* [OE-core][wrynose][PATCH v2 07/10] expat: fix CVE-2026-56409
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56409
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of
latest wrynose branch merged commits.
.../expat/expat/CVE-2026-56409.patch | 53 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56409.patch b/meta/recipes-core/expat/expat/CVE-2026-56409.patch
new file mode 100644
index 0000000000..ff0e650a2a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56409.patch
@@ -0,0 +1,53 @@
+From 10938bc2cef7573087566b5b1c948061baa68b98 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Mon, 1 Jun 2026 11:53:19 +0530
+Subject: [PATCH] xmlwf: protect output path join from integer overflow
+
+CVE: CVE-2026-56409
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e]
+
+Backport Changes:
+- Adapt the allocation hunk to the explicit cast used by Expat 2.7.5.
+
+(cherry picked from commit 61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 06416454..6a0a707a 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -1236,8 +1236,26 @@ tmain(int argc, XML_Char **argv) {
+ }
+ #endif
+ }
+- outName = (XML_Char *)malloc((tcslen(outputDir) + tcslen(file) + 2)
+- * sizeof(XML_Char));
++ const size_t outputDirLen = tcslen(outputDir);
++ const size_t fileLen = tcslen(file);
++
++ /* Detect and prevent integer overflow in the addition (without
++ risking underflow) and the multiplication, mirroring the guards
++ in xcsdup() and resolveSystemId() */
++ if (outputDirLen > SIZE_MAX - fileLen
++ || outputDirLen > SIZE_MAX - fileLen - 2) {
++ tperror(T("Could not allocate memory"));
++ exit(XMLWF_EXIT_INTERNAL_ERROR);
++ }
++
++ const size_t charsRequired = outputDirLen + fileLen + 2;
++
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char)) {
++ tperror(T("Could not allocate memory"));
++ exit(XMLWF_EXIT_INTERNAL_ERROR);
++ }
++
++ outName = malloc(charsRequired * sizeof(XML_Char));
+ if (! outName) {
+ tperror(T("Could not allocate memory"));
+ exit(XMLWF_EXIT_INTERNAL_ERROR);
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index f14e39c00b..cb8f9dd1ac 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -28,6 +28,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56410_p2.patch;striplevel=2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
+ file://CVE-2026-56409.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 09/10] expat: fix CVE-2026-56407
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56407
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of
latest wrynose branch merged commits.
.../expat/expat/CVE-2026-56407.patch | 44 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56407.patch b/meta/recipes-core/expat/expat/CVE-2026-56407.patch
new file mode 100644
index 0000000000..5a2a22e017
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56407.patch
@@ -0,0 +1,44 @@
+From 7216b3584bcfb2d415026d16b8902ee7eacad5ca Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Tue, 2 Jun 2026 11:59:01 +0530
+Subject: [PATCH] cap entity textLen against signed integer overflow
+
+CVE: CVE-2026-56407
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13]
+
+(cherry picked from commit 30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 71fe2c79..8e90fea8 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5684,6 +5684,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ parser, enc, s + enc->minBytesPerChar, next - enc->minBytesPerChar,
+ XML_ACCOUNT_NONE);
+ if (parser->m_declEntity) {
++ /* Detect and prevent signed integer overflow */
++ if ((size_t)poolLength(&dtd->entityValuePool) > (size_t)INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ parser->m_declEntity->textPtr = poolStart(&dtd->entityValuePool);
+ parser->m_declEntity->textLen
+ = (int)(poolLength(&dtd->entityValuePool));
+@@ -7099,6 +7103,11 @@ storeSelfEntityValue(XML_Parser parser, ENTITY *entity) {
+ return XML_ERROR_NO_MEMORY;
+ }
+
++ /* Detect and prevent signed integer overflow */
++ if ((size_t)poolLength(pool) > (size_t)INT_MAX) {
++ poolDiscard(pool);
++ return XML_ERROR_NO_MEMORY;
++ }
+ entity->textPtr = poolStart(pool);
+ entity->textLen = (int)(poolLength(pool));
+ poolFinish(pool);
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index bd6656c6e0..9f519b482e 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -30,6 +30,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
file://CVE-2026-56411.patch;striplevel=2 \
+ file://CVE-2026-56407.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 08/10] expat: fix CVE-2026-56411
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56411
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of
latest wrynose branch merged commits.
