Re: [OE-core] [wrynose][PATCH] curl: fix CVE-2026-80230

["Yoann Congal" <yoann.congal@smile.fr>]

On Sun Oct 18, 2026 at 3:18 PM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> Hi Yoann, Jaipaul,
>
> I’m preparing a six-patch curl CVE fix series for Wrynose. One of the
> patches addresses CVE-2026-80230 using the same upstream fix and curl
> 8.19.0 adaptation as Jaipaul’s submission here. The other five patches
> address additional CVEs.
>
> Would you prefer that I submit the complete series with the overlap
> noted in the cover letter, or omit the CVE-2026-80230 patch and submit
> the remaining five based on Jaipaul’s change?

Hello,

Send it on top of Jaipaul's please. No need to resend the CVE-2026-80230
patch.

Thanks!

>
> Thanks,
> Darsh
>
> On Fri, Oct 16, 2026 at 07:10 PM, Jaipaul Cheernam wrote:
>
>> 
>> Backport the upstream fix [1] as mentioned in [2]
>> 
>> [1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
>> [2] https://curl.se/docs/CVE-2026-80230.html
>> 
>> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> ---
>> Note: SRC_URI indentation is corrected by devtool
>> 
>> .../curl/curl/CVE-2026-80230.patch | 68 +++++++++++++++++++
>> meta/recipes-support/curl/curl_8.19.0.bb | 62 ++++++++---------
>> 2 files changed, 99 insertions(+), 31 deletions(-)
>> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> 
>> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> new file mode 100644
>> index 0000000000..5a6bb35986
>> --- /dev/null
>> +++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> @@ -0,0 +1,68 @@
>> +From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001
>> +From: Daniel Stenberg <daniel@haxx.se>
>> +Date: Mon, 24 Aug 2026 23:37:49 +0200
>> +Subject: [PATCH] openssl: no server cert is only okay if also not pinned
>> +
>> +Reported-by: Stanislav Fort
>> +Closes #22660
>> +
>> +CVE: CVE-2026-80230
>> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef
>> ]
>> +
>> +Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned()
>> +accesses data->set.str[] directly instead.
>> +
>> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> +---
>> + lib/vtls/openssl.c | 26 +++++++++++++++-----------
>> + 1 file changed, 15 insertions(+), 11 deletions(-)
>> +
>> +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
>> +index 1cf357c..cb6fcc4 100644
>> +--- a/lib/vtls/openssl.c
>> ++++ b/lib/vtls/openssl.c
>> +@@ -4607,21 +4607,24 @@ out:
>> + return result;
>> + }
>> +
>> +-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
>> +- struct Curl_easy *data,
>> +- X509 *server_cert)
>> ++static const char *pinned(struct Curl_cfilter *cf,
>> ++ struct Curl_easy *data)
>> + {
>> +- const char *ptr;
>> +- CURLcode result = CURLE_OK;
>> +-
>> + (void)cf;
>> ++ return
>> + #ifndef CURL_DISABLE_PROXY
>> +- ptr = Curl_ssl_cf_is_proxy(cf) ?
>> ++ Curl_ssl_cf_is_proxy(cf) ?
>> + data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
>> +- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
>> +-#else
>> +- ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
>> + #endif
>> ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY];
>> ++}
>> ++
>> ++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
>> ++ struct Curl_easy *data,
>> ++ X509 *server_cert)
>> ++{
>> ++ CURLcode result = CURLE_OK;
>> ++ const char *ptr = pinned(cf, data);
>> + if(ptr) {
>> + result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
>> + if(result)
>> +@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct
>> Curl_cfilter *cf,
>> + server_cert = SSL_get1_peer_certificate(octx->ssl);
>> + if(!server_cert) {
>> + /* no verification at all, this maybe acceptable */
>> +- if(!(conn_config->verifypeer || conn_config->verifyhost))
>> ++ if(!(conn_config->verifypeer || conn_config->verifyhost) &&
>> ++ !pinned(cf, data))
>> + goto out;
>> +
>> + failf(data, "SSL: could not get peer certificate");
>> diff --git a/meta/recipes-support/curl/curl_8.19.0.bb
>> b/meta/recipes-support/curl/curl_8.19.0.bb
>> index 0573e08ea4..c2697d6dd8 100644
>> --- a/meta/recipes-support/curl/curl_8.19.0.bb
>> +++ b/meta/recipes-support/curl/curl_8.19.0.bb
>> @@ -9,37 +9,37 @@ SECTION = "console/network"
>> LICENSE = "curl"
>> LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc"
>> 
>> -SRC_URI = " \
>> - https://curl.se/download/ ${BP}.tar.xz \
>> - file://run-ptest \
>> - file://disable-tests \
>> - file://no-test-timeout.patch \
>> - file://CVE-2026-6276.patch \
>> - file://CVE-2026-5773.patch \
>> - file://mbedtls.patch \
>> - file://CVE-2026-5545.patch \
>> - file://CVE-2026-6253.patch \
>> - file://CVE-2026-6429-dependent.patch \
>> - file://CVE-2026-6429.patch \
>> - file://CVE-2026-7168.patch \
>> - file://CVE-2026-4873.patch \
>> - file://CVE-2026-8286.patch \
>> - file://CVE-2026-8927.patch \
>> - file://CVE-2026-8932-dependent.patch \
>> - file://CVE-2026-8932.patch \
>> - file://CVE-2026-11352.patch \
>> - file://CVE-2026-11586.patch \
>> - file://CVE-2026-7009.patch \
>> - file://CVE-2026-8925.patch \
>> - file://CVE-2026-9080.patch \
>> - file://CVE-2026-9545-01.patch \
>> - file://CVE-2026-9545-02.patch \
>> - file://CVE-2026-9079.patch \
>> - file://CVE-2026-13608.patch \
>> - file://CVE-2026-80229.patch \
>> - file://CVE-2026-9546-01.patch \
>> - file://CVE-2026-9546-02.patch \
>> -"
>> +SRC_URI = " https://curl.se/download/ ${BP}.tar.xz \
>> + file://run-ptest \
>> + file://disable-tests \
>> + file://no-test-timeout.patch \
>> + file://CVE-2026-6276.patch \
>> + file://CVE-2026-5773.patch \
>> + file://mbedtls.patch \
>> + file://CVE-2026-5545.patch \
>> + file://CVE-2026-6253.patch \
>> + file://CVE-2026-6429-dependent.patch \
>> + file://CVE-2026-6429.patch \
>> + file://CVE-2026-7168.patch \
>> + file://CVE-2026-4873.patch \
>> + file://CVE-2026-8286.patch \
>> + file://CVE-2026-8927.patch \
>> + file://CVE-2026-8932-dependent.patch \
>> + file://CVE-2026-8932.patch \
>> + file://CVE-2026-11352.patch \
>> + file://CVE-2026-11586.patch \
>> + file://CVE-2026-7009.patch \
>> + file://CVE-2026-8925.patch \
>> + file://CVE-2026-9080.patch \
>> + file://CVE-2026-9545-01.patch \
>> + file://CVE-2026-9545-02.patch \
>> + file://CVE-2026-9079.patch \
>> + file://CVE-2026-13608.patch \
>> + file://CVE-2026-80229.patch \
>> + file://CVE-2026-9546-01.patch \
>> + file://CVE-2026-9546-02.patch \
>> + file://CVE-2026-80230.patch \
>> + "
>> 
>> SRC_URI:append:class-nativesdk = " \
>> file://environment.d-curl.sh \


-- 
Yoann Congal
Smile ECS