Re: [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> [1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a
> [2] https://curl.se/docs/CVE-2026-82208.html
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
>  .../curl/curl/CVE-2026-82208.patch            | 52 +++++++++++++++++++
>  meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
>  2 files changed, 53 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
> new file mode 100644
> index 0000000000..2c733de210
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
> @@ -0,0 +1,52 @@
> +From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001
> +From: Stefan Eissing <stefan@eissing.org>
> +Date: Wed, 26 Aug 2026 13:46:13 +0200
> +Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice
> +
> +The flag preventing a rerun was not set when a cached_store
> +was used.
> +
> +CURL_UNCONST an ech string for my old wolfssl version
> +
> +Closes #22689
> +
> +CVE: CVE-2026-82208
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a]
> +
> +Backport Changes:
> +- Omitted the unrelated CURL_UNCONST ECH compatibility change because
> +  curl 8.19.0 uses a mutable ECH configuration string and a different
> +  code path.

Can you justify this? How can I know that difference from upstream just
broke ECH or introduced a vulnerability?

Regards,
-- 
Yoann Congal
Smile ECS