Re: [scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286

["Devansh Patel" <devanshp@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 3447 bytes --]

Hi Yoann,

Thanks for the review. I regenerated the patches and also adapted few CVE_STATUSES from Wrynose,
sent a new fresh v1 series combining CVEs with Deepak's two fixes for CVE-2026-6429 & CVE-2026-7168 :

New Series: https://patchwork.yoctoproject.org/project/oe-core/list/?series=51870

The series applies to Scarthgap and curl 8.7.1. Please consider my earlier six-patch series superseded.

Regards,
Devansh

On Fri, Sep 18, 2026 at 03:10 PM, Yoann Congal wrote:

> 
> On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via
> lists.openembedded.org wrote:
> 
>> From: Devansh Patel <devanshp@cisco.com>
>> 
>> This patch applies the upstream fix as referenced in [2], using the
>> commit shown in [1].
>> 
>> [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
>> 
>> [2] https://curl.se/docs/CVE-2026-8286.html
>> 
>> Signed-off-by: Devansh Patel <devanshp@cisco.com>
>> ---
>> .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++
>> meta/recipes-support/curl/curl_8.7.1.bb | 1 +
>> 2 files changed, 61 insertions(+)
>> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> 
>> diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> new file mode 100644
>> index 0000000000..ec2f6165c3
>> --- /dev/null
>> +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> @@ -0,0 +1,60 @@
>> +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
>> +From: Stefan Eissing <stefan@eissing.org>
>> +Date: Thu, 7 May 2026 10:30:07 +0200
>> +Subject: [PATCH] url: fix connection reuse for starttls protocols
>> +
>> +When a connection is tested for reuse in a transfer that *may* upgrade
>> +to TLS (commonly via STARTTLS), the SSL configuration must match the
>> +existing connection.
>> +
>> +Reported-by: Andrew Nesbit
>> +Closes #21522
>> +
>> +CVE: CVE-2026-8286
>> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
>> ]
>> +
>> +Backport Changes:
>> +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream
>> may-TLS
>> + and require-TLS distinction in ConnectionExists() and preserve the
>> upstream
>> + TLS configuration matching behavior.
>> +
>> +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
>> +Signed-off-by: Devansh Patel <devanshp@cisco.com>
>> +---
>> + lib/url.c | 9 +++++----
>> + 1 file changed, 5 insertions(+), 4 deletions(-)
>> +
> 
> Hello,
> 
> This patch and the other ones in the series have formating issues:
> 
> 
>> +diff --git a/lib/url.c b/lib/url.c
>> +index dfcd6f4841..9e1ca0336c 100644
>> +--- a/lib/url.c
>> ++++ b/lib/url.c
>> +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
>> + /* plain HTTP with upgrade */
>> + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
>> + (needle->handler->protocol & CURLPROTO_HTTP);
>> +- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
>> ++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
>> ++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
>> +
> 
> ^ For exemple, here it lacks a space to mark context.
> 
> If you use interdiff to compare the upstream patch and yours, it is
> quite noticeable.
> 
> Can you send a v2 with those fixed?
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

[-- Attachment #2: Type: text/html, Size: 4028 bytes --]