1724, 1725 and 2036
+
+Closes #21983
+
+CVE: CVE-2026-12064
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e]
+
+Backport Changes:
+- Adapt the config2setopts.c change to curl 8.7.1's equivalent url_proto()
+ implementation in tool_operate.c. Since CURLU_NO_GUESS_SCHEME is not
+ available, parse without scheme guessing when --proto-default is set and
+ use the configured default only when the URL has no explicit scheme.
+- Preserve upstream error handling by propagating CURLUE_OUT_OF_MEMORY from
+ both curl_url_set() and curl_url_get() as CURLE_OUT_OF_MEMORY.
+- Register the regression tests in the target Makefile.inc. Renumber upstream
+ test2036 to test1726 because test2036 already exists in curl 8.7.1. Use
+ the target's %SSH_PWD substitution in test1725. Declare the no-server
+ test1726 explicitly because the older test harness requires it.
+
+(cherry picked from commit ab3bb8cd8be8f9d4acb97da0418abc279182041e)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ docs/cmdline-opts/proto-default.md | 6 +++-
+ src/tool_operate.c | 45 +++++++++++++++----------
+ tests/data/Makefile.inc | 1 +
+ tests/data/test1724 | 53 ++++++++++++++++++++++++++++++
+ tests/data/test1725 | 29 ++++++++++++++++
+ tests/data/test1726 | 29 ++++++++++++++++
+ 6 files changed, 144 insertions(+), 19 deletions(-)
+ create mode 100644 tests/data/test1724
+ create mode 100644 tests/data/test1725
+ create mode 100644 tests/data/test1726
+
+diff --git a/docs/cmdline-opts/proto-default.md b/docs/cmdline-opts/proto-default.md
+index 209e5cdc83..903fac73a5 100644
+--- a/docs/cmdline-opts/proto-default.md
++++ b/docs/cmdline-opts/proto-default.md
+@@ -16,7 +16,8 @@ Example:
+
+ # `--proto-default`
+
+-Use *protocol* for any provided URL missing a scheme.
++Use *protocol* for any provided URL missing a scheme. The case-insensitive
++name should be given without any `://` suffix.
+
+ An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*.
+
+@@ -24,3 +25,6 @@ This option does not change the default proxy protocol (http).
+
+ Without this option set, curl guesses protocol based on the hostname, see
+ --url for details.
++
++The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to
++be used explicitly in the URL.
+diff --git a/src/tool_operate.c b/src/tool_operate.c
+index 7e2c1eefe0..c8059a40d9 100644
+--- a/src/tool_operate.c
++++ b/src/tool_operate.c
+@@ -704,26 +704,35 @@ static CURLcode url_proto(char **url,
+ if(*url) {
+ char *schemep = NULL;
+
+- if(!curl_url_set(uh, CURLUPART_URL, *url,
+- CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) &&
+- !curl_url_get(uh, CURLUPART_SCHEME, &schemep,
+- CURLU_DEFAULT_SCHEME)) {
+- if(curl_strequal(schemep, proto_ipfs) ||
+- curl_strequal(schemep, proto_ipns)) {
+- result = ipfs_url_rewrite(uh, schemep, url, config);
+- /* short-circuit proto_token, we know it's ipfs or ipns */
+- if(curl_strequal(schemep, proto_ipfs))
+- proto = proto_ipfs;
+- else if(curl_strequal(schemep, proto_ipns))
+- proto = proto_ipns;
+- if(result)
+- config->synthetic_error = TRUE;
++ CURLUcode uc =
++ curl_url_set(uh, CURLUPART_URL, *url,
++ CURLU_NON_SUPPORT_SCHEME |
++ (config->proto_default ? 0 : CURLU_GUESS_SCHEME));
++
++ if((uc == CURLUE_BAD_SCHEME) && config->proto_default)
++ proto = proto_token(config->proto_default);
++ else if(!uc) {
++ uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
++ CURLU_DEFAULT_SCHEME);
++ if(!uc) {
++ if(curl_strequal(schemep, proto_ipfs) ||
++ curl_strequal(schemep, proto_ipns)) {
++ result = ipfs_url_rewrite(uh, schemep, url, config);
++ /* short-circuit proto_token, we know it's ipfs or ipns */
++ if(curl_strequal(schemep, proto_ipfs))
++ proto = proto_ipfs;
++ else if(curl_strequal(schemep, proto_ipns))
++ proto = proto_ipns;
++ if(result)
++ config->synthetic_error = TRUE;
++ }
++ else
++ proto = proto_token(schemep);
+ }
+- else
+- proto = proto_token(schemep);
+-
+- curl_free(schemep);
+ }
++ if(uc == CURLUE_OUT_OF_MEMORY)
++ result = CURLE_OUT_OF_MEMORY;
++ curl_free(schemep);
+ }
+ curl_url_cleanup(uh);
+ }
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 9708e37b1f..da87400564 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -220,6 +220,7 @@ test1670 test1671 \
+ test1680 test1681 test1682 test1683 \
+ \
+ test1700 test1701 test1702 test1703 test1704 \
++test1724 test1725 test1726 \
+ \
+ test1800 test1801 \
+ \
+diff --git a/tests/data/test1724 b/tests/data/test1724
+new file mode 100644
+index 0000000000..3cd328e39c
+--- /dev/null
++++ b/tests/data/test1724
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++IPFS
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
++ETag: "21025-dc7-39462498"
++Accept-Ranges: bytes
++Content-Length: 21
++Connection: close
++Content-Type: text/plain
++Funny-head: yesyes
++
++Hello curl from IPFS
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++ipfs
++</features>
++<server>
++http
++</server>
++<name>
++IPFS with --proto-default HTTP
++</name>
++<command>
++--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test1725 b/tests/data/test1725
+new file mode 100644
+index 0000000000..e3b2c5abd2
+--- /dev/null
++++ b/tests/data/test1725
+@@ -0,0 +1,29 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++SCP
++server key check
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++scp
++</server>
++<name>
++SCP incorrect host key with --proto-default SCP
++</name>
++<command>
++--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<errorcode>
++60
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test1726 b/tests/data/test1726
+new file mode 100644
+index 0000000000..61f5b5dbd5
+--- /dev/null
++++ b/tests/data/test1726
+@@ -0,0 +1,29 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++--proto-default
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++none
++</server>
++<name>
++Attempt to set a default protocol with :// suffix
++</name>
++<command>
++--proto-default https://
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++# CURLE_UNSUPPORTED_PROTOCOL is error code 1
++<errorcode>
++1
++</errorcode>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index e9ba10cb97..267182aacd 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -47,6 +47,7 @@ SRC_URI = " \
file://CVE-2026-8927.patch \
file://CVE-2026-8932.patch \
file://CVE-2026-9547.patch \
+ file://CVE-2026-12064.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-04 9:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-04 9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04 9:00 ` [OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.