* [wrynose][PATCH] curl: fix CVE-2026-80230
@ 2026-10-16 13:40 Jaipaul Cheernam
2026-10-18 13:18 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 1 reply; 3+ messages in thread
From: Jaipaul Cheernam @ 2026-10-16 13:40 UTC (permalink / raw)
To: openembedded-core
Backport the upstream fix [1] as mentioned in [2]
[1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
[2] https://curl.se/docs/CVE-2026-80230.html
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
Note: SRC_URI indentation is corrected by devtool
.../curl/curl/CVE-2026-80230.patch | 68 +++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 62 ++++++++---------
2 files changed, 99 insertions(+), 31 deletions(-)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
new file mode 100644
index 0000000000..5a6bb35986
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
@@ -0,0 +1,68 @@
+From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 24 Aug 2026 23:37:49 +0200
+Subject: [PATCH] openssl: no server cert is only okay if also not pinned
+
+Reported-by: Stanislav Fort
+Closes #22660
+
+CVE: CVE-2026-80230
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef]
+
+Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned()
+accesses data->set.str[] directly instead.
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ lib/vtls/openssl.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 1cf357c..cb6fcc4 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -4607,21 +4607,24 @@ out:
+ return result;
+ }
+
+-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
+- struct Curl_easy *data,
+- X509 *server_cert)
++static const char *pinned(struct Curl_cfilter *cf,
++ struct Curl_easy *data)
+ {
+- const char *ptr;
+- CURLcode result = CURLE_OK;
+-
+ (void)cf;
++ return
+ #ifndef CURL_DISABLE_PROXY
+- ptr = Curl_ssl_cf_is_proxy(cf) ?
++ Curl_ssl_cf_is_proxy(cf) ?
+ data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
+- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+-#else
+- ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+ #endif
++ data->set.str[STRING_SSL_PINNEDPUBLICKEY];
++}
++
++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
++ struct Curl_easy *data,
++ X509 *server_cert)
++{
++ CURLcode result = CURLE_OK;
++ const char *ptr = pinned(cf, data);
+ if(ptr) {
+ result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
+ if(result)
+@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+ server_cert = SSL_get1_peer_certificate(octx->ssl);
+ if(!server_cert) {
+ /* no verification at all, this maybe acceptable */
+- if(!(conn_config->verifypeer || conn_config->verifyhost))
++ if(!(conn_config->verifypeer || conn_config->verifyhost) &&
++ !pinned(cf, data))
+ goto out;
+
+ failf(data, "SSL: could not get peer certificate");
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 0573e08ea4..c2697d6dd8 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -9,37 +9,37 @@ SECTION = "console/network"
LICENSE = "curl"
LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc"
-SRC_URI = " \
- https://curl.se/download/${BP}.tar.xz \
- file://run-ptest \
- file://disable-tests \
- file://no-test-timeout.patch \
- file://CVE-2026-6276.patch \
- file://CVE-2026-5773.patch \
- file://mbedtls.patch \
- file://CVE-2026-5545.patch \
- file://CVE-2026-6253.patch \
- file://CVE-2026-6429-dependent.patch \
- file://CVE-2026-6429.patch \
- file://CVE-2026-7168.patch \
- file://CVE-2026-4873.patch \
- file://CVE-2026-8286.patch \
- file://CVE-2026-8927.patch \
- file://CVE-2026-8932-dependent.patch \
- file://CVE-2026-8932.patch \
- file://CVE-2026-11352.patch \
- file://CVE-2026-11586.patch \
- file://CVE-2026-7009.patch \
- file://CVE-2026-8925.patch \
- file://CVE-2026-9080.patch \
- file://CVE-2026-9545-01.patch \
- file://CVE-2026-9545-02.patch \
- file://CVE-2026-9079.patch \
- file://CVE-2026-13608.patch \
- file://CVE-2026-80229.patch \
- file://CVE-2026-9546-01.patch \