.../expat/expat/CVE-2026-56411.patch | 47 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56411.patch b/meta/recipes-core/expat/expat/CVE-2026-56411.patch
new file mode 100644
index 0000000000..884837b61e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56411.patch
@@ -0,0 +1,47 @@
+From e447d5d72884a1246894f111a5b72de4e479152e Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Tue, 2 Jun 2026 13:13:34 +0530
+Subject: [PATCH] xmlwf: protect notation list allocation from integer overflow
+
+CVE: CVE-2026-56411
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5]
+
+(cherry picked from commit 528a4e5017e1bd3b48b689fd0c131df940ae3ea5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 6a0a707a..a9640190 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -383,9 +383,9 @@ static void XMLCALL
+ endDoctypeDecl(void *userData) {
+ XmlwfUserData *data = (XmlwfUserData *)userData;
+ NotationList **notations;
+- int notationCount = 0;
++ size_t notationCount = 0;
+ NotationList *p;
+- int i;
++ size_t i;
+
+ /* How many notations do we have? */
+ for (p = data->notationListHead; p != NULL; p = p->next)
+@@ -395,6 +395,13 @@ endDoctypeDecl(void *userData) {
+ goto cleanUp;
+ }
+
++ /* Detect and prevent integer overflow in the multiplication, mirroring
++ the guards in xcsdup() and resolveSystemId() */
++ if (notationCount > SIZE_MAX / sizeof(NotationList *)) {
++ fprintf(stderr, "Unable to sort notations");
++ goto cleanUp;
++ }
++
+ notations = malloc(notationCount * sizeof(NotationList *));
+ if (notations == NULL) {
+ fprintf(stderr, "Unable to sort notations");
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index cb8f9dd1ac..bd6656c6e0 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -29,6 +29,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
+ file://CVE-2026-56411.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 04/10] expat: fix CVE-2026-56405
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56405
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of
latest wrynose branch merged commits.
.../expat/expat/CVE-2026-56405.patch | 32 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56405.patch b/meta/recipes-core/expat/expat/CVE-2026-56405.patch
new file mode 100644
index 0000000000..c850801c1a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56405.patch
@@ -0,0 +1,32 @@
+From 73209f445f0265b203829fa7873caa78ca83cefe Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Fri, 29 May 2026 11:45:17 +0530
+Subject: [PATCH] lib: Protect function getAttributeId from signed integer
+ overflow
+
+CVE: CVE-2026-56405
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0]
+
+(cherry picked from commit 2c6c42d33689f6b266a5267b639e03cde17e53c0)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 1b7e289f..ec707336 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -7324,6 +7324,10 @@ getAttributeId(XML_Parser parser, const ENCODING *enc, const char *start,
+ } else {
+ int i;
+ for (i = 0; name[i]; i++) {
++ /* Detect and prevent signed integer overflow */
++ if (i == INT_MAX) {
++ return NULL;
++ }
+ /* attributes without prefix are *not* in the default namespace */
+ if (name[i] == XML_T(ASCII_COLON)) {
+ int j;
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index d15e023207..789fd7e077 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -23,6 +23,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
file://CVE-2026-56404.patch;striplevel=2 \
+ file://CVE-2026-56405.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 03/10] expat: fix CVE-2026-56404
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56404
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of
latest wrynose branch merged commits.
