* [OE-core][wrynose][PATCH 1/5] curl: fix CVE-2026-8926
2026-10-19 6:43 [OE-core][wrynose][PATCH 0/5] curl: backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-19 6:43 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-20 13:43 ` Yoann Congal
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (3 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 6:43 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
Backport the upstream fix [1] for [2] to curl 8.19.0.
Include entry-selection changes and extended test 685 from [4].
Keep password-only entries valid for a user supplied in the URL,
while rejecting passwords tied to a different login. Reset login
matching state when changing entries.
Include upstream follow-up [3] to cover URL users absent from the
netrc file, with regression test 1646.
[1] https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854
[2] https://curl.se/docs/CVE-2026-8926.html
[3] https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8
[4] https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../curl/curl/CVE-2026-8926-dependent.patch | 140 ++++++++++++++++++
.../curl/curl/CVE-2026-8926_p1.patch | 100 +++++++++++++
.../curl/curl/CVE-2026-8926_p2.patch | 84 +++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 3 +
4 files changed, 327 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch
new file mode 100644
index 0000000000..1c46d08e27
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch
@@ -0,0 +1,140 @@
+From a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 9 Mar 2026 08:38:14 +0100
+Subject: [PATCH] netrc: refactor into smaller sub functions
+
+Fixes #20950 - test 685 is extended for this
+Closes #20932
+
+CVE: CVE-2026-8926
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca]
+
+Backport Changes:
+- Kept the curl 8.19.0 parser and login/password API instead of
+ extracting netrc_state, token, state, and finalization helpers.
+- Applied the password-presence check, generic-entry selection and
+ entry-state resets in the existing parser, without the helper moves.
+- Omitted netrc_finalize's password-return comment because the CVE
+ fix must reject entries with an explicitly mismatched login.
+
+(cherry picked from commit a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ docs/cmdline-opts/netrc.md | 12 ++++++++++--
+ docs/libcurl/opts/CURLOPT_NETRC.md | 5 +++++
+ lib/netrc.c | 17 ++++++++++++++---
+ tests/data/test685 | 4 +++-
+ 4 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/docs/cmdline-opts/netrc.md b/docs/cmdline-opts/netrc.md
+index 72b5ff9..03a7ed6 100644
+--- a/docs/cmdline-opts/netrc.md
++++ b/docs/cmdline-opts/netrc.md
+@@ -35,10 +35,18 @@ On Windows two filenames in the home directory are checked: *.netrc* and
+ *_netrc*, preferring the former. Older versions on Windows checked for
+ *_netrc* only.
+
+-A quick and simple example of how to setup a *.netrc* to allow curl to FTP to
+-the machine host.example.com with username 'myself' and password 'secret'
++A quick and simple example of how to setup a *.netrc* to allow curl to access
++the machine host.example.com with username `myself` and password `secret`
+ could look similar to:
+
+ machine host.example.com
+ login myself
+ password secret
++
++curl also supports the `default` keyword. This is the same as machine name
++except that default matches any name. There can be only one `default` token,
++and it must be after all machine tokens.
++
++When providing a username in the URL and a *.netrc* file, curl looks for the
++password for that specific user for the given host if such an entry appears in
++the file before a "generic" `machine` entry without `login` specified.
+diff --git a/docs/libcurl/opts/CURLOPT_NETRC.md b/docs/libcurl/opts/CURLOPT_NETRC.md
+index 65d87cf..1e3dbb1 100644
+--- a/docs/libcurl/opts/CURLOPT_NETRC.md
++++ b/docs/libcurl/opts/CURLOPT_NETRC.md
+@@ -50,6 +50,11 @@ and similar things are not supported).
+ The netrc file provides credentials for a hostname independent of which
+ protocol and port number that are used.
+
++When providing a username in the URL and a *.netrc* file, libcurl looks for
++and uses the password for that specific user for the given host if such an
++entry appears in the file before a "generic" `machine` entry without `login`
++specified.
++
+ libcurl does not verify that the file has the correct properties set (as the
+ standard Unix ftp client does). It should only be readable by user.
+
+diff --git a/lib/netrc.c b/lib/netrc.c
+index 1073cc5..5eb0c84 100644
+--- a/lib/netrc.c
++++ b/lib/netrc.c
+@@ -289,8 +289,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+ retcode = NETRC_OUT_OF_MEMORY; /* allocation failed */
+ goto out;
+ }
+- if(!specific_login || our_login)
+- found |= FOUND_PASSWORD;
++ found |= FOUND_PASSWORD;
+ keyword = NONE;
+ }
+ else if(curl_strequal("login", tok))
+@@ -299,13 +298,22 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+ keyword = PASSWORD;
+ else if(curl_strequal("machine", tok)) {
+ /* a new machine here */
+- if(found & FOUND_PASSWORD) {
++ if(found & FOUND_PASSWORD &&
++ /* a password was provided for this host */
++
++ ((!specific_login || our_login) ||
++ /* either there was no specific login to search for, or this
++ is the specific one we wanted */
++ (specific_login && !(found & FOUND_LOGIN)))) {
++ /* or we look for a specific login, but that was not specified */
++
+ done = TRUE;
+ break;
+ }
+ state = HOSTFOUND;
+ keyword = NONE;
+ found = 0;
++ our_login = FALSE;
+ Curl_safefree(password);
+ if(!specific_login)
+ Curl_safefree(login);
+@@ -313,6 +321,9 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+ else if(curl_strequal("default", tok)) {
+ state = HOSTVALID;
+ retcode = NETRC_OK; /* we did find our host */
++ keyword = NONE;
++ found = 0;
++ our_login = FALSE;
+ Curl_safefree(password);
+ if(!specific_login)
+ Curl_safefree(login);
+diff --git a/tests/data/test685 b/tests/data/test685
+index a069ff8..5346cd1 100644
+--- a/tests/data/test685
++++ b/tests/data/test685
+@@ -26,13 +26,15 @@ Connection: close
+ http
+ </server>
+ <name>
+-netrc with no login - provided user
++netrc with no login - but provided user in URL
+ </name>
+ <command>
+ --netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://user@%HOSTIP:%HTTPPORT/
+ </command>
+ <file name="%LOGDIR/netrc%TESTNUMBER" >
++machine %HOSTIP password firstthis login unknown
+ machine %HOSTIP password 5up3r53cr37
++machine %HOSTIP password d1ff3r3nt login anotherone
+ </file>
+ </client>
+
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch
new file mode 100644
index 0000000000..8402429fce
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch
@@ -0,0 +1,100 @@
+From 4ae1d7cc2643e4773a136395f12bc02fc6867854 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 15 May 2026 11:45:49 +0200
+Subject: [PATCH] netrc: scanner refactor
+
+Refactor the netrc scanner. Add test case for checking that the last
+matched machine with unmatched login does not return the password as
+success (unit1304).
+
+Closes #21624
+
+CVE: CVE-2026-8926
+Upstream-Status: Backport [https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854]
+
+Backport Changes:
+- Kept the curl 8.19.0 tokenizer and login/password API in netrc.c;
+ omitted the Curl_creds API changes in netrc.h and url.c.
+- Replaced the scanner refactor with a NETRC_NO_MATCH guard for an
+ unmatched requested login, keeping generic password-only entries.
+- Corrected test 685's regression in the initial backport: a missing
+ login keyword must not reject a password-only entry for a URL user.
+- Preserved the old blank-password behavior for a matching login.
+- Adapted unit1304 to the curl 8.19.0 login/password API and retained
+ the upstream regression scenario for the last unmatched login.
+
+(cherry picked from commit 4ae1d7cc2643e4773a136395f12bc02fc6867854)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/netrc.c | 3 +++
+ tests/unit/unit1304.c | 20 +++++++++++++++++---
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/lib/netrc.c b/lib/netrc.c
+index 5eb0c84..425a535 100644
+--- a/lib/netrc.c
++++ b/lib/netrc.c
+@@ -349,6 +349,9 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+
+ out:
+ curlx_dyn_free(&token);
++ if(!retcode && specific_login && !our_login &&
++ ((found & FOUND_LOGIN) || !password))
++ retcode = NETRC_NO_MATCH;
+ if(!retcode) {
+ if(!password && our_login) {
+ /* success without a password, set a blank one */
+diff --git a/tests/unit/unit1304.c b/tests/unit/unit1304.c
+index 231ddd4..cff99f1 100644
+--- a/tests/unit/unit1304.c
++++ b/tests/unit/unit1304.c
+@@ -59,7 +59,7 @@ static CURLcode test_unit1304(const char *arg)
+ login = curlx_strdup("me");
+ Curl_netrc_init(&store);
+ result = Curl_parsenetrc(&store, "example.com", &login, &password, arg);
+- fail_unless(result == 0, "Host should have been found");
++ fail_unless(result == 1, "Login should not have been found");
+ abort_unless(password == NULL, "password is not NULL!");
+ Curl_netrc_cleanup(&store);
+ curlx_free(login);
+@@ -82,7 +82,7 @@ static CURLcode test_unit1304(const char *arg)
+ login = curlx_strdup("admi"); /* spellchecker:disable-line */
+ Curl_netrc_init(&store);
+ result = Curl_parsenetrc(&store, "example.com", &login, &password, arg);
+- fail_unless(result == 0, "Host should have been found");
++ fail_unless(result == 1, "Login should not have been found");
+ abort_unless(password == NULL, "password is not NULL!");
+ Curl_netrc_cleanup(&store);
+ curlx_free(login);
+@@ -94,7 +94,7 @@ static CURLcode test_unit1304(const char *arg)
+ login = curlx_strdup("adminn");
+ Curl_netrc_init(&store);
+ result = Curl_parsenetrc(&store, "example.com", &login, &password, arg);
+- fail_unless(result == 0, "Host should have been found");
++ fail_unless(result == 1, "Login should not have been found");
+ abort_unless(password == NULL, "password is not NULL!");
+ Curl_netrc_cleanup(&store);
+ curlx_free(login);
+@@ -166,6 +166,20 @@ static CURLcode test_unit1304(const char *arg)
+ fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'");
+ Curl_netrc_cleanup(&store);
+
++ /*
++ * Test for the last host where we do not want to see the password
++ * if the login does not match.
++ */
++ curlx_free(password);
++ password = NULL;
++ curlx_free(login);
++ login = curlx_strdup("hilarious");
++ Curl_netrc_init(&store);
++ result = Curl_parsenetrc(&store, "curl.example.com", &login, &password, arg);
++ fail_unless(result == 1, "Login should not have been found");
++ abort_unless(password == NULL, "password is not NULL!");
++ Curl_netrc_cleanup(&store);
++
+ UNITTEST_END(t1304_stop(&password, &login))
+ }
+
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch
new file mode 100644
index 0000000000..b511e03fc4
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch
@@ -0,0 +1,84 @@
+From 7ca5f939c8403db7ede21e2ccb805a65d3329ef8 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 16 May 2026 00:54:13 +0200
+Subject: [PATCH] test1646: netrc parsing without user match but user in URL
+
+Follow-up to 4ae1d7cc2643e
+
+CVE: CVE-2026-8926
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8]
+
+Backport Changes:
+- Registered test 1646 in the older curl 8.19.0 test-list row.
+
+(cherry picked from commit 7ca5f939c8403db7ede21e2ccb805a65d3329ef8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ tests/data/Makefile.am | 2 +-
+ tests/data/test1646 | 45 +++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 46 insertions(+), 1 deletion(-)
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 13e47a3..ea700cd 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -218,7 +218,7 @@ test1620 test1621 test1622 test1623 test1624 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \
+ \
+-test1640 test1641 test1642 test1643 test1647 test1648 test1649 \
++test1640 test1641 test1642 test1643 test1646 test1647 test1648 test1649 \
+ \
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
+ test1658 \
+diff --git a/tests/data/test1646 b/tests/data/test1646
+new file mode 100644
+index 0000000..3df03be
+--- /dev/null
++++ b/tests/data/test1646
+@@ -0,0 +1,45 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++netrc
++</keywords>
++</info>
++
++<reply>
++<data>
++HTTP/1.1 200 OK
++Content-Length: 6
++
++12345
++</data>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++<name>
++netrc parsing without user match but user in URL
++</name>
++<command>
++--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://alice@example.com:%HTTPPORT/%TESTNUMBER --resolve example.com:%HTTPPORT:%HOSTIP
++</command>
++<file name="%LOGDIR/netrc%TESTNUMBER" >
++machine example.com login bob password sekret
++</file>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET /%TESTNUMBER HTTP/1.1
++Host: example.com:%HTTPPORT
++Authorization: Basic %b64[alice:]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index c2697d6dd8..af76f5d53b 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -38,6 +38,9 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-80229.patch \
file://CVE-2026-9546-01.patch \
file://CVE-2026-9546-02.patch \
+ file://CVE-2026-8926-dependent.patch \
+ file://CVE-2026-8926_p1.patch \
+ file://CVE-2026-8926_p2.patch \
file://CVE-2026-80230.patch \
"
--
2.35.6
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [OE-core][wrynose][PATCH 1/5] curl: fix CVE-2026-8926
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 1/5] curl: fix CVE-2026-8926 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-20 13:43 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-10-20 13:43 UTC (permalink / raw)
To: dkelaiya, openembedded-core
On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> Backport the upstream fix [1] for [2] to curl 8.19.0.
>
> Include entry-selection changes and extended test 685 from [4].
> Keep password-only entries valid for a user supplied in the URL,
> while rejecting passwords tied to a different login. Reset login
> matching state when changing entries.
>
> Include upstream follow-up [3] to cover URL users absent from the
> netrc file, with regression test 1646.
>
> [1] https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854
> [2] https://curl.se/docs/CVE-2026-8926.html
> [3] https://github.com/curl/curl/commit/7ca5f939c8403db7ede21e2ccb805a65d3329ef8
> [4] https://github.com/curl/curl/commit/a327a5bdedfad6b486bca4e0a1a4fdac9ab298ca
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
> .../curl/curl/CVE-2026-8926-dependent.patch | 140 ++++++++++++++++++
> .../curl/curl/CVE-2026-8926_p1.patch | 100 +++++++++++++
> .../curl/curl/CVE-2026-8926_p2.patch | 84 +++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 3 +
> 4 files changed, 327 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch
Hello,
Since this is not simple code to review, I've ask my LLM to review this
series. I think it found a regression with this backported patch that
does not exists in upstream's:
A netrc entry with two logins gives bob alice's password.
- With `machine example.com login alice password p1 login bob password p2`
and URL user bob, the final tree sends bob:p1. 8.19.0 and upstream
8.21 send bob:p2. (LLM reproduced this on the base and final builds.)
- Cause: the dependent patch removes the if(!specific_login || our_login)
condition before found |= FOUND_PASSWORD, as upstream
8.20.0 did (8.20.0 is still vulnerable to this CVE).
Can you look into this?
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564
2026-10-19 6:43 [OE-core][wrynose][PATCH 0/5] curl: backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 1/5] curl: fix CVE-2026-8926 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-19 6:43 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-20 13:53 ` Yoann Congal
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-80255 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 6:43 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
Restore the upstream native CA and proxy-origin comments while
retaining the curl 8.19.0 option-completion API.
[1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891
[2] https://curl.se/docs/CVE-2026-11564.html
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../curl/curl/CVE-2026-11564.patch | 132 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 133 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
new file mode 100644
index 0000000000..539236228c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
@@ -0,0 +1,132 @@
+From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 8 Jun 2026 10:11:30 +0200
+Subject: [PATCH] ssl native_ca_store: always reinit
+
+Add bit `native_ca_store_opt` to keep the setting of
+CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy
+transfer if a native CA store shall be used or not.
+
+This avoids `native_ca_store` getting stuck on TRUE after being set
+once.
+
+Closes #21902
+
+CVE: CVE-2026-11564
+Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891]
+
+Backport Changes:
+- Applied the option-completion helper to lib/vtls/vtls.c because curl
+ 8.19.0 does not have lib/vtls/vtls_config.c.
+- Retained the curl 8.19.0 auto-client-certificate behavior because the
+ later initial-origin tracking API is not available.
+
+(cherry picked from commit d69bfad3fa3daf5e72331f6870667607828d5891)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/doh.c | 3 ++-
+ lib/setopt.c | 20 ++------------------
+ lib/vtls/vtls.c | 21 +++++++++++++++++++++
+ 3 files changed, 25 insertions(+), 19 deletions(-)
+
+diff --git a/lib/doh.c b/lib/doh.c
+index 4488d42..80da94b 100644
+--- a/lib/doh.c
++++ b/lib/doh.c
+@@ -397,7 +397,8 @@ static CURLcode doh_probe_run(struct Curl_easy *data,
+ }
+
+ (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS,
+- (long)data->set.ssl.primary.ssl_options);
++ ((long)data->set.ssl.primary.ssl_options &
++ ~CURLSSLOPT_AUTO_CLIENT_CERT));
+
+ doh->state.internal = TRUE;
+ doh->master_mid = data->mid; /* master transfer of this one */
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 7e6960c..3603912 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -407,22 +407,6 @@ static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg)
+ }
+ #endif /* !CURL_DISABLE_RTSP */
+
+-#ifdef USE_SSL
+-static void set_ssl_options(struct ssl_config_data *ssl,
+- struct ssl_primary_config *config,
+- long arg)
+-{
+- config->ssl_options = (unsigned char)(arg & 0xff);
+- ssl->enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST);
+- ssl->no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
+- ssl->no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
+- ssl->revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT);
+- ssl->native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA);
+- ssl->auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT);
+- ssl->earlydata = !!(arg & CURLSSLOPT_EARLYDATA);
+-}
+-#endif
+-
+ static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option,
+ long arg)
+ {
+@@ -1002,11 +986,11 @@ static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option,
+ s->use_ssl = (unsigned char)arg;
+ break;
+ case CURLOPT_SSL_OPTIONS:
+- set_ssl_options(&s->ssl, &s->ssl.primary, arg);
++ s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+ break;
+ #ifndef CURL_DISABLE_PROXY
+ case CURLOPT_PROXY_SSL_OPTIONS:
+- set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg);
++ s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+ break;
+ #endif
+ case CURLOPT_SSL_ENABLE_NPN:
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index 6dcc67d..35cb4f0 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -306,6 +306,22 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc)
+ #endif
+ }
+
++static void ssl_easy_config_compl_options(struct ssl_config_data *sslc)
++{
++ uint8_t options = sslc->primary.ssl_options;
++ /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
++ * If not, we switch it on for supported backends if no custom
++ * ca settings exist. */
++ sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
++ sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
++ sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
++ sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
++ sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT);
++ sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA);
++
++ sslc->auto_client_cert = !!(options & CURLSSLOPT_AUTO_CLIENT_CERT);
++}
++
+ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ {
+ struct ssl_config_data *sslc = &data->set.ssl;
+@@ -314,6 +330,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ CURLcode result;
+ #endif
+
++ ssl_easy_config_compl_options(sslc);
++
+ if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+ if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+@@ -360,6 +378,9 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+
+ #ifndef CURL_DISABLE_PROXY
+ sslc = &data->set.proxy_ssl;
++ /* no initial origin for proxy, it is not changed for redirects */
++ ssl_easy_config_compl_options(sslc);
++
+ if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+ if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index af76f5d53b..322304f47d 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -41,6 +41,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-8926-dependent.patch \
file://CVE-2026-8926_p1.patch \
file://CVE-2026-8926_p2.patch \
+ file://CVE-2026-11564.patch \
file://CVE-2026-80230.patch \
"
--
2.35.6
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-20 13:53 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-10-20 13:53 UTC (permalink / raw)
To: dkelaiya, openembedded-core
On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> Restore the upstream native CA and proxy-origin comments while
> retaining the curl 8.19.0 option-completion API.
