* [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467
@ 2026-08-31 21:13 Jason Stasiak
2026-09-01 8:32 ` [OE-core] " Yoann Congal
2026-10-30 18:14 ` Yoann Congal
0 siblings, 2 replies; 5+ messages in thread
From: Jason Stasiak @ 2026-08-31 21:13 UTC (permalink / raw)
To: openembedded-core
From: Jason Stasiak <jason.stasiak@gmail.com>
Backport fix for CVE-2026-1467 from meta-oe to OE-core.
Update CVE patch to address a use case where a uri validation
failure was not handled.
(From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
---
.../libsoup/libsoup-2.4/CVE-2026-1467.patch | 276 ++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.3.bb | 1 +
2 files changed, 277 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
new file mode 100644
index 0000000000..c9cc9a19da
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
@@ -0,0 +1,276 @@
+From 361d797281f7ecfce4c2fb642c40227d66e541b5 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Tue, 21 Apr 2026 17:10:37 +0800
+Subject: [PATCH] Fix CVE-2026-1467
+
+CVE: CVE-2026-1467
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/6dfe506618d2d5856618e5c0f85bd93386dc8012]
+
+The original backport patch targets libsoup3. This patch has been
+adapted accordingly for libsoup2, refer the openSUSE patch, see [1]
+
+[1] https://www.suse.com/security/cve/CVE-2026-1467.html
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+
+Update soup_session_connect_async(...) in soup-session.c to handle
+the case where soup_message_new_from_uri() fails and returns a NULL
+msg. Adjust connection unit tests to account for the change in
+soup_session_connect_async(...).
+
+Backport the uri-parsing uri validation unit tests from the upstream
+libsoup3 patch
+
+Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
+---
+ libsoup/soup-auth.c | 2 +-
+ libsoup/soup-message.c | 5 +++-
+ libsoup/soup-session.c | 13 +++++++++
+ libsoup/soup-uri.c | 60 ++++++++++++++++++++++++++++++++++++++++
+ libsoup/soup-uri.h | 2 ++
+ tests/connection-test.c | 8 ++++--
+ tests/uri-parsing-test.c | 41 +++++++++++++++++++++++++++
+ 7 files changed, 127 insertions(+), 4 deletions(-)
+
+diff --git a/libsoup/soup-auth.c b/libsoup/soup-auth.c
+index 1896aab7..e205fe31 100644
+--- a/libsoup/soup-auth.c
++++ b/libsoup/soup-auth.c
+@@ -535,7 +535,7 @@ GSList *
+ soup_auth_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
+ {
+ g_return_val_if_fail (SOUP_IS_AUTH (auth), NULL);
+- g_return_val_if_fail (source_uri != NULL, NULL);
++ g_return_val_if_fail (soup_uri_is_valid (source_uri), NULL);
+
+ return SOUP_AUTH_GET_CLASS (auth)->get_protection_space (auth, source_uri);
+ }
+diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c
+index da32b42f..cc4f22b6 100644
+--- a/libsoup/soup-message.c
++++ b/libsoup/soup-message.c
+@@ -1044,7 +1044,7 @@ soup_message_new (const char *method, const char *uri_string)
+ uri = soup_uri_new (uri_string);
+ if (!uri)
+ return NULL;
+- if (!uri->host) {
++ if (!soup_uri_is_valid (uri)) {
+ soup_uri_free (uri);
+ return NULL;
+ }
+@@ -1066,6 +1066,8 @@ soup_message_new (const char *method, const char *uri_string)
+ SoupMessage *
+ soup_message_new_from_uri (const char *method, SoupURI *uri)
+ {
++ g_return_val_if_fail (soup_uri_is_valid (uri), NULL);
++
+ return g_object_new (SOUP_TYPE_MESSAGE,
+ SOUP_MESSAGE_METHOD, method,
+ SOUP_MESSAGE_URI, uri,
+@@ -1676,6 +1678,7 @@ soup_message_set_uri (SoupMessage *msg, SoupURI *uri)
+ SoupMessagePrivate *priv;
+
+ g_return_if_fail (SOUP_IS_MESSAGE (msg));
++ g_return_if_fail (soup_uri_is_valid (uri));
+ priv = soup_message_get_instance_private (msg);
+
+ if (priv->uri)
+diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
+index 4472bb91..fadd5cd2 100644
+--- a/libsoup/soup-session.c
++++ b/libsoup/soup-session.c
+@@ -5106,6 +5106,7 @@ soup_session_connect_async (SoupSession *session,
+ SoupMessageQueueItem *item;
+ ConnectAsyncData *data;
+ GTask *task;
++ GError *error = NULL;
+
+ g_return_if_fail (SOUP_IS_SESSION (session));
+ g_return_if_fail (!SOUP_IS_SESSION_SYNC (session));
+@@ -5116,6 +5117,18 @@ soup_session_connect_async (SoupSession *session,
+ task = g_task_new (session, cancellable, callback, user_data);
+
+ msg = soup_message_new_from_uri (SOUP_METHOD_HEAD, uri);
++
++ /* Trigger task to notify caller when soup_message can not be constructed */
++ if ( msg == NULL ) {
++ g_set_error( &error,
++ G_IO_ERROR,
++ G_IO_ERROR_INVALID_ARGUMENT,
++ "Failed to construct soup message from uri");
++ g_task_return_error (task, error);
++ g_object_unref (task);
++ return;
++ }
++
+ soup_message_set_flags (msg, SOUP_MESSAGE_NEW_CONNECTION);
+ g_signal_connect_object (msg, "finished",
+ G_CALLBACK (connect_async_message_finished),
+diff --git a/libsoup/soup-uri.c b/libsoup/soup-uri.c
+index bdb7a175..d781ff11 100644
+--- a/libsoup/soup-uri.c
++++ b/libsoup/soup-uri.c
+@@ -1342,6 +1342,66 @@ soup_uri_host_equal (gconstpointer v1, gconstpointer v2)
+ return g_ascii_strcasecmp (one->host, two->host) == 0;
+ }
+
++static gboolean
++is_valid_character_for_host (char c)
++{
++ static const char forbidden_chars[] = { '\t', '\n', '\r', ' ', '#', '/', ':', '<', '>', '?', '@', '[', '\\', ']', '^', '|' };
++ int i;
++
++ for (i = 0; i < G_N_ELEMENTS (forbidden_chars); ++i) {
++ if (c == forbidden_chars[i])
++ return FALSE;
++ }
++
++ return TRUE;
++}
++
++static gboolean
++is_host_valid (const char* host)
++{
++ int i;
++ gboolean is_valid;
++ char *ascii_host = NULL;
++
++ if (!host || !host[0])
++ return FALSE;
++
++ if (g_hostname_is_non_ascii (host)) {
++ ascii_host = g_hostname_to_ascii (host);
++ if (!ascii_host)
++ return FALSE;
++
++ host = ascii_host;
++ }
++
++ if ((g_ascii_isdigit (host[0]) || strchr (host, ':')) && g_hostname_is_ip_address (host)) {
++ g_free (ascii_host);
++ return TRUE;
++ }
++ is_valid = TRUE;
++ for (i = 0; host[i] && is_valid; i++)
++ is_valid = is_valid_character_for_host (host[i]);
++
++ g_free (ascii_host);
++
++ return is_valid;
++}
++
++gboolean
++soup_uri_is_valid (SoupURI *uri)
++{
++ if (!uri)
++ return FALSE;
++
++ if (!is_host_valid (soup_uri_get_host (uri)))
++ return FALSE;
++
++ /* FIXME: validate other URI components? */
++
++ return TRUE;
++}
++
++
+ gboolean
+ soup_uri_is_http (SoupURI *uri, char **aliases)
+ {
+diff --git a/libsoup/soup-uri.h b/libsoup/soup-uri.h
+index 8015e4f1..64099c3c 100644
+--- a/libsoup/soup-uri.h
++++ b/libsoup/soup-uri.h
+@@ -133,6 +133,8 @@ guint soup_uri_host_hash (gconstpointer key);
+ SOUP_AVAILABLE_IN_2_28
+ gboolean soup_uri_host_equal (gconstpointer v1,
+ gconstpointer v2);
++SOUP_AVAILABLE_IN_2_68
++gboolean soup_uri_is_valid (SoupURI *uri);
+
+ #define SOUP_URI_IS_VALID(uri) ((uri) && (uri)->scheme && (uri)->path)
+ #define SOUP_URI_VALID_FOR_HTTP(uri) ((uri) && ((uri)->scheme == SOUP_URI_SCHEME_HTTP || (uri)->scheme == SOUP_URI_SCHEME_HTTPS) && (uri)->host && (uri)->path)
+diff --git a/tests/connection-test.c b/tests/connection-test.c
+index 08400fb9..21ffd6f9 100644
+--- a/tests/connection-test.c
++++ b/tests/connection-test.c
+@@ -1135,11 +1135,15 @@ do_connection_connect_test (void)
+ } else
+ debug_printf (1, " wss -- SKIPPING\n");
+
++ g_test_expect_message ("libsoup",
++ G_LOG_LEVEL_CRITICAL,
++ "*soup_message_new_from_uri*assertion*soup_uri_is_valid*failed*");
+ debug_printf (1, " file\n");
+ file_uri = soup_uri_new ("file:///foo/bar");
+ do_one_connection_connect_fail_test (session, file_uri,
+- G_RESOLVER_ERROR, G_RESOLVER_ERROR_NOT_FOUND,
+- "r");
++ G_IO_ERROR, G_IO_ERROR_INVALID_ARGUMENT,
++ "");
++ g_test_assert_expected_messages ();
+
+ debug_printf (1, " wrong http (invalid port)\n");
+ wrong_http_uri = soup_uri_new (HTTP_SERVER);
+diff --git a/tests/uri-parsing-test.c b/tests/uri-parsing-test.c
+index 07ef96b2..68a4940d 100644
+--- a/tests/uri-parsing-test.c
++++ b/tests/uri-parsing-test.c
+@@ -575,6 +575,46 @@ test_uri_decode (void)
+ g_free (decoded);
+ }
+
++static struct {
++ const char *host;
++ gboolean valid;
++} valid_tests[] = {
++ { "example.com", TRUE },
++ { "localhost", TRUE },
++ { "127.0.0.1", TRUE },
++ { "::1", TRUE },
++ { "::192.168.0.10", TRUE },
++ { "FEDC:BA98:7654:3210:FEDC:BA98:7654:3210", TRUE },
++ { "\xe4\xbe\x8b\xe5\xad\x90.\xe6\xb5\x8b\xe8\xaf\x95", TRUE },
++ { "012x:4567:89AB:cdef:3210:7654:ba98:FeDc", FALSE },
++ { "\texample.com", FALSE },
++ { "example.com\n", FALSE },
++ { "\r\nexample.com", FALSE },
++ { "example .com", FALSE },
++ { "example:com", FALSE },
++ { "exampl<e>.com", FALSE },
++ { "exampl[e].com", FALSE },
++ { "exampl^e.com", FALSE },
++ { "examp|e.com", FALSE },
++};
++
++static void
++do_valid_tests (void)
++{
++ int i;
++
++ for (i = 0; i < G_N_ELEMENTS (valid_tests); ++i) {
++ SoupURI *uri;
++
++ uri = soup_uri_new ("http://example.com/");
++ soup_uri_set_host (uri, valid_tests[i].host);
++
++ g_assert_true (soup_uri_is_valid (uri) == valid_tests[i].valid);
++
++ soup_uri_free (uri);
++ }
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -589,6 +629,7 @@ main (int argc, char **argv)
+ g_test_add_func ("/uri/normalization", do_normalization_tests);
+ g_test_add_func ("/uri/data", do_data_tests);
+ g_test_add_func ("/uri/decode", test_uri_decode);
++ g_test_add_func ("/uri/valid", do_valid_tests);
+
+ ret = g_test_run ();
+
+--
+2.55.0
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
index 7e00cd678a..ac715dc169 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
@@ -41,6 +41,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-4476.patch \
file://CVE-2025-2784.patch \
file://CVE-2025-4945.patch \
+ file://CVE-2026-1467.patch \
"
SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13"
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core] [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467
2026-08-31 21:13 [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467 Jason Stasiak
@ 2026-09-01 8:32 ` Yoann Congal
2026-09-01 14:35 ` Jason
2026-10-30 18:14 ` Yoann Congal
1 sibling, 1 reply; 5+ messages in thread
From: Yoann Congal @ 2026-09-01 8:32 UTC (permalink / raw)
To: jason.stasiak, openembedded-core; +Cc: Colin Pinnell McAllister
On Mon Aug 31, 2026 at 11:13 PM CEST, Jason Stasiak via lists.openembedded.org wrote:
> From: Jason Stasiak <jason.stasiak@gmail.com>
>
> Backport fix for CVE-2026-1467 from meta-oe to OE-core.
> Update CVE patch to address a use case where a uri validation
> failure was not handled.
>
> (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
>
> Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
> ---
> .../libsoup/libsoup-2.4/CVE-2026-1467.patch | 276 ++++++++++++++++++
> .../libsoup/libsoup-2.4_2.74.3.bb | 1 +
> 2 files changed, 277 insertions(+)
> create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
Hello,
Isn't that the patch Colin McAllister "colin-pm" (CC'd) asked about on
IRC #yocto?
https://libera.catirclogs.org/yocto/2026-08-28#1787933879-1787935062;
Is the trouble he mentioned fixed in this version of the patch?
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core] [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467
2026-09-01 8:32 ` [OE-core] " Yoann Congal
@ 2026-09-01 14:35 ` Jason
2026-09-01 14:37 ` Yoann Congal
0 siblings, 1 reply; 5+ messages in thread
From: Jason @ 2026-09-01 14:35 UTC (permalink / raw)
To: Yoann Congal; +Cc: openembedded-core, Colin Pinnell McAllister
On Tue, Sep 1, 2026 at 1:32 AM Yoann Congal <yoann.congal@smile.fr> wrote:
>
> On Mon Aug 31, 2026 at 11:13 PM CEST, Jason Stasiak via lists.openembedded.org wrote:
> > From: Jason Stasiak <jason.stasiak@gmail.com>
> >
> > Backport fix for CVE-2026-1467 from meta-oe to OE-core.
> > Update CVE patch to address a use case where a uri validation
> > failure was not handled.
> >
> > (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
> >
> > Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
> > ---
> > .../libsoup/libsoup-2.4/CVE-2026-1467.patch | 276 ++++++++++++++++++
> > .../libsoup/libsoup-2.4_2.74.3.bb | 1 +
> > 2 files changed, 277 insertions(+)
> > create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
>
> Hello,
>
> Isn't that the patch Colin McAllister "colin-pm" (CC'd) asked about on
> IRC #yocto?
> https://libera.catirclogs.org/yocto/2026-08-28#1787933879-1787935062;
>
Yes, I believe that this is the patch he was asking about.
> Is the trouble he mentioned fixed in this version of the patch?
Yes, the issue has been addressed in the patch and the associated test case in
the connection tests has been updated to verify the change.
>
> Thanks!
> --
> Yoann Congal
> Smile ECS
>
Regards.
Jason Stasiak
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core] [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467
2026-09-01 14:35 ` Jason
@ 2026-09-01 14:37 ` Yoann Congal
0 siblings, 0 replies; 5+ messages in thread
From: Yoann Congal @ 2026-09-01 14:37 UTC (permalink / raw)
To: Jason; +Cc: openembedded-core, Colin Pinnell McAllister
On Tue Sep 1, 2026 at 4:35 PM CEST, Jason wrote:
> On Tue, Sep 1, 2026 at 1:32 AM Yoann Congal <yoann.congal@smile.fr> wrote:
>>
>> On Mon Aug 31, 2026 at 11:13 PM CEST, Jason Stasiak via lists.openembedded.org wrote:
>> > From: Jason Stasiak <jason.stasiak@gmail.com>
>> >
>> > Backport fix for CVE-2026-1467 from meta-oe to OE-core.
>> > Update CVE patch to address a use case where a uri validation
>> > failure was not handled.
>> >
>> > (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
>> >
>> > Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
>> > ---
>> > .../libsoup/libsoup-2.4/CVE-2026-1467.patch | 276 ++++++++++++++++++
>> > .../libsoup/libsoup-2.4_2.74.3.bb | 1 +
>> > 2 files changed, 277 insertions(+)
>> > create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
>>
>> Hello,
>>
>> Isn't that the patch Colin McAllister "colin-pm" (CC'd) asked about on
>> IRC #yocto?
>> https://libera.catirclogs.org/yocto/2026-08-28#1787933879-1787935062;
>>
> Yes, I believe that this is the patch he was asking about.
>
>> Is the trouble he mentioned fixed in this version of the patch?
> Yes, the issue has been addressed in the patch and the associated test case in
> the connection tests has been updated to verify the change.
Awesome. I'll put the patch in the review queue.
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core] [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467
2026-08-31 21:13 [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467 Jason Stasiak
2026-09-01 8:32 ` [OE-core] " Yoann Congal
@ 2026-10-30 18:14 ` Yoann Congal
1 sibling, 0 replies; 5+ messages in thread
From: Yoann Congal @ 2026-10-30 18:14 UTC (permalink / raw)
To: jason.stasiak, openembedded-core
On Mon Aug 31, 2026 at 11:13 PM CEST, Jason Stasiak via lists.openembedded.org wrote:
> From: Jason Stasiak <jason.stasiak@gmail.com>
>
> Backport fix for CVE-2026-1467 from meta-oe to OE-core.
> Update CVE patch to address a use case where a uri validation
> failure was not handled.
>
> (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
>
> Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
> ---
> .../libsoup/libsoup-2.4/CVE-2026-1467.patch | 276 ++++++++++++++++++
> .../libsoup/libsoup-2.4_2.74.3.bb | 1 +
> 2 files changed, 277 insertions(+)
> create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
Hello,
Sorry I took so much time answering this one. It has some non-trivial
changes from upstream and I pushed its review "for later" for 2 months
now :-/
Since you have another series on libsoup-2.4[0], can you merge this CVE fix
into its next version? ... and also applying the same review as the
series:
* metadata preservation (authorship, subject, ...)
* diff minimisation from upstream patch
[0]: https://lore.kernel.org/all/20261014161209.2227316-1-jason.stasiak@garmin.com/
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-30 18:14 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-31 21:13 [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467 Jason Stasiak
2026-09-01 8:32 ` [OE-core] " Yoann Congal
2026-09-01 14:35 ` Jason
2026-09-01 14:37 ` Yoann Congal
2026-10-30 18:14 ` Yoann Congal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox