All of lore.kernel.org
 help / color / mirror / Atom feed
* [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286
@ 2026-09-04  9:00 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
  2026-09-04  9:00 ` [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-04  9:00 UTC (permalink / raw)
  To: openembedded-core; +Cc: xe-linux-external

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
[2] https://curl.se/docs/CVE-2026-8286.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-8286.patch             | 60 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
new file mode 100644
index 0000000000..ec2f6165c3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
@@ -0,0 +1,60 @@
+From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+CVE: CVE-2026-8286
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
+
+Backport Changes:
+- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream may-TLS
+  and require-TLS distinction in ConnectionExists() and preserve the upstream
+  TLS configuration matching behavior.
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/url.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index dfcd6f4841..9e1ca0336c 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
+   /* plain HTTP with upgrade */
+   bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
+     (needle->handler->protocol & CURLPROTO_HTTP);
+-  bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+
+   *usethis = NULL;
+   *force_reuse = FALSE;
+@@ -1054,7 +1055,7 @@ ConnectionExists(struct Curl_easy *data,
+         continue;
+
+     if(!(needle->handler->flags & PROTOPT_SSL) &&
+-       req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
++       require_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
+       continue;
+
+     if(needle->bits.conn_to_host != check->bits.conn_to_host)
+@@ -1202,8 +1203,8 @@ ConnectionExists(struct Curl_easy *data,
+          needle->remote_port != check->remote_port)
+         continue;
+
+-      /* If talking TLS, check needs to use the same SSL options. */
+-      if((needle->handler->flags & PROTOPT_SSL) &&
++      /* If talking/upgrading to TLS, check needs the same SSL options. */
++      if(((needle->handler->flags & PROTOPT_SSL) || may_tls) &&
+          !Curl_ssl_conn_config_match(data, check, FALSE)) {
+         DEBUGF(infof(data,
+                      "Connection #%" CURL_FORMAT_CURL_OFF_T
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 365f02ad59..c006649a1b 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -41,6 +41,7 @@ SRC_URI = " \
     file://CVE-2026-5545.patch \
     file://CVE-2026-6253.patch \
     file://CVE-2026-4873.patch \
+    file://CVE-2026-8286.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6



^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-04  9:00 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-04  9:00 [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04  9:00 ` [OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04  9:00 ` [OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04  9:00 ` [OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04  9:00 ` [OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-09-04  9:00 ` [OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.