Re: [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> Restore the upstream native CA and proxy-origin comments while
> retaining the curl 8.19.0 option-completion API.
>
> [1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891
> [2] https://curl.se/docs/CVE-2026-11564.html
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
>  .../curl/curl/CVE-2026-11564.patch            | 132 ++++++++++++++++++
>  meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
>  2 files changed, 133 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
> new file mode 100644
> index 0000000000..539236228c
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
> @@ -0,0 +1,132 @@
> +From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001
> +From: Stefan Eissing <stefan@eissing.org>
> +Date: Mon, 8 Jun 2026 10:11:30 +0200
> +Subject: [PATCH] ssl native_ca_store: always reinit
> +
> +Add bit `native_ca_store_opt` to keep the setting of
> +CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy
> +transfer if a native CA store shall be used or not.
> +
> +This avoids `native_ca_store` getting stuck on TRUE after being set
> +once.
> +
> +Closes #21902
> +
> +CVE: CVE-2026-11564
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891]
> +
> +Backport Changes:
> +- Applied the option-completion helper to lib/vtls/vtls.c because curl
> +  8.19.0 does not have lib/vtls/vtls_config.c.
> +- Retained the curl 8.19.0 auto-client-certificate behavior because the
> +  later initial-origin tracking API is not available.
Isn't that a vuln in itself? Something like certificate confusion?

Regards,
-- 
Yoann Congal
Smile ECS