From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A4CDCA5FF1 for ; Wed, 7 Oct 2026 11:40:05 +0000 (UTC) Subject: Re: [scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286 To: openembedded-core@lists.openembedded.org From: "Devansh Patel" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.21) X-Originating-Platform: Windows Edge 154 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Wed, 07 Oct 2026 04:39:55 -0700 References: <20260904090007.27374-1-devanshp@cisco.com> In-Reply-To: Message-ID: <1690975.1791373195261402163@lists.openembedded.org> Content-Type: multipart/alternative; boundary="U14B4wZf8HODOtm8kJmh" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 07 Oct 2026 11:40:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247396 --U14B4wZf8HODOtm8kJmh Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Yoann, Thanks for the review. I regenerated the patches and also adapted few CVE_S= TATUSES from Wrynose, sent a new fresh v1 series combining CVEs with Deepak's two fixes for CVE-2= 026-6429 & CVE-2026-7168 : New Series: https://patchwork.yoctoproject.org/project/oe-core/list/?series= =3D51870 The series applies to Scarthgap and curl 8.7.1. Please consider my earlier = six-patch series superseded. Regards, Devansh On Fri, Sep 18, 2026 at 03:10 PM, Yoann Congal wrote: >=20 > On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via > lists.openembedded.org wrote: >=20 >> From: Devansh Patel >>=20 >> This patch applies the upstream fix as referenced in [2], using the >> commit shown in [1]. >>=20 >> [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de= 8319ad16 >>=20 >> [2] https://curl.se/docs/CVE-2026-8286.html >>=20 >> Signed-off-by: Devansh Patel >> --- >> .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++ >> meta/recipes-support/curl/curl_8.7.1.bb | 1 + >> 2 files changed, 61 insertions(+) >> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch >>=20 >> diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch >> b/meta/recipes-support/curl/curl/CVE-2026-8286.patch >> new file mode 100644 >> index 0000000000..ec2f6165c3 >> --- /dev/null >> +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch >> @@ -0,0 +1,60 @@ >> +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001 >> +From: Stefan Eissing >> +Date: Thu, 7 May 2026 10:30:07 +0200 >> +Subject: [PATCH] url: fix connection reuse for starttls protocols >> + >> +When a connection is tested for reuse in a transfer that *may* upgrade >> +to TLS (commonly via STARTTLS), the SSL configuration must match the >> +existing connection. >> + >> +Reported-by: Andrew Nesbit >> +Closes #21522 >> + >> +CVE: CVE-2026-8286 >> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/a86efdd= 7ca5433de9231e650f18247de8319ad16 >> ] >> + >> +Backport Changes: >> +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream >> may-TLS >> + and require-TLS distinction in ConnectionExists() and preserve the >> upstream >> + TLS configuration matching behavior. >> + >> +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16) >> +Signed-off-by: Devansh Patel >> +--- >> + lib/url.c | 9 +++++---- >> + 1 file changed, 5 insertions(+), 4 deletions(-) >> + >=20 > Hello, >=20 > This patch and the other ones in the series have formating issues: >=20 >=20 >> +diff --git a/lib/url.c b/lib/url.c >> +index dfcd6f4841..9e1ca0336c 100644 >> +--- a/lib/url.c >> ++++ b/lib/url.c >> +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data, >> + /* plain HTTP with upgrade */ >> + bool h2upgrade =3D (data->state.httpwant =3D=3D CURL_HTTP_VERSION_2_0)= && >> + (needle->handler->protocol & CURLPROTO_HTTP); >> +- bool req_tls =3D data->set.use_ssl >=3D CURLUSESSL_CONTROL; >> ++ bool require_tls =3D data->set.use_ssl >=3D CURLUSESSL_CONTROL; >> ++ bool may_tls =3D data->set.use_ssl > CURLUSESSL_NONE; >> + >=20 > ^ For exemple, here it lacks a space to mark context. >=20 > If you use interdiff to compare the upstream patch and yours, it is > quite noticeable. >=20 > Can you send a v2 with those fixed? >=20 > Thanks! > -- > Yoann Congal > Smile ECS --U14B4wZf8HODOtm8kJmh Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
Hi Yoann,

Thanks for the review. I regenerated the patches = and also adapted few CVE_STATUSES from Wrynose,
sent a new fresh v1 se= ries combining CVEs with Deepak's two fixes for CVE-2026-6429 & CVE-202= 6-7168 :

New Series: https://patchwork.yoctoproject.org/project/= oe-core/list/?series=3D51870

The series applies to Scarthgap and= curl 8.7.1. Please consider my earlier six-patch series superseded.
<= br />Regards,
Devansh

On Fri, Sep 18, 2026 at 03:10 PM, Yoa= nn Congal wrote:
On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via lists.op= enembedded.org wrote:
From: Devansh Patel <devanshp@cisco.com>

This = patch applies the upstream fix as referenced in [2], using the
commit = shown in [1].

[1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319= ad16
[2] https://curl.se/docs/CVE-2026-8286.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---<= br />.../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++
meta/r= ecipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 61 insertions= (+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.pa= tch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.pa= tch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
new file mode= 100644
index 0000000000..ec2f6165c3
--- /dev/null
+++ b/met= a/recipes-support/curl/curl/CVE-2026-8286.patch
@@ -0,0 +1,60 @@
= +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2= 026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for sta= rttls protocols
+
+When a connection is tested for reuse in a tra= nsfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL conf= iguration must match the
+existing connection.
+
+Reported-b= y: Andrew Nesbit
+Closes #21522
+
+CVE: CVE-2026-8286
+= Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad= 16]
+
+Backport Changes:
+- curl 8.7.1 predates the url_= conn_match refactor. Carry the upstream may-TLS
+ and require-TLS dist= inction in ConnectionExists() and preserve the upstream
+ TLS configur= ation matching behavior.
+
+(cherry picked from commit a86efdd7ca= 5433de9231e650f18247de8319ad16)
+Signed-off-by: Devansh Patel <deva= nshp@cisco.com>
+---
+ lib/url.c | 9 +++++----
+ 1 file c= hanged, 5 insertions(+), 4 deletions(-)
+
Hello,

This patch and the other ones in the series have formatin= g issues:

+diff --git a/lib/url.c b/lib/url.c
+index dfcd6f4841..9e1= ca0336c 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,7 = +935,8 @@ ConnectionExists(struct Curl_easy *data,
+ /* plain HTTP wit= h upgrade */
+ bool h2upgrade =3D (data->state.httpwant =3D=3D CURL= _HTTP_VERSION_2_0) &&
+ (needle->handler->protocol &= CURLPROTO_HTTP);
+- bool req_tls =3D data->set.use_ssl >=3D CUR= LUSESSL_CONTROL;
++ bool require_tls =3D data->set.use_ssl >=3D = CURLUSESSL_CONTROL;
++ bool may_tls =3D data->set.use_ssl > CURL= USESSL_NONE;
+
^ For exemple, here it lacks a space to mark context.

If you use= interdiff to compare the upstream patch and yours, it is
quite notice= able.

Can you send a v2 with those fixed?

Thanks!
--
Yoann Congal
Smile ECS
--U14B4wZf8HODOtm8kJmh--