- file://CVE-2026-9546-02.patch \
-"
+SRC_URI = "https://curl.se/download/${BP}.tar.xz \
+ file://run-ptest \
+ file://disable-tests \
+ file://no-test-timeout.patch \
+ file://CVE-2026-6276.patch \
+ file://CVE-2026-5773.patch \
+ file://mbedtls.patch \
+ file://CVE-2026-5545.patch \
+ file://CVE-2026-6253.patch \
+ file://CVE-2026-6429-dependent.patch \
+ file://CVE-2026-6429.patch \
+ file://CVE-2026-7168.patch \
+ file://CVE-2026-4873.patch \
+ file://CVE-2026-8286.patch \
+ file://CVE-2026-8927.patch \
+ file://CVE-2026-8932-dependent.patch \
+ file://CVE-2026-8932.patch \
+ file://CVE-2026-11352.patch \
+ file://CVE-2026-11586.patch \
+ file://CVE-2026-7009.patch \
+ file://CVE-2026-8925.patch \
+ file://CVE-2026-9080.patch \
+ file://CVE-2026-9545-01.patch \
+ file://CVE-2026-9545-02.patch \
+ file://CVE-2026-9079.patch \
+ file://CVE-2026-13608.patch \
+ file://CVE-2026-80229.patch \
+ file://CVE-2026-9546-01.patch \
+ file://CVE-2026-9546-02.patch \
+ file://CVE-2026-80230.patch \
+ "
SRC_URI:append:class-nativesdk = " \
file://environment.d-curl.sh \
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [wrynose][PATCH] curl: fix CVE-2026-80230
2026-10-16 13:40 [wrynose][PATCH] curl: fix CVE-2026-80230 Jaipaul Cheernam
@ 2026-10-18 13:18 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-18 22:02 ` [OE-core] " Yoann Congal
0 siblings, 1 reply; 3+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-18 13:18 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 6337 bytes --]
Hi Yoann, Jaipaul,
I’m preparing a six-patch curl CVE fix series for Wrynose. One of the patches addresses CVE-2026-80230 using the same upstream fix and curl 8.19.0 adaptation as Jaipaul’s submission here. The other five patches address additional CVEs.
Would you prefer that I submit the complete series with the overlap noted in the cover letter, or omit the CVE-2026-80230 patch and submit the remaining five based on Jaipaul’s change?
Thanks,
Darsh
On Fri, Oct 16, 2026 at 07:10 PM, Jaipaul Cheernam wrote:
>
> Backport the upstream fix [1] as mentioned in [2]
>
> [1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
> [2] https://curl.se/docs/CVE-2026-80230.html
>
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---
> Note: SRC_URI indentation is corrected by devtool
>
> .../curl/curl/CVE-2026-80230.patch | 68 +++++++++++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 62 ++++++++---------
> 2 files changed, 99 insertions(+), 31 deletions(-)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch
> b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
> new file mode 100644
> index 0000000000..5a6bb35986
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
> @@ -0,0 +1,68 @@
> +From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Mon, 24 Aug 2026 23:37:49 +0200
> +Subject: [PATCH] openssl: no server cert is only okay if also not pinned
> +
> +Reported-by: Stanislav Fort
> +Closes #22660
> +
> +CVE: CVE-2026-80230
> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef
> ]
> +
> +Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned()
> +accesses data->set.str[] directly instead.
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +---
> + lib/vtls/openssl.c | 26 +++++++++++++++-----------
> + 1 file changed, 15 insertions(+), 11 deletions(-)
> +
> +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
> +index 1cf357c..cb6fcc4 100644
> +--- a/lib/vtls/openssl.c
> ++++ b/lib/vtls/openssl.c
> +@@ -4607,21 +4607,24 @@ out:
> + return result;
> + }
> +
> +-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
> +- struct Curl_easy *data,
> +- X509 *server_cert)
> ++static const char *pinned(struct Curl_cfilter *cf,
> ++ struct Curl_easy *data)
> + {
> +- const char *ptr;
> +- CURLcode result = CURLE_OK;
> +-
> + (void)cf;
> ++ return
> + #ifndef CURL_DISABLE_PROXY
> +- ptr = Curl_ssl_cf_is_proxy(cf) ?
> ++ Curl_ssl_cf_is_proxy(cf) ?
> + data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
> +- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
> +-#else
> +- ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
> + #endif
> ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY];
> ++}
> ++
> ++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
> ++ struct Curl_easy *data,
> ++ X509 *server_cert)
> ++{
> ++ CURLcode result = CURLE_OK;
> ++ const char *ptr = pinned(cf, data);
> + if(ptr) {
> + result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
> + if(result)
> +@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct
> Curl_cfilter *cf,
> + server_cert = SSL_get1_peer_certificate(octx->ssl);
> + if(!server_cert) {
> + /* no verification at all, this maybe acceptable */
> +- if(!(conn_config->verifypeer || conn_config->verifyhost))
> ++ if(!(conn_config->verifypeer || conn_config->verifyhost) &&
> ++ !pinned(cf, data))
> + goto out;
> +
> + failf(data, "SSL: could not get peer certificate");
> diff --git a/meta/recipes-support/curl/curl_8.19.0.bb
> b/meta/recipes-support/curl/curl_8.19.0.bb
> index 0573e08ea4..c2697d6dd8 100644
> --- a/meta/recipes-support/curl/curl_8.19.0.bb
> +++ b/meta/recipes-support/curl/curl_8.19.0.bb
> @@ -9,37 +9,37 @@ SECTION = "console/network"
> LICENSE = "curl"
> LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc"
>
> -SRC_URI = " \
> - https://curl.se/download/ ${BP}.tar.xz \
> - file://run-ptest \
> - file://disable-tests \
> - file://no-test-timeout.patch \
> - file://CVE-2026-6276.patch \
> - file://CVE-2026-5773.patch \
> - file://mbedtls.patch \
> - file://CVE-2026-5545.patch \
> - file://CVE-2026-6253.patch \
> - file://CVE-2026-6429-dependent.patch \
> - file://CVE-2026-6429.patch \
> - file://CVE-2026-7168.patch \
> - file://CVE-2026-4873.patch \
> - file://CVE-2026-8286.patch \
> - file://CVE-2026-8927.patch \
> - file://CVE-2026-8932-dependent.patch \
> - file://CVE-2026-8932.patch \
> - file://CVE-2026-11352.patch \
> - file://CVE-2026-11586.patch \
> - file://CVE-2026-7009.patch \
> - file://CVE-2026-8925.patch \
> - file://CVE-2026-9080.patch \
> - file://CVE-2026-9545-01.patch \
> - file://CVE-2026-9545-02.patch \
> - file://CVE-2026-9079.patch \
> - file://CVE-2026-13608.patch \
> - file://CVE-2026-80229.patch \
> - file://CVE-2026-9546-01.patch \
> - file://CVE-2026-9546-02.patch \
> -"
> +SRC_URI = " https://curl.se/download/ ${BP}.tar.xz \
> + file://run-ptest \
> + file://disable-tests \
> + file://no-test-timeout.patch \
> + file://CVE-2026-6276.patch \
> + file://CVE-2026-5773.patch \
> + file://mbedtls.patch \
> + file://CVE-2026-5545.patch \
> + file://CVE-2026-6253.patch \
> + file://CVE-2026-6429-dependent.patch \
> + file://CVE-2026-6429.patch \
> + file://CVE-2026-7168.patch \
> + file://CVE-2026-4873.patch \
> + file://CVE-2026-8286.patch \
> + file://CVE-2026-8927.patch \
> + file://CVE-2026-8932-dependent.patch \
> + file://CVE-2026-8932.patch \
> + file://CVE-2026-11352.patch \
> + file://CVE-2026-11586.patch \
> + file://CVE-2026-7009.patch \
> + file://CVE-2026-8925.patch \
> + file://CVE-2026-9080.patch \
> + file://CVE-2026-9545-01.patch \
> + file://CVE-2026-9545-02.patch \
> + file://CVE-2026-9079.patch \
> + file://CVE-2026-13608.patch \
> + file://CVE-2026-80229.patch \
> + file://CVE-2026-9546-01.patch \
> + file://CVE-2026-9546-02.patch \
> + file://CVE-2026-80230.patch \
> + "
>
> SRC_URI:append:class-nativesdk = " \
> file://environment.d-curl.sh \
[-- Attachment #2: Type: text/html, Size: 7270 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [OE-core] [wrynose][PATCH] curl: fix CVE-2026-80230
2026-10-18 13:18 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-18 22:02 ` Yoann Congal
0 siblings, 0 replies; 3+ messages in thread
From: Yoann Congal @ 2026-10-18 22:02 UTC (permalink / raw)
To: dkelaiya, openembedded-core
On Sun Oct 18, 2026 at 3:18 PM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> Hi Yoann, Jaipaul,
>
> I’m preparing a six-patch curl CVE fix series for Wrynose. One of the
> patches addresses CVE-2026-80230 using the same upstream fix and curl
> 8.19.0 adaptation as Jaipaul’s submission here. The other five patches
> address additional CVEs.
>
> Would you prefer that I submit the complete series with the overlap
> noted in the cover letter, or omit the CVE-2026-80230 patch and submit
> the remaining five based on Jaipaul’s change?
Hello,
Send it on top of Jaipaul's please. No need to resend the CVE-2026-80230
patch.
Thanks!
>
> Thanks,
> Darsh
>
> On Fri, Oct 16, 2026 at 07:10 PM, Jaipaul Cheernam wrote:
>
>>
>> Backport the upstream fix [1] as mentioned in [2]
>>
>> [1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
>> [2] https://curl.se/docs/CVE-2026-80230.html
>>
>> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> ---
>> Note: SRC_URI indentation is corrected by devtool
>>
>> .../curl/curl/CVE-2026-80230.patch | 68 +++++++++++++++++++
>> meta/recipes-support/curl/curl_8.19.0.bb | 62 ++++++++---------
>> 2 files changed, 99 insertions(+), 31 deletions(-)
>> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
>>
>> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> new file mode 100644
>> index 0000000000..5a6bb35986
>> --- /dev/null
>> +++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
>> @@ -0,0 +1,68 @@
>> +From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001
>> +From: Daniel Stenberg <daniel@haxx.se>
>> +Date: Mon, 24 Aug 2026 23:37:49 +0200
>> +Subject: [PATCH] openssl: no server cert is only okay if also not pinned
>> +
>> +Reported-by: Stanislav Fort
>> +Closes #22660
>> +
>> +CVE: CVE-2026-80230
>> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef
>> ]
>> +
>> +Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned()
>> +accesses data->set.str[] directly instead.
>> +
>> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> +---
>> + lib/vtls/openssl.c | 26 +++++++++++++++-----------
>> + 1 file changed, 15 insertions(+), 11 deletions(-)
>> +
>> +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
>> +index 1cf357c..cb6fcc4 100644
>> +--- a/lib/vtls/openssl.c
>> ++++ b/lib/vtls/openssl.c
>> +@@ -4607,21 +4607,24 @@ out:
>> + return result;
>> + }
>> +
>> +-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
>> +- struct Curl_easy *data,
>> +- X509 *server_cert)
>> ++static const char *pinned(struct Curl_cfilter *cf,
>> ++ struct Curl_easy *data)
>> + {
>> +- const char *ptr;
>> +- CURLcode result = CURLE_OK;
>> +-
>> + (void)cf;
>> ++ return
>> + #ifndef CURL_DISABLE_PROXY
>> +- ptr = Curl_ssl_cf_is_proxy(cf) ?
>> ++ Curl_ssl_cf_is_proxy(cf) ?
>> + data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
>> +- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
>> +-#else
>> +- ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
>> + #endif
>> ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY];
>> ++}
>> ++
>> ++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
>> ++ struct Curl_easy *data,
>> ++ X509 *server_cert)
>> ++{
>> ++ CURLcode result = CURLE_OK;
>> ++ const char *ptr = pinned(cf, data);
>> + if(ptr) {
>> + result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
>> + if(result)
>> +@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct
>> Curl_cfilter *cf,
>> + server_cert = SSL_get1_peer_certificate(octx->ssl);
>> + if(!server_cert) {
>> + /* no verification at all, this maybe acceptable */
>> +- if(!(conn_config->verifypeer || conn_config->verifyhost))
>> ++ if(!(conn_config->verifypeer || conn_config->verifyhost) &&
>> ++ !pinned(cf, data))
>> + goto out;
>> +
>> + failf(data, "SSL: could not get peer certificate");
>> diff --git a/meta/recipes-support/curl/curl_8.19.0.bb
>> b/meta/recipes-support/curl/curl_8.19.0.bb
>> index 0573e08ea4..c2697d6dd8 100644
>> --- a/meta/recipes-support/curl/curl_8.19.0.bb
>> +++ b/meta/recipes-support/curl/curl_8.19.0.bb
>> @@ -9,37 +9,37 @@ SECTION = "console/network"
>> LICENSE = "curl"
>> LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc"
>>
>> -SRC_URI = " \
>> - https://curl.se/download/ ${BP}.tar.xz \
>> - file://run-ptest \
>> - file://disable-tests \
>> - file://no-test-timeout.patch \
>> - file://CVE-2026-6276.patch \
>> - file://CVE-2026-5773.patch \
>> - file://mbedtls.patch \
>> - file://CVE-2026-5545.patch \
>> - file://CVE-2026-6253.patch \
>> - file://CVE-2026-6429-dependent.patch \
>> - file://CVE-2026-6429.patch \
>> - file://CVE-2026-7168.patch \
>> - file://CVE-2026-4873.patch \
>> - file://CVE-2026-8286.patch \
>> - file://CVE-2026-8927.patch \
>> - file://CVE-2026-8932-dependent.patch \
>> - file://CVE-2026-8932.patch \
>> - file://CVE-2026-11352.patch \
>> - file://CVE-2026-11586.patch \
>> - file://CVE-2026-7009.patch \
>> - file://CVE-2026-8925.patch \
>> - file://CVE-2026-9080.patch \
>> - file://CVE-2026-9545-01.patch \
>> - file://CVE-2026-9545-02.patch \
>> - file://CVE-2026-9079.patch \
>> - file://CVE-2026-13608.patch \
>> - file://CVE-2026-80229.patch \
>> - file://CVE-2026-9546-01.patch \
>> - file://CVE-2026-9546-02.patch \
>> -"
>> +SRC_URI = " https://curl.se/download/ ${BP}.tar.xz \
>> + file://run-ptest \
>> + file://disable-tests \
>> + file://no-test-timeout.patch \
>> + file://CVE-2026-6276.patch \
>> + file://CVE-2026-5773.patch \
>> + file://mbedtls.patch \
>> + file://CVE-2026-5545.patch \
>> + file://CVE-2026-6253.patch \
>> + file://CVE-2026-6429-dependent.patch \
>> + file://CVE-2026-6429.patch \
>> + file://CVE-2026-7168.patch \
>> + file://CVE-2026-4873.patch \
>> + file://CVE-2026-8286.patch \
>> + file://CVE-2026-8927.patch \
>> + file://CVE-2026-8932-dependent.patch \
>> + file://CVE-2026-8932.patch \
>> + file://CVE-2026-11352.patch \
>> + file://CVE-2026-11586.patch \
>> + file://CVE-2026-7009.patch \
>> + file://CVE-2026-8925.patch \
>> + file://CVE-2026-9080.patch \
>> + file://CVE-2026-9545-01.patch \
>> + file://CVE-2026-9545-02.patch \
>> + file://CVE-2026-9079.patch \
>> + file://CVE-2026-13608.patch \
>> + file://CVE-2026-80229.patch \
>> + file://CVE-2026-9546-01.patch \
>> + file://CVE-2026-9546-02.patch \
>> + file://CVE-2026-80230.patch \
>> + "
>>
>> SRC_URI:append:class-nativesdk = " \
>> file://environment.d-curl.sh \
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-18 22:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-16 13:40 [wrynose][PATCH] curl: fix CVE-2026-80230 Jaipaul Cheernam
2026-10-18 13:18 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-18 22:02 ` [OE-core] " Yoann Congal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox