Re: [OE-core][wrynose][PATCH 1/8] curl: fix CVE-2026-8286

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Aug 5, 2026 at 10:30 AM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream curl security fix backport for
> CVE-2026-8286. The upstream fix commit is referenced in [1],
> and the public curl advisory is referenced in [2]. The backported
> commit link is also recorded in the embedded patch header.
>
> [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
> [2] https://curl.se/docs/CVE-2026-8286.html
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> ---
>  .../curl/curl/CVE-2026-8286.patch             | 81 +++++++++++++++++++
>  meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
>  2 files changed, 82 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch

Hello,

This series does not apply on top of the review branch anymore:
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
|ERROR: curl-8.19.0-r0 do_patch: Applying patch '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl/CVE-2026-8927.patch' on target directory '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/sources/curl-8.19.0'
|CmdError('quilt --quiltrc .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-8927.patch
|patching file lib/url.c
|patching file lib/urldata.h
|patching file tests/data/Makefile.am
|Hunk #1 FAILED at 218.
|1 out of 1 hunk FAILED -- rejects in file tests/data/Makefile.am
|patching file tests/data/test1647
|patching file tests/libtest/Makefile.inc
|Hunk #1 FAILED at 100.
|1 out of 1 hunk FAILED -- rejects in file tests/libtest/Makefile.inc
|patching file tests/libtest/lib1647.c
|Patch CVE-2026-8927.patch does not apply (enforce with -f)
|
|stderr: ')
|ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/temp/log.do_patch.468848
|ERROR: Task (.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl_8.19.0.bb:do_patch) failed with exit code '1'

Can you please rebase and send a v2?

Please note that there are other pending curl CVE patches, I'd recommand
reviewing/testing patches to identify conflict at the earliest.

Thanks!
-- 
Yoann Congal
Smile ECS