Re: [OE-core][wrynose][PATCH 1/8] curl: fix CVE-2026-8286

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Aug 26, 2026 at 10:47 AM CEST, Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
> Thank you for your review and feedback.
> These patches were originally prepared on top of the curl CVE fix
> series that is currently under review and already present in the
> wrynose/wrynose-nut review branches:
>
>   *
> curl: fix CVE-2026-4873 - openembedded-core-contrib - OpenEmbedded Core user contribution trees<https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/wrynose-nut&id=7e44b94a57a1b7d9ec043554fb7f1f4c3fbfbbaf>
>   *
> [wrynose,v4] curl: fix CVE-2026-4873 - Patchwork<https://patchwork.yoctoproject.org/project/oe-core/patch/20260731061427.14543-1-deeratho@cisco.com/>
>
> Because the remaining curl CVE patches in this series were developed
> on top of that patch, rebasing everything on the current wrynose
> review branch would require additional rebasing work once
> CVE-2026-4873 is merged. If you apply current curl patches on top of
> this CVE-2026-4873 fix, then there will be no build failure. Could you
> please advise on the preferred approach in this situation?
> I appreciate your guidance.
> Regards,
> Deepak Rathore

Ok, there was a bad interaction with other curl patches in my series but
those are gone now.
So, this series does apply cleanly and I've added it to my review
branch.

Thanks!

> ________________________________
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: Tuesday, August 25, 2026 8:34 PM
> To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <deeratho@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core][wrynose][PATCH 1/8] curl: fix CVE-2026-8286
>
> On Wed Aug 5, 2026 at 10:30 AM CEST, Deepak Rathore via lists.openembedded.org wrote:
>> From: Deepak Rathore <deeratho@cisco.com>
>>
>> This patch applies the upstream curl security fix backport for
>> CVE-2026-8286. The upstream fix commit is referenced in [1],
>> and the public curl advisory is referenced in [2]. The backported
>> commit link is also recorded in the embedded patch header.
>>
>> [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
>> [2] https://curl.se/docs/CVE-2026-8286.html
>>
>> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
>> ---
>>  .../curl/curl/CVE-2026-8286.patch             | 81 +++++++++++++++++++
>>  meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
>>  2 files changed, 82 insertions(+)
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
>
> Hello,
>
> This series does not apply on top of the review branch anymore:
> https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
> |ERROR: curl-8.19.0-r0 do_patch: Applying patch '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl/CVE-2026-8927.patch' on target directory '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/sources/curl-8.19.0'
> |CmdError('quilt --quiltrc .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-8927.patch
> |patching file lib/url.c
> |patching file lib/urldata.h
> |patching file tests/data/Makefile.am
> |Hunk #1 FAILED at 218.
> |1 out of 1 hunk FAILED -- rejects in file tests/data/Makefile.am
> |patching file tests/data/test1647
> |patching file tests/libtest/Makefile.inc
> |Hunk #1 FAILED at 100.
> |1 out of 1 hunk FAILED -- rejects in file tests/libtest/Makefile.inc
> |patching file tests/libtest/lib1647.c
> |Patch CVE-2026-8927.patch does not apply (enforce with -f)
> |
> |stderr: ')
> |ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/temp/log.do_patch.468848
> |ERROR: Task (.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl_8.19.0.bb:do_patch) failed with exit code '1'
>
> Can you please rebase and send a v2?
>
> Please note that there are other pending curl CVE patches, I'd recommand
> reviewing/testing patches to identify conflict at the earliest.
>
> Thanks!
> --
> Yoann Congal
> Smile ECS


-- 
Yoann Congal
Smile ECS