.../expat/expat/CVE-2026-56404.patch | 47 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56404.patch b/meta/recipes-core/expat/expat/CVE-2026-56404.patch
new file mode 100644
index 0000000000..6bca7cf961
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56404.patch
@@ -0,0 +1,47 @@
+From 8cb4583ac3204175a03c8ea8e371adee583b0bec Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Thu, 28 May 2026 12:44:11 +0530
+Subject: [PATCH] lib: protect function addBinding from signed integer overflow
+
+CVE: CVE-2026-56404
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164]
+
+(cherry picked from commit babfc48090977cbf7be24b2c48f6053dca75c164)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 53f842d1..33b92c9c 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -4485,6 +4485,10 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ }
+
+ for (len = 0; uri[len]; len++) {
++ /* Detect and prevent signed integer overflow */
++ if (len == INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ if (isXML && (len > xmlLen || uri[len] != xmlNamespace[len]))
+ isXML = XML_FALSE;
+
+@@ -4525,8 +4529,13 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ if (isXMLNS)
+ return XML_ERROR_RESERVED_NAMESPACE_URI;
+
+- if (parser->m_namespaceSeparator)
++ if (parser->m_namespaceSeparator) {
++ /* Detect and prevent signed integer overflow */
++ if (len == INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ len++;
++ }
+ if (parser->m_freeBindingList) {
+ b = parser->m_freeBindingList;
+ if (len > b->uriAlloc) {
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 934cde4b1a..d15e023207 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -22,6 +22,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
+ file://CVE-2026-56404.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 01/10] expat: fix CVE-2026-56403
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fixes shown in [1] and [2], as
referenced by [3].
[1] https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
[2] https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56403
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
Changes in v2:
- Drop the Wrynose-only stdint.h include from CVE-2026-56403_p2.patch
because current Wrynose already provides it through expat.h via OE-Core
commit 21042df15008.
- Remove the unnecessary Backport Changes note from
CVE-2026-56403_p2.patch.
.../expat/expat/CVE-2026-56403_p1.patch | 83 +++++++++++++++++++
.../expat/expat/CVE-2026-56403_p2.patch | 40 +++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 2 +
3 files changed, 125 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
new file mode 100644
index 0000000000..4cf5c3bd54
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
@@ -0,0 +1,83 @@
+From 4a264be1794368a1acc08476058b6cf087686d11 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Wed, 20 May 2026 12:12:10 +0200
+Subject: [PATCH] lib: Protect function `storeAtts` from signed integer
+ overflow
+
+CVE: CVE-2026-56403
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648]
+
+Backport Changes:
+- Retain the Expat 2.7.5 binding URI reallocation and active tag pointer
+ updates while using the overflow-safe localPartLen calculation.
+
+(cherry picked from commit 12dc6d8d3d65f79471a94d8565f6bf1cf245f648)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 0248b665..e441ff7f 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -4235,26 +4235,32 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ return XML_ERROR_NONE;
+ prefixLen = 0;
+ if (parser->m_ns_triplets && binding->prefix->name) {
+- while (binding->prefix->name[prefixLen++])
+- ; /* prefixLen includes null terminator */
++ size_t candidateLen = 0;
++ while (binding->prefix->name[candidateLen++])
++ ; /* candidateLen includes null terminator */
++ /* Detect and prevent integer overflow */
++ if (candidateLen > INT_MAX)
++ return XML_ERROR_NO_MEMORY;
++ prefixLen = (int)candidateLen;
+ }
+ tagNamePtr->localPart = localPart;
+ tagNamePtr->uriLen = binding->uriLen;
+ tagNamePtr->prefix = binding->prefix->name;
+ tagNamePtr->prefixLen = prefixLen;
+- for (i = 0; localPart[i++];)
+- ; /* i includes null terminator */
++
++ size_t localPartLen = 0;
++ for (; localPart[localPartLen++];)
++ ; /* localPartLen includes null terminator */
+
+ /* Detect and prevent integer overflow */
+- if (binding->uriLen > INT_MAX - prefixLen
+- || i > INT_MAX - (binding->uriLen + prefixLen)) {
++ if (localPartLen > INT_MAX || binding->uriLen > INT_MAX - prefixLen
++ || localPartLen > (size_t)INT_MAX - (binding->uriLen + prefixLen)) {
+ return XML_ERROR_NO_MEMORY;
+ }
+
+- n = i + binding->uriLen + prefixLen;
++ n = (int)localPartLen + binding->uriLen + prefixLen;
+ if (n > binding->uriAlloc) {
+ TAG *p;
+-
+ /* Detect and prevent integer overflow */
+ if (n > INT_MAX - EXPAND_SPARE) {
+ return XML_ERROR_NO_MEMORY;
+@@ -4282,10 +4288,14 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ }
+ /* if m_namespaceSeparator != '\0' then uri includes it already */
+ uri = binding->uri + binding->uriLen;
+- memcpy(uri, localPart, i * sizeof(XML_Char));
++ /* Detect and prevent integer overflow */
++ if (localPartLen > SIZE_MAX / sizeof(XML_Char)) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ memcpy(uri, localPart, localPartLen * sizeof(XML_Char));
+ /* we always have a namespace separator between localPart and prefix */
+ if (prefixLen) {
+- uri += i - 1;
++ uri += localPartLen - 1;
+ *uri = parser->m_namespaceSeparator; /* replace null terminator */
+ memcpy(uri + 1, binding->prefix->name, prefixLen * sizeof(XML_Char));
+ }
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
new file mode 100644
index 0000000000..62fdff79e3
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
@@ -0,0 +1,40 @@
+From e8100827a4f68c70d8cadf446bb82bec7cbebbac Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Fri, 22 May 2026 00:43:52 +0200
+Subject: [PATCH] xmlwf: Protect function `xcsdup` from signed integer overflow
+
+CVE: CVE-2026-56403
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15]
+
+(cherry picked from commit 147c8f36d6277d5c6011c098370a8362aed47b15)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 2d0c4f8e..934473ce 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -305,13 +305,18 @@ processingInstruction(void *userData, const XML_Char *target,
+ static XML_Char *
+ xcsdup(const XML_Char *s) {
+ XML_Char *result;
+- int count = 0;
++ size_t count = 0;
+ size_t numBytes;
+
+ /* Get the length of the string, including terminator */
+ while (s[count++] != 0) {
+ /* Do nothing */
+ }
++
++ // Detect and prevent integer overflow
++ if (count > SIZE_MAX / sizeof(XML_Char))
++ return NULL;
++
+ numBytes = count * sizeof(XML_Char);
+ result = malloc(numBytes);
+ if (result == NULL)
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index ae90ec04e3..423219c726 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -19,6 +19,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-45186-07.patch \
file://CVE-2026-41080-1.patch \
file://CVE-2026-41080-2.patch \
+ file://CVE-2026-56403_p1.patch;striplevel=2 \
+ file://CVE-2026-56403_p2.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 02/10] expat: fix CVE-2026-56408
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720121615.2520859-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
The fix is adapted to the existing Expat 2.7.5 copyString implementation.
[1] https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56408
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of
latest wrynose branch merged commits.
.../expat/expat/CVE-2026-56408.patch | 36 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56408.patch b/meta/recipes-core/expat/expat/CVE-2026-56408.patch
new file mode 100644
index 0000000000..b8c43636cc
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56408.patch
@@ -0,0 +1,36 @@
+From b0cf9e9b0f5dfdd938148931a4605a0fd6b917a7 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Thu, 23 Apr 2026 10:31:45 +0200
+Subject: [PATCH] lib: Waterproof `copyString` from integer overflow
+
+CVE: CVE-2026-56408
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817]
+
+Backport Changes:
+- Adapt the fix to Expat 2.7.5, which calculates charsRequired using
+ an existing loop instead of xcslen. The upstream string helper
+ refactoring is not required for the overflow guard.
+
+(cherry picked from commit 16e2efd867ea8567ffa012210b52ef5918e20817)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e441ff7f..4ff5e33b 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -8505,6 +8505,10 @@ copyString(const XML_Char *s, XML_Parser parser) {
+ /* Include the terminator */
+ charsRequired++;
+
++ /* Detect and prevent integer overflow */
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
++ return NULL;
++
+ /* Now allocate space for the copy */
+ result = MALLOC(parser, charsRequired * sizeof(XML_Char));
+ if (result == NULL)
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 423219c726..934cde4b1a 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -21,6 +21,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-41080-2.patch \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
+ file://CVE-2026-56408.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 00/10] expat: Security fixes
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 12:16 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260710130809.2817559-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This v2 series backports security fixes for Expat 2.7.5 in Wrynose.
The listed CVEs affect versions before 2.8.2, so this series carries
the relevant upstream fixes instead of upgrading the stable-branch
recipe.
Changes in v2:
- Regenerate the patch mails with the Wrynose subject prefix:
[wrynose][PATCH v2 nn/10].
- Drop the Wrynose-only stdint.h include from CVE-2026-56403_p2.patch
and CVE-2026-56410_p1.patch because current Wrynose already provides
it through expat.h via OE-Core commit 21042df15008.
- Remove the now-unnecessary Backport Changes note from
CVE-2026-56403_p2.patch and keep only the remaining 2.7.5 context
note for CVE-2026-56410_p1.patch.
- Refresh all the patches on top of latest wrynose branch merge commit.
- CVE-2026-56403: Signed integer overflow in storeAtts namespace URI
construction, with related xcsdup overflow hardening from the same
upstream pull request. Fixed by adding overflow guards before length
conversion, allocation, and copy operations.
Upstream: https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
- CVE-2026-56408: copyString could overflow while calculating the
allocation size for a copied string. Fixed by adding the upstream
allocation overflow guard while keeping the Wrynose 2.7.5 copyString
structure.
Upstream: https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
- CVE-2026-56404: addBinding could hit signed integer overflow while
calculating namespace binding lengths. Fixed by adding upstream
length and allocation bounds checks in the binding path.
Upstream: https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
- CVE-2026-56405: getAttributeId could hit signed integer overflow
while sizing attribute ID storage. Fixed by applying the upstream
overflow checks around the attribute name allocation.
Upstream: https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
- CVE-2026-56410: xmlwf resolveSystemId could overflow while joining
base and system identifiers. Fixed by guarding both the length sum
and the allocation multiplication.
Upstream: https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347
https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea
- CVE-2026-56406: XML_GetBuffer was missing the overflow protection
already used by XML_Parse. Fixed by adding the XML_Index overflow
check, with the prerequisite XML_INDEX_MAX helper backported first.
Upstream: https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd
https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d
- CVE-2026-56409: xmlwf output path construction could overflow while
joining output directory and file name components. Fixed by adding
upstream bounds checks before allocation.
Upstream: https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
- CVE-2026-56411: xmlwf notation list allocation could overflow while
sizing the notation table. Fixed by applying the upstream allocation
checks.
Upstream: https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5
- CVE-2026-56407: Entity textLen handling could exceed signed integer
limits. Fixed by capping entity textLen before storing it in the
signed field.
Upstream: https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
- CVE-2026-56132: Shared DTD scaffolding could store past the
scaffIndex allocation after parser-specific group sizes diverged.
Fixed by tracking scaffIndexSize separately, growing scaffIndex from
its actual allocation size, and backporting the regression test and
related follow-up cleanups.
Upstream: https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3
https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e
https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf
https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4
https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5
Deepak Rathore (10):
expat: fix CVE-2026-56403
expat: fix CVE-2026-56408
expat: fix CVE-2026-56404
expat: fix CVE-2026-56405
expat: fix CVE-2026-56410
expat: fix CVE-2026-56406
expat: fix CVE-2026-56409
expat: fix CVE-2026-56411
expat: fix CVE-2026-56407
expat: fix CVE-2026-56132
.../expat/expat/CVE-2026-56132_p1.patch | 90 +++++++++++++++++++
.../expat/expat/CVE-2026-56132_p2.patch | 63 +++++++++++++
.../expat/expat/CVE-2026-56132_p3.patch | 77 ++++++++++++++++
.../expat/expat/CVE-2026-56132_p4.patch | 63 +++++++++++++
.../expat/expat/CVE-2026-56132_p5.patch | 58 ++++++++++++
.../expat/expat/CVE-2026-56403_p1.patch | 83 +++++++++++++++++++
.../expat/expat/CVE-2026-56403_p2.patch | 40 +++++++++
.../expat/expat/CVE-2026-56404.patch | 47 ++++++++++
.../expat/expat/CVE-2026-56405.patch | 32 +++++++
.../expat/CVE-2026-56406-dependent.patch | 58 ++++++++++++
.../expat/expat/CVE-2026-56406.patch | 37 ++++++++
.../expat/expat/CVE-2026-56407.patch | 44 +++++++++
.../expat/expat/CVE-2026-56408.patch | 36 ++++++++
.../expat/expat/CVE-2026-56409.patch | 53 +++++++++++
.../expat/expat/CVE-2026-56410_p1.patch | 40 +++++++++
.../expat/expat/CVE-2026-56410_p2.patch | 41 +++++++++
.../expat/expat/CVE-2026-56411.patch | 47 ++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 17 ++++
18 files changed, 926 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch
--
2.35.6
^ permalink raw reply
* Re: [OE-core] [PATCH 2/2] kernel-fit-image: introduce FIT_OS variable to override 'os' field
From: Nora Schiffer @ 2026-07-20 12:15 UTC (permalink / raw)
To: adrian.freihofer, openembedded-core; +Cc: oss
In-Reply-To: <c0cfb5e9731b9c7c679ad353fb04ac32e118c1ab.camel@gmail.com>
On Sun, 2026-07-19 at 21:37 +0200, adrian.freihofer@gmail.com wrote:
> On Tue, 2026-07-07 at 13:29 +0200, Nora Schiffer via
> lists.openembedded.org wrote:
> > U-Boot can load an EFI application from a FIT image; this requires
> > setting the OS to "efi" (usually in combination with type
> > "kernel_noload"). Doing so is a convenient approach for giving the OS
> > access to EFI services while preserving other benefits of FIT image
> > boot.
> >
> > Signed-off-by: Nora Schiffer <nora.schiffer@ew.tq-group.com>
> > ---
> > meta/classes-recipe/kernel-fit-image.bbclass | 3 ++-
> > meta/conf/image-fitimage.conf | 4 ++++
> > meta/lib/oe/fitimage.py | 11 ++++++-----
> > meta/lib/oeqa/selftest/cases/fitimage.py | 13 +++++++++++--
> > 4 files changed, 23 insertions(+), 8 deletions(-)
> >
> > diff --git a/meta/classes-recipe/kernel-fit-image.bbclass
> > b/meta/classes-recipe/kernel-fit-image.bbclass
> > index 448a88ccb1..899516e372 100644
> > --- a/meta/classes-recipe/kernel-fit-image.bbclass
> > +++ b/meta/classes-recipe/kernel-fit-image.bbclass
> > @@ -69,7 +69,8 @@ python do_compile() {
> > # Collect all the its nodes before the its file is generated and
> > mkimage gets executed
> > root_node = oe.fitimage.ItsNodeRootKernel(
> > d.getVar("FIT_DESC"), d.getVar("FIT_ADDRESS_CELLS"),
> > - d.getVar('HOST_PREFIX'), d.getVar('UBOOT_ARCH'),
> > d.getVar("FIT_CONF_PREFIX"),
> > + d.getVar('HOST_PREFIX'), d.getVar('UBOOT_ARCH'),
> > d.getVar('FIT_OS'),
> > + d.getVar("FIT_CONF_PREFIX"),
> > oe.types.boolean(d.getVar('FIT_KERNEL_SIGN_ENABLE')),
> > d.getVar("FIT_KERNEL_SIGN_KEYDIR"),
> > d.getVar("UBOOT_MKIMAGE"),
> > d.getVar("UBOOT_MKIMAGE_DTCOPTS"),
> > d.getVar('FIT_MKIMAGE_EXTRA_OPTS'),
> > diff --git a/meta/conf/image-fitimage.conf b/meta/conf/image-
> > fitimage.conf
> > index 2fdb816d55..a06d30e494 100644
> > --- a/meta/conf/image-fitimage.conf
> > +++ b/meta/conf/image-fitimage.conf
> > @@ -37,6 +37,10 @@ FIT_CONF_PREFIX[doc] = "Prefix to use for FIT
> > configuration node name"
> >
> > FIT_SUPPORTED_INITRAMFS_FSTYPES ?= "cpio.lz4 cpio.lzo cpio.lzma
> > cpio.xz cpio.zst cpio.gz ext2.gz cpio"
> >
> > +# os field of the kernel and various other images in the FIT image.
> > Set to "efi"
> > +# to load a kernel with EFI stub as an EFI application.
> > +FIT_OS ?= "linux"
> > +
> > # Allow user to support special use cases where the kernel binary is
> > # not included in the FIT image itself.
> > # This is particularly useful for UKI-based setups, where the kernel
> > diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
> > index 81d18f6c91..86a0e44e12 100644
> > --- a/meta/lib/oe/fitimage.py
> > +++ b/meta/lib/oe/fitimage.py
> > @@ -153,7 +153,7 @@ class ItsNodeRootKernel(ItsNode):
> > If a device tree included in the FIT image, the default
> > configuration is the
> > firt DTB. If there is no dtb present than the default
> > configuation the kernel.
> > """
> > - def __init__(self, description, address_cells, host_prefix,
> > arch, conf_prefix,
> > + def __init__(self, description, address_cells, host_prefix,
> > arch, os, conf_prefix,
>
> Should we use "os" as a variable name? What happens if
>
> import os
>
> os = "efi" ?
>
> os.path.join(...)
>
> To be on the save side, I would suggest to use fit_os, for example.
>
> Thank you for the patch. I think this needs a v2 because of this
> detail. But otherwise it looks good to me.
>
> Sorry for the late response,
> Adrian
Hi Adrian,
thanks for the review. Changing the identifier to fit_os makes sense to me, will
update in v2 or a follow-up patch (depending on whether the v1 currently in
master-next makes it to master or not).
Best,
Nora
>
>
> > sign_enable=False, sign_keydir=None,
> > mkimage=None, mkimage_dtcopts=None,
> > mkimage_extra_opts=None,
> > @@ -171,6 +171,7 @@ class ItsNodeRootKernel(ItsNode):
> >
> > self._host_prefix = host_prefix
> > self._arch = arch
> > + self._os = os
> > self._conf_prefix = conf_prefix
> >
> > # Signature related properties
> > @@ -279,7 +280,7 @@ class ItsNodeRootKernel(ItsNode):
> > opt_props = {
> > "data": '/incbin/("' + kernel_path + '")',
> > "arch": self._arch,
> > - "os": "linux",
> > + "os": self._os,
> > }
> > if load:
> > opt_props["load"] = f"<{load}>"
> > @@ -370,7 +371,7 @@ class ItsNodeRootKernel(ItsNode):
> > {
> > "data": '/incbin/("' + setup_path + '")',
> > "arch": self._arch,
> > - "os": "linux",
> > + "os": self._os,
> > "load": load,
> > "entry": entry
> > }
> > @@ -385,7 +386,7 @@ class ItsNodeRootKernel(ItsNode):
> > "data": '/incbin/("' + ramdisk_path + '")',
> > "type": "ramdisk",
> > "arch": self._arch,
> > - "os": "linux"
> > + "os": self._os,
> > }
> > if load:
> > opt_props["load"] = f"<{load}>"
> > @@ -406,7 +407,7 @@ class ItsNodeRootKernel(ItsNode):
> > opt_props = {
> > "data": '/incbin/("' + filepath + '")',
> > "arch": arch if arch is not None else self._arch,
> > - "os": os if os is not None else "linux",
> > + "os": os if os is not None else self._os,
> > }
> >
> > if load:
> > diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py
> > b/meta/lib/oeqa/selftest/cases/fitimage.py
> > index c5f2975223..d28b5b8965 100644
> > --- a/meta/lib/oeqa/selftest/cases/fitimage.py
> > +++ b/meta/lib/oeqa/selftest/cases/fitimage.py
> > @@ -670,6 +670,7 @@ class KernelFitImageBase(FitImageTestCase):
> > 'FIT_LOADABLES',
> > 'FIT_LOADABLE_ENTRYPOINT',
> > 'FIT_LOADABLE_LOADADDRESS',
> > + 'FIT_OS',
> > 'FIT_SIGN_ALG',
> > 'FIT_SIGN_INDIVIDUAL',
> > 'FIT_UBOOT_ENV',
> > @@ -904,7 +905,7 @@ class KernelFitImageBase(FitImageTestCase):
> > # 'compression = "' +
> > str(bb_vars['FIT_KERNEL_COMP_ALG']) + '";', defined based on files in
> > TMPDIR, not ideal...
> > 'data = /incbin/("linux.bin");',
> > 'arch = "' + str(bb_vars['UBOOT_ARCH']) + '";',
> > - 'os = "linux";',
> > + 'os = "%s";' % bb_vars['FIT_OS'],
> > 'load = <' + str(bb_vars['UBOOT_LOADADDRESS']) + '>;',
> > 'entry = <' + str(bb_vars['UBOOT_ENTRYPOINT']) + '>;',
> > ]
> > @@ -1463,6 +1464,7 @@ class FitImagePyTests(KernelFitImageBase):
> > 'FIT_KEY_SIGN_PKCS': "-x509",
> > 'FIT_LOADABLES': "",
> > 'FIT_LINUX_BIN': "linux.bin",
> > + 'FIT_OS': "linux",
> > 'FIT_PAD_ALG': "pkcs-1.5",
> > 'FIT_SIGN_ALG': "rsa2048",
> > 'FIT_SIGN_INDIVIDUAL': "0",
> > @@ -1503,7 +1505,8 @@ class FitImagePyTests(KernelFitImageBase):
> >
> > root_node = oe.fitimage.ItsNodeRootKernel(
> > bb_vars["FIT_DESC"], bb_vars["FIT_ADDRESS_CELLS"],
> > - bb_vars['HOST_PREFIX'], bb_vars['UBOOT_ARCH'],
> > bb_vars["FIT_CONF_PREFIX"],
> > + bb_vars['HOST_PREFIX'], bb_vars['UBOOT_ARCH'],
> > bb_vars['FIT_OS'],
> > + bb_vars["FIT_CONF_PREFIX"],
> > oe.types.boolean(bb_vars['UBOOT_SIGN_ENABLE']),
> > bb_vars["UBOOT_SIGN_KEYDIR"],
> > bb_vars["UBOOT_MKIMAGE"],
> > bb_vars["UBOOT_MKIMAGE_DTCOPTS"],
> > bb_vars["UBOOT_MKIMAGE_SIGN"],
> > bb_vars["UBOOT_MKIMAGE_SIGN_ARGS"],
> > @@ -1609,6 +1612,12 @@ class FitImagePyTests(KernelFitImageBase):
> > }
> > self._test_fitimage_py(bb_vars_overrides)
> >
> > + def test_fitimage_py_conf_os(self):
> > + """Test FIT_OS functionality"""
> > + bb_vars_overrides = {
> > + 'FIT_OS': "efi",
> > + }
> > + self._test_fitimage_py(bb_vars_overrides)
> >
> > class UBootFitImageTests(FitImageTestCase):
> > """Test cases for the uboot-sign bbclass"""
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#240383):
> > https://lists.openembedded.org/g/openembedded-core/message/240383
> > Mute This Topic: https://lists.openembedded.org/mt/120154469/4454582
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe:
> > https://lists.openembedded.org/g/openembedded-core/unsub [
> > adrian.freihofer@gmail.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
--
TQ-Systems GmbH | Mühlstraße 2, Gut Delling | 82229 Seefeld, Germany
Amtsgericht München, HRB 105018
Geschäftsführer: Detlef Schneider, Rüdiger Stahl, Stefan Schneider
https://www.tq-group.com/
^ permalink raw reply
* Re: [OE-core][wrynose 10/17] u-boot: re-enable RISC-V compressed (c) ISA extension
From: Yoann Congal @ 2026-07-20 12:07 UTC (permalink / raw)
To: Gustavo Nihei, Paul Barker,
openembedded-core@lists.openembedded.org
In-Reply-To: <PUZPR04MB54191B12EAA85D1C673596A6EBC32@PUZPR04MB5419.apcprd04.prod.outlook.com>
On Mon Jul 20, 2026 at 2:05 PM CEST, Gustavo Nihei wrote:
> You're right, that was my mistake.
> Should I send a v2 of this backport with the corrected "Fixes:" tag?
Yes, please, send a v2 for wrynose :)
> The already-merged master commit (fef027f2350c) carries the same wrong tag.
> Let me know if you'd like a follow-up fixup there too, or if it's fine to leave as-is.
We won't be able to change the commit in master so nothing to do there.
>
> Best regards,
> Gustavo.
> ________