Re: [OE-core][wrynose][PATCH 5/5] curl: fix CVE-2026-80231

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Oct 19, 2026 at 8:43 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> Apply the native CA connection-reuse fix [1] after CVE-2026-11564.
> Store the effective native CA setting in the primary SSL configuration
> and include it in connection matching and cloning. Update each affected
> TLS backend to read the connection setting using the curl 8.19.0 layout.
> The upstream advisory is referenced in [2].
>
> [1] https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42
> [2] https://curl.se/docs/CVE-2026-80231.html
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
>  .../curl/curl/CVE-2026-80231.patch            | 212 ++++++++++++++++++
>  meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
>  2 files changed, 213 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80231.patch b/meta/recipes-support/curl/curl/CVE-2026-80231.patch
> new file mode 100644
> index 0000000000..dd58c6c544
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80231.patch
> @@ -0,0 +1,212 @@
> +From 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Tue, 25 Aug 2026 13:47:11 +0200
> +Subject: [PATCH] vtls: move 'native_ca_store' ssl_config_data =>
> + ssl_primary_config
> +
> +And include it as key for connection reuse matching.
> +
> +Reported-by: Stanislav Fort
> +
> +Closes #22668
> +
> +CVE: CVE-2026-80231
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42]
> +
> +Backport Changes:
> +- Moved the SSL config structures to lib/urldata.h and matching,
> +  cloning and option completion to lib/vtls/vtls.c. Curl 8.19.0
> +  does not provide lib/vtls/vtls_config.[ch].
> +- Omitted the ossl_apply_session() hunk because curl 8.19.0 has no
> +  corresponding session-verification path.
Can you provide a proof for this? Same as a previous patch in the
series: I need to be convinced we are not introducing a vulnerability by
omitting part of the upstream fix.

> +- Retained the older GnuTLS verification layout and helper names.
> +
> +(cherry picked from commit 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42)
> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> +---
> + lib/urldata.h      | 2 +-
> + lib/vtls/gtls.c    | 6 +++---
> + lib/vtls/openssl.c | 7 +++----
> + lib/vtls/rustls.c  | 2 +-
> + lib/vtls/vtls.c    | 8 +++++---
> + lib/vtls/wolfssl.c | 5 ++---
> + 6 files changed, 15 insertions(+), 15 deletions(-)

Regards,
-- 
Yoann Congal
Smile ECS