>
> [1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891
> [2] https://curl.se/docs/CVE-2026-11564.html
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
> .../curl/curl/CVE-2026-11564.patch | 132 ++++++++++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 1 +
> 2 files changed, 133 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
> new file mode 100644
> index 0000000000..539236228c
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch
> @@ -0,0 +1,132 @@
> +From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001
> +From: Stefan Eissing <stefan@eissing.org>
> +Date: Mon, 8 Jun 2026 10:11:30 +0200
> +Subject: [PATCH] ssl native_ca_store: always reinit
> +
> +Add bit `native_ca_store_opt` to keep the setting of
> +CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy
> +transfer if a native CA store shall be used or not.
> +
> +This avoids `native_ca_store` getting stuck on TRUE after being set
> +once.
> +
> +Closes #21902
> +
> +CVE: CVE-2026-11564
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891]
> +
> +Backport Changes:
> +- Applied the option-completion helper to lib/vtls/vtls.c because curl
> + 8.19.0 does not have lib/vtls/vtls_config.c.
> +- Retained the curl 8.19.0 auto-client-certificate behavior because the
> + later initial-origin tracking API is not available.
Isn't that a vuln in itself? Something like certificate confusion?
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-80255
2026-10-19 6:43 [OE-core][wrynose][PATCH 0/5] curl: backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 1/5] curl: fix CVE-2026-8926 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 2/5] curl: fix CVE-2026-11564 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-19 6:43 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-20 14:12 ` Yoann Congal
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
4 siblings, 1 reply; 11+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 6:43 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
Apply prerequisite [3] to reject TABs in cookie attribute values.
Retain test 1685 alongside the main fix and test 2885. Keep the
8.19.0 invalid_octets() adaptation that prevents test 1105 regressions.
[1] https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a
[2] https://curl.se/docs/CVE-2026-80255.html
[3] https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../curl/curl/CVE-2026-80255-dependent.patch | 139 ++++++++++++++++++
.../curl/curl/CVE-2026-80255.patch | 125 ++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 2 +
3 files changed, 266 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
new file mode 100644
index 0000000000..ca7737e5dd
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
@@ -0,0 +1,139 @@
+From 8e8bdd36048c146fe843d8948a912fbd398d1c5d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 1 Apr 2026 08:09:47 +0200
+Subject: [PATCH] cookie: fix rejection when tabs in value
+
+A previous refactor changed the TAB check so that the octet could be
+accepted in the 'path', which would cause an invalid line in the saved
+cookie file so not possible to read the cookie back. Not terrible
+because the path cannot contain a raw tab anyway so it would never match
+anyway.
+
+Add test 1685 to verify
+
+Reported-by: Izan on hackerone
+
+Closes #21185
+
+CVE: CVE-2026-80255
+Upstream-Status: Backport [https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d]
+
+Backport Changes:
+- Registered test 1685 in the older curl 8.19.0 test-list row.
+
+(cherry picked from commit 8e8bdd36048c146fe843d8948a912fbd398d1c5d)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cookie.c | 14 ++++++-------
+ tests/data/Makefile.am | 2 +-
+ tests/data/test1685 | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 65 insertions(+), 8 deletions(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 4d53cc4..cd95130 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -461,6 +461,13 @@ parse_cookie_header(struct Curl_easy *data,
+ sep = TRUE; /* a '=' was used */
+ if(!curlx_str_cspn(&ptr, &val, ";\r\n"))
+ curlx_str_trimblanks(&val);
++
++ /* Reject cookies with a TAB inside the value */
++ if(curlx_strlen(&val) &&
++ memchr(curlx_str(&val), '\t', curlx_strlen(&val))) {
++ infof(data, "cookie contains TAB, dropping");
++ return CURLE_OK;
++ }
+ }
+ else
+ curlx_str_init(&val);
+@@ -489,13 +496,6 @@ parse_cookie_header(struct Curl_easy *data,
+ return CURLE_OK;
+ }
+
+- /* Reject cookies with a TAB inside the value */
+- if(curlx_strlen(&val) &&
+- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) {
+- infof(data, "cookie contains TAB, dropping");
+- return CURLE_OK;
+- }
+-
+ /* Check if we have a reserved prefix set. */
+ if(!strncmp("__Secure-", curlx_str(&name), 9))
+ co->prefix_secure = TRUE;
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index ea700cd..5bb4f7e 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -226,7 +226,7 @@ test1660 test1661 test1662 test1663 test1664 test1665 \
+ \
+ test1670 test1671 \
+ \
+-test1680 test1681 test1682 test1683 \
++test1680 test1681 test1682 test1683 test1685 \
+ \
+ test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
+ test1708 test1709 test1710 test1711 test1712 \
+diff --git a/tests/data/test1685 b/tests/data/test1685
+new file mode 100644
+index 0000000..b98dc20
+--- /dev/null
++++ b/tests/data/test1685
+@@ -0,0 +1,57 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers">
++HTTP/1.0 200 OK swsclose
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Type: text/html
++Set-Cookie: name=content; path=/we%TABwant
++Set-Cookie: accept=this; path=/only/this
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++<name>
++HTTP, reject cookie with tab in path
++</name>
++<command>
++http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt
++</command>
++
++<features>
++cookies
++</features>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text">
++# Netscape HTTP Cookie File
++# https://curl.se/docs/http-cookies.html
++# This file was generated by libcurl! Edit at your own risk.
++
++127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis
++</file>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch
new file mode 100644
index 0000000000..50af08fc3c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch
@@ -0,0 +1,125 @@
+From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 27 Aug 2026 08:33:30 +0200
+Subject: [PATCH] cookie: improve TAB handling
+
+For entries with a leading tab. Verified in test 2885.
+
+Reported-by: Stanislav Fort
+Closes #22699
+
+CVE: CVE-2026-80255
+Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a]
+
+Backport Changes:
+- Made invalid_octets() reject TAB as required by the curl 8.19.0
+ parser; without this adaptation, upstream test 1105 regresses.
+- Registered test 2885 in the older test-list layout.
+
+(cherry picked from commit 4f6aa41a0145e930e766775dbe860883d350aa0a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cookie.c | 6 ++---
+ tests/data/Makefile.am | 2 +-
+ tests/data/test2885 | 52 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 56 insertions(+), 4 deletions(-)
+ create mode 100644 tests/data/test2885
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 4d53cc4..c3adf1d 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -354,9 +354,9 @@ static bool bad_domain(const char *domain, size_t len)
+ static bool invalid_octets(const char *ptr, size_t len)
+ {
+ const unsigned char *p = (const unsigned char *)ptr;
+- /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
++ /* Reject all bytes \x01 - \x1f + \x7f */
+ while(len && *p) {
+- if(((*p != 9) && (*p < 0x20)) || (*p == 0x7f))
++ if((*p < 0x20) || (*p == 0x7f))
+ return TRUE;
+ p++;
+ len--;
+@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data,
+ struct Curl_str val;
+
+ /* we have a <name>=<value> pair or a stand-alone word here */
+- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) {
+ bool sep = FALSE;
+ curlx_str_trimblanks(&name);
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 13e47a3..18e7730 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -272,7 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \
+ test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \
+ test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \
+ test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \
+-\
++test2885 \
+ test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
+ test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \
+ test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \
+diff --git a/tests/data/test2885 b/tests/data/test2885
+new file mode 100644
+index 0000000..456224f
+--- /dev/null
++++ b/tests/data/test2885
+@@ -0,0 +1,52 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++<reply>
++<data crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 0
++Set-Cookie: thisis=SECRET;%TABSecure
++Set-Cookie: also=notab; Secure
++
++</data>
++</reply>
++
++<client>
++<features>
++cookies
++</features>
++<server>
++https
++</server>
++<name>
++Cookies with TAB before 'secure'
++</name>
++<command>
++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure
++</command>
++</client>
++
++<verify>
++<protocol crlf="headers">
++GET /%TESTNUMBER HTTP/1.1
++Host: cookie.example:%HTTPSPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++<file name="%LOGDIR/cookies.txt" mode="text">
++# Netscape HTTP Cookie File
++# https://curl.se/docs/http-cookies.html
++# This file was generated by libcurl! Edit at your own risk.
++
++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab
++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET
++</file>
++</verify>
++</testcase>
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 322304f47d..33954465f7 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -42,6 +42,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-8926_p1.patch \
file://CVE-2026-8926_p2.patch \
file://CVE-2026-11564.patch \
+ file://CVE-2026-80255-dependent.patch \
+ file://CVE-2026-80255.patch \
file://CVE-2026-80230.patch \
"
--
2.35.6
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-80255
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-80255 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-20 14:12 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-10-20 14:12 UTC (permalink / raw)
To: dkelaiya, openembedded-core
On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> Apply prerequisite [3] to reject TABs in cookie attribute values.
> Retain test 1685 alongside the main fix and test 2885. Keep the
> 8.19.0 invalid_octets() adaptation that prevents test 1105 regressions.
>
> [1] https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a
> [2] https://curl.se/docs/CVE-2026-80255.html
> [3] https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
> .../curl/curl/CVE-2026-80255-dependent.patch | 139 ++++++++++++++++++
> .../curl/curl/CVE-2026-80255.patch | 125 ++++++++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 2 +
> 3 files changed, 266 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
> new file mode 100644
> index 0000000000..ca7737e5dd
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
> @@ -0,0 +1,139 @@
> +From 8e8bdd36048c146fe843d8948a912fbd398d1c5d Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Wed, 1 Apr 2026 08:09:47 +0200
> +Subject: [PATCH] cookie: fix rejection when tabs in value
> +
> +A previous refactor changed the TAB check so that the octet could be
> +accepted in the 'path', which would cause an invalid line in the saved
> +cookie file so not possible to read the cookie back. Not terrible
> +because the path cannot contain a raw tab anyway so it would never match
> +anyway.
> +
> +Add test 1685 to verify
> +
> +Reported-by: Izan on hackerone
> +
> +Closes #21185
> +
> +CVE: CVE-2026-80255
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d]
> +
> +Backport Changes:
> +- Registered test 1685 in the older curl 8.19.0 test-list row.
> +
> +(cherry picked from commit 8e8bdd36048c146fe843d8948a912fbd398d1c5d)
> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> +---
> + lib/cookie.c | 14 ++++++-------
> + tests/data/Makefile.am | 2 +-
> + tests/data/test1685 | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++
> + 3 files changed, 65 insertions(+), 8 deletions(-)
> +
> +diff --git a/lib/cookie.c b/lib/cookie.c
> +index 4d53cc4..cd95130 100644
> +--- a/lib/cookie.c
> ++++ b/lib/cookie.c
> +@@ -461,6 +461,13 @@ parse_cookie_header(struct Curl_easy *data,
> + sep = TRUE; /* a '=' was used */
> + if(!curlx_str_cspn(&ptr, &val, ";\r\n"))
> + curlx_str_trimblanks(&val);
> ++
> ++ /* Reject cookies with a TAB inside the value */
> ++ if(curlx_strlen(&val) &&
> ++ memchr(curlx_str(&val), '\t', curlx_strlen(&val))) {
> ++ infof(data, "cookie contains TAB, dropping");
> ++ return CURLE_OK;
> ++ }
> + }
> + else
> + curlx_str_init(&val);
> +@@ -489,13 +496,6 @@ parse_cookie_header(struct Curl_easy *data,
> + return CURLE_OK;
> + }
> +
> +- /* Reject cookies with a TAB inside the value */
> +- if(curlx_strlen(&val) &&
> +- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) {
> +- infof(data, "cookie contains TAB, dropping");
> +- return CURLE_OK;
> +- }
> +-
> + /* Check if we have a reserved prefix set. */
> + if(!strncmp("__Secure-", curlx_str(&name), 9))
> + co->prefix_secure = TRUE;
> +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
> +index ea700cd..5bb4f7e 100644
> +--- a/tests/data/Makefile.am
> ++++ b/tests/data/Makefile.am
> +@@ -226,7 +226,7 @@ test1660 test1661 test1662 test1663 test1664 test1665 \
> + \
> + test1670 test1671 \
> + \
> +-test1680 test1681 test1682 test1683 \
> ++test1680 test1681 test1682 test1683 test1685 \
> + \
> + test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
> + test1708 test1709 test1710 test1711 test1712 \
> +diff --git a/tests/data/test1685 b/tests/data/test1685
> +new file mode 100644
> +index 0000000..b98dc20
> +--- /dev/null
> ++++ b/tests/data/test1685
> +@@ -0,0 +1,57 @@
> ++<?xml version="1.0" encoding="US-ASCII"?>
> ++<testcase>
> ++<info>
> ++<keywords>
> ++HTTP
> ++cookies
> ++</keywords>
> ++</info>
> ++
> ++# Server-side
> ++<reply>
> ++<data crlf="headers">
> ++HTTP/1.0 200 OK swsclose
> ++Date: Tue, 09 Nov 2010 14:49:00 GMT
> ++Content-Type: text/html
> ++Set-Cookie: name=content; path=/we%TABwant
> ++Set-Cookie: accept=this; path=/only/this
> ++
> ++boo
> ++</data>
> ++</reply>
> ++
> ++# Client-side
> ++<client>
> ++<server>
> ++http
> ++</server>
> ++<name>
> ++HTTP, reject cookie with tab in path
> ++</name>
> ++<command>
> ++http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt
> ++</command>
> ++
> ++<features>
> ++cookies
> ++</features>
> ++</client>
> ++
> ++# Verify data after the test has been "shot"
> ++<verify>
> ++<protocol crlf="headers">
> ++GET / HTTP/1.1
> ++Host: %HOSTIP:%HTTPPORT
> ++User-Agent: curl/%VERSION
> ++Accept: */*
> ++
> ++</protocol>
> ++<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text">
> ++# Netscape HTTP Cookie File
> ++# https://curl.se/docs/http-cookies.html
> ++# This file was generated by libcurl! Edit at your own risk.
> ++
> ++127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis
> ++</file>
> ++</verify>
> ++</testcase>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch
> new file mode 100644
> index 0000000000..50af08fc3c
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch
> @@ -0,0 +1,125 @@
> +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Thu, 27 Aug 2026 08:33:30 +0200
> +Subject: [PATCH] cookie: improve TAB handling
> +
> +For entries with a leading tab. Verified in test 2885.
> +
> +Reported-by: Stanislav Fort
> +Closes #22699
> +
> +CVE: CVE-2026-80255
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a]
> +
> +Backport Changes:
> +- Made invalid_octets() reject TAB as required by the curl 8.19.0
> + parser; without this adaptation, upstream test 1105 regresses.
> +- Registered test 2885 in the older test-list layout.
> +
> +(cherry picked from commit 4f6aa41a0145e930e766775dbe860883d350aa0a)
> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> +---
> + lib/cookie.c | 6 ++---
> + tests/data/Makefile.am | 2 +-
> + tests/data/test2885 | 52 ++++++++++++++++++++++++++++++++++++++++++
> + 3 files changed, 56 insertions(+), 4 deletions(-)
> + create mode 100644 tests/data/test2885
> +
> +diff --git a/lib/cookie.c b/lib/cookie.c
> +index 4d53cc4..c3adf1d 100644
> +--- a/lib/cookie.c
> ++++ b/lib/cookie.c
> +@@ -354,9 +354,9 @@ static bool bad_domain(const char *domain, size_t len)
> + static bool invalid_octets(const char *ptr, size_t len)
> + {
> + const unsigned char *p = (const unsigned char *)ptr;
> +- /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
> ++ /* Reject all bytes \x01 - \x1f + \x7f */
> + while(len && *p) {
> +- if(((*p != 9) && (*p < 0x20)) || (*p == 0x7f))
> ++ if((*p < 0x20) || (*p == 0x7f))
> + return TRUE;
> + p++;
> + len--;
> +@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data,
> + struct Curl_str val;
> +
> + /* we have a <name>=<value> pair or a stand-alone word here */
> +- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
> ++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) {
> + bool sep = FALSE;
> + curlx_str_trimblanks(&name);
> +
> +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
> +index 13e47a3..18e7730 100644
> +--- a/tests/data/Makefile.am
> ++++ b/tests/data/Makefile.am
> +@@ -272,7 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \
> + test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \
> + test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \
> + test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \
> +-\
> ++test2885 \
> + test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
> + test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \
> + test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \
> +diff --git a/tests/data/test2885 b/tests/data/test2885
> +new file mode 100644
> +index 0000000..456224f
> +--- /dev/null
> ++++ b/tests/data/test2885
> +@@ -0,0 +1,52 @@
> ++<?xml version="1.0" encoding="US-ASCII"?>
> ++<testcase>
> ++<info>
> ++<keywords>
> ++HTTP
> ++cookies
> ++</keywords>
> ++</info>
> ++
> ++<reply>
> ++<data crlf="headers">
> ++HTTP/1.1 200 OK
> ++Content-Length: 0
> ++Set-Cookie: thisis=SECRET;%TABSecure
> ++Set-Cookie: also=notab; Secure
> ++
> ++</data>
> ++</reply>
> ++
> ++<client>
> ++<features>
> ++cookies
> ++</features>
> ++<server>
> ++https
> ++</server>
> ++<name>
> ++Cookies with TAB before 'secure'
> ++</name>
> ++<command>
> ++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure
> ++</command>
> ++</client>
> ++
> ++<verify>
> ++<protocol crlf="headers">
> ++GET /%TESTNUMBER HTTP/1.1
> ++Host: cookie.example:%HTTPSPORT
> ++User-Agent: curl/%VERSION
> ++Accept: */*
> ++
> ++</protocol>
> ++<file name="%LOGDIR/cookies.txt" mode="text">
> ++# Netscape HTTP Cookie File
> ++# https://curl.se/docs/http-cookies.html
> ++# This file was generated by libcurl! Edit at your own risk.
> ++
> ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab
> ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET
> ++</file>
> ++</verify>
> ++</testcase>
> +--
> +2.35.6
> diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
> index 322304f47d..33954465f7 100644
> --- a/meta/recipes-support/curl/curl_8.19.0.bb
> +++ b/meta/recipes-support/curl/curl_8.19.0.bb
> @@ -42,6 +42,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
> file://CVE-2026-8926_p1.patch \
> file://CVE-2026-8926_p2.patch \
> file://CVE-2026-11564.patch \
> + file://CVE-2026-80255-dependent.patch \
> + file://CVE-2026-80255.patch \
> file://CVE-2026-80230.patch \
> "
>
My LLM thinks there is a part of the backport missing:
Secure<TAB>HttpOnly now loses the Secure flag.
- Upstream drops \t from the cookie-name scanner. That is safe upstream
only because 6730081429 also runs invalid_octets() on every attribute
name.
- The backport takes only the TAB part of invalid_octets(), not the
per-name check (upstream 4f6aa41a01:lib/cookie.c:619-622).
- Result for a=SECRET; Secure<TAB>HttpOnly: 8.19.0 stored it with
Secure, the series stores it without Secure, and upstream drops the
cookie.
Can you look into it?
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208
2026-10-19 6:43 [OE-core][wrynose][PATCH 0/5] curl: backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 preceding siblings ...)
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 3/5] curl: fix CVE-2026-80255 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-19 6:43 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-20 14:15 ` Yoann Congal
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
4 siblings, 1 reply; 11+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 6:43 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a
[2] https://curl.se/docs/CVE-2026-82208.html
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../curl/curl/CVE-2026-82208.patch | 52 +++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 53 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
new file mode 100644
index 0000000000..2c733de210
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
@@ -0,0 +1,52 @@
+From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 26 Aug 2026 13:46:13 +0200
+Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice
+
+The flag preventing a rerun was not set when a cached_store
+was used.
+
+CURL_UNCONST an ech string for my old wolfssl version
+
+Closes #22689
+
+CVE: CVE-2026-82208
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a]
+
+Backport Changes:
+- Omitted the unrelated CURL_UNCONST ECH compatibility change because
+ curl 8.19.0 uses a mutable ECH configuration string and a different
+ code path.
+
+(cherry picked from commit ed0338befd1d865a8ea1fbaa90013a096dedd07a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/vtls/wolfssl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index 74bd247..fdf33a8 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -597,9 +597,6 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
+ bool imported_native_ca = FALSE;
+ bool imported_ca_info_blob = FALSE;
+
+- /* We do not want to do this again, no matter the outcome */
+- wssl->x509_store_setup = TRUE;
+-
+ #ifndef NO_FILESYSTEM
+ /* load native CA certificates */
+ if(ssl_config->native_ca_store) {
+@@ -802,6 +799,9 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
+ WOLFSSL_X509_STORE *cached_store;
+ bool cache_criteria_met;
+
++ /* We do not want to do this again, no matter the outcome */
++ wssl->x509_store_setup = TRUE;
++
+ /* Consider the X509 store cacheable if it comes exclusively from a CAfile,
+ or no source is provided and we are falling back to wolfSSL's built-in
+ default. */
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 33954465f7..0418bec61c 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -44,6 +44,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-11564.patch \
file://CVE-2026-80255-dependent.patch \
file://CVE-2026-80255.patch \
+ file://CVE-2026-82208.patch \
file://CVE-2026-80230.patch \
"
--
2.35.6
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-20 14:15 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-10-20 14:15 UTC (permalink / raw)
To: dkelaiya, openembedded-core
On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> [1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a
> [2] https://curl.se/docs/CVE-2026-82208.html
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
> .../curl/curl/CVE-2026-82208.patch | 52 +++++++++++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 1 +
> 2 files changed, 53 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
> new file mode 100644
> index 0000000000..2c733de210
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
> @@ -0,0 +1,52 @@
> +From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001
> +From: Stefan Eissing <stefan@eissing.org>
> +Date: Wed, 26 Aug 2026 13:46:13 +0200
> +Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice
> +
> +The flag preventing a rerun was not set when a cached_store
> +was used.
> +
> +CURL_UNCONST an ech string for my old wolfssl version
> +
> +Closes #22689
> +
> +CVE: CVE-2026-82208
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a]
> +
> +Backport Changes:
> +- Omitted the unrelated CURL_UNCONST ECH compatibility change because
> + curl 8.19.0 uses a mutable ECH configuration string and a different
> + code path.
Can you justify this? How can I know that difference from upstream just
broke ECH or introduced a vulnerability?
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread
* [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231
2026-10-19 6:43 [OE-core][wrynose][PATCH 0/5] curl: backport security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (3 preceding siblings ...)
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-19 6:43 ` Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-20 14:28 ` Yoann Congal
4 siblings, 1 reply; 11+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 6:43 UTC (permalink / raw)
To: openembedded-core; +Cc: Darsh Kelaiya
From: Darsh Kelaiya <dkelaiya@cisco.com>
Apply the native CA connection-reuse fix [1] after CVE-2026-11564.
Store the effective native CA setting in the primary SSL configuration
and include it in connection matching and cloning. Update each affected
TLS backend to read the connection setting using the curl 8.19.0 layout.
The upstream advisory is referenced in [2].
[1] https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42
[2] https://curl.se/docs/CVE-2026-80231.html
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../curl/curl/CVE-2026-80231.patch | 212 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 213 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-80231.patch b/meta/recipes-support/curl/curl/CVE-2026-80231.patch
new file mode 100644
index 0000000000..dd58c6c544
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80231.patch
@@ -0,0 +1,212 @@
+From 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 25 Aug 2026 13:47:11 +0200
+Subject: [PATCH] vtls: move 'native_ca_store' ssl_config_data =>
+ ssl_primary_config
+
+And include it as key for connection reuse matching.
+
+Reported-by: Stanislav Fort
+
+Closes #22668
+
+CVE: CVE-2026-80231
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42]
+
+Backport Changes:
+- Moved the SSL config structures to lib/urldata.h and matching,
+ cloning and option completion to lib/vtls/vtls.c. Curl 8.19.0
+ does not provide lib/vtls/vtls_config.[ch].
+- Omitted the ossl_apply_session() hunk because curl 8.19.0 has no
+ corresponding session-verification path.
+- Retained the older GnuTLS verification layout and helper names.
+
+(cherry picked from commit 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/urldata.h | 2 +-
+ lib/vtls/gtls.c | 6 +++---
+ lib/vtls/openssl.c | 7 +++----
+ lib/vtls/rustls.c | 2 +-
+ lib/vtls/vtls.c | 8 +++++---
+ lib/vtls/wolfssl.c | 5 ++---
+ 6 files changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/lib/urldata.h b/lib/urldata.h
+index dce181d..0bc9ade 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -249,6 +249,7 @@ struct ssl_primary_config {
+ BIT(verifypeer); /* set TRUE if this is desired */
+ BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */
+ BIT(verifystatus); /* set TRUE if certificate status must be checked */
++ BIT(native_ca_store); /* use the native CA store of operating system */
+ BIT(cache_session); /* cache session or not */
+ };
+
+@@ -264,7 +265,6 @@ struct ssl_config_data {
+ BIT(no_partialchain); /* do not accept partial certificate chains */
+ BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation
+ list errors */
+- BIT(native_ca_store); /* use the native CA store of operating system */
+ BIT(auto_client_cert); /* automatically locate and use a client
+ certificate for authentication (Schannel) */
+ BIT(custom_cafile); /* application has set custom CA file */
+diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
+index bfeb948..f19940a 100644
+--- a/lib/vtls/gtls.c
++++ b/lib/vtls/gtls.c
+@@ -451,7 +451,7 @@ static CURLcode gtls_populate_creds(struct Curl_cfilter *cf,
+ }
+
+ infof(data, "SSL Trust Anchors:");
+- if(ssl_config->native_ca_store) {
++ if(config->native_ca_store) {
+ #ifdef USE_APPLE_SECTRUST
+ infof(data, " Native: Apple SecTrust");
+ creds_are_empty = FALSE;
+@@ -655,7 +655,7 @@ CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf,
+ !conn_config->CApath &&
+ !conn_config->ca_info_blob &&
+ !ssl_config->primary.CRLfile &&
+- !ssl_config->native_ca_store &&
++ !conn_config->native_ca_store &&
+ !conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */
+
+ if(cache_criteria_met)
+@@ -1659,7 +1659,7 @@ CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf,
+ infof(data, " SSL certificate verified by GnuTLS");
+
+ #ifdef USE_APPLE_SECTRUST
+- if(!verified && ssl_config->native_ca_store) {
++ if(!verified && config->native_ca_store) {
+ result = glts_apple_verify(cf, data, peer, &chain, &verified);
+ if(result && (result != CURLE_PEER_FAILED_VERIFICATION))
+ goto out; /* unexpected error */
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 1cf357c..e162114 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -3034,7 +3034,6 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
+ X509_STORE *store)
+ {
+ struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+ CURLcode result = CURLE_OK;
+ const char * const ssl_cafile =
+ /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+@@ -3043,7 +3042,7 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
+ bool have_native_check = FALSE;
+
+ octx->store_is_empty = TRUE;
+- if(ssl_config->native_ca_store) {
++ if(conn_config->native_ca_store) {
+ #ifdef USE_WIN32_CRYPTO
+ bool added = FALSE;
+ result = ossl_windows_load_anchors(cf, data, store, &added);
+@@ -3352,7 +3351,7 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
+ !conn_config->CApath &&
+ !conn_config->ca_info_blob &&
+ !ssl_config->primary.CRLfile &&
+- !ssl_config->native_ca_store;
++ !conn_config->native_ca_store;
+
+ ERR_set_mark();
+
+@@ -4834,7 +4833,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+ infof(data, "SSL certificate verified via OpenSSL.");
+
+ #ifdef USE_APPLE_SECTRUST
+- if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) {
++ if(!verified && conn_config->verifypeer && conn_config->native_ca_store) {
+ /* we verify using Apple SecTrust *unless* OpenSSL already verified.
+ * This may happen if the application intercepted the OpenSSL callback
+ * and installed its own. */
+diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c
+index 564b10a..8961943 100644
+--- a/lib/vtls/rustls.c
++++ b/lib/vtls/rustls.c
+@@ -1035,7 +1035,7 @@ static CURLcode cr_init_backend(struct Curl_cfilter *cf,
+ rustls_client_config_builder_dangerous_set_certificate_verifier(
+ config_builder, cr_verify_none);
+ }
+- else if(ssl_config->native_ca_store) {
++ else if(conn_config->native_ca_store) {
+ result = init_config_builder_platform_verifier(data, config_builder);
+ if(result != CURLE_OK) {
+ rustls_client_config_builder_free(config_builder);
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index 35cb4f0..a3ed81b 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -198,6 +198,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
+ if((c1->version == c2->version) &&
+ (c1->version_max == c2->version_max) &&
+ (c1->ssl_options == c2->ssl_options) &&
++ (c1->native_ca_store == c2->native_ca_store) &&
+ (c1->verifypeer == c2->verifypeer) &&
+ (c1->verifyhost == c2->verifyhost) &&
+ (c1->verifystatus == c2->verifystatus) &&
+@@ -251,6 +252,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+ dest->verifypeer = source->verifypeer;
+ dest->verifyhost = source->verifyhost;
+ dest->verifystatus = source->verifystatus;
++ dest->native_ca_store = source->native_ca_store;
+ dest->cache_session = source->cache_session;
+ dest->ssl_options = source->ssl_options;
+
+@@ -312,7 +314,7 @@ static void ssl_easy_config_compl_options(struct ssl_config_data *sslc)
+ /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
+ * If not, we switch it on for supported backends if no custom
+ * ca settings exist. */
+- sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
++ sslc->primary.native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
+ sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
+ sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
+ sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
+@@ -335,7 +337,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+ if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+- sslc->native_ca_store = TRUE;
++ sslc->primary.native_ca_store = TRUE;
+ #endif
+ #ifdef CURL_CA_PATH
+ if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH]) {
+@@ -384,7 +386,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+ if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+- sslc->native_ca_store = TRUE;
++ sslc->primary.native_ca_store = TRUE;
+ #endif
+ #ifdef CURL_CA_PATH
+ if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) {
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index fdf33a8..c901ebf 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -593,13 +593,12 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
+ /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+ (ca_info_blob ? NULL : conn_config->CAfile);
+ const char * const ssl_capath = conn_config->CApath;
+- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+ bool imported_native_ca = FALSE;
+ bool imported_ca_info_blob = FALSE;
+
+ #ifndef NO_FILESYSTEM
+ /* load native CA certificates */
+- if(ssl_config->native_ca_store) {
++ if(conn_config->native_ca_store) {
+ #ifdef WOLFSSL_SYS_CA_CERTS
+ if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) {
+ infof(data, "error importing native CA store, continuing anyway");
+@@ -810,7 +809,7 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
+ !conn_config->CApath &&
+ !conn_config->ca_info_blob &&
+ !ssl_config->primary.CRLfile &&
+- !ssl_config->native_ca_store;
++ !conn_config->native_ca_store;
+
+ cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data)
+ : NULL;
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 0418bec61c..208595d950 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -46,6 +46,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-80255.patch \
file://CVE-2026-82208.patch \
file://CVE-2026-80230.patch \
+ file://CVE-2026-80231.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231
2026-10-19 6:43 ` [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-10-20 14:28 ` Yoann Congal
0 siblings, 0 replies; 11+ messages in thread
From: Yoann Congal @ 2026-10-20 14:28 UTC (permalink / raw)
To: dkelaiya, openembedded-core
On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> Apply the native CA connection-reuse fix [1] after CVE-2026-11564.
> Store the effective native CA setting in the primary SSL configuration
> and include it in connection matching and cloning. Update each affected
> TLS backend to read the connection setting using the curl 8.19.0 layout.
> The upstream advisory is referenced in [2].
>
> [1] https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42
> [2] https://curl.se/docs/CVE-2026-80231.html
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
> .../curl/curl/CVE-2026-80231.patch | 212 ++++++++++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 1 +
> 2 files changed, 213 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80231.patch b/meta/recipes-support/curl/curl/CVE-2026-80231.patch
> new file mode 100644
> index 0000000000..dd58c6c544
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80231.patch
> @@ -0,0 +1,212 @@
> +From 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Tue, 25 Aug 2026 13:47:11 +0200
> +Subject: [PATCH] vtls: move 'native_ca_store' ssl_config_data =>
> + ssl_primary_config
> +
> +And include it as key for connection reuse matching.
> +
> +Reported-by: Stanislav Fort
> +
> +Closes #22668
> +
> +CVE: CVE-2026-80231
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42]
> +
> +Backport Changes:
> +- Moved the SSL config structures to lib/urldata.h and matching,
> + cloning and option completion to lib/vtls/vtls.c. Curl 8.19.0
> + does not provide lib/vtls/vtls_config.[ch].
> +- Omitted the ossl_apply_session() hunk because curl 8.19.0 has no
> + corresponding session-verification path.
Can you provide a proof for this? Same as a previous patch in the
series: I need to be convinced we are not introducing a vulnerability by
omitting part of the upstream fix.
> +- Retained the older GnuTLS verification layout and helper names.
> +
> +(cherry picked from commit 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42)
> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> +---
> + lib/urldata.h | 2 +-
> + lib/vtls/gtls.c | 6 +++---
> + lib/vtls/openssl.c | 7 +++----
> + lib/vtls/rustls.c | 2 +-
> + lib/vtls/vtls.c | 8 +++++---
> + lib/vtls/wolfssl.c | 5 ++---
> + 6 files changed, 15 insertions(+), 15 deletions(-)
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 11+ messages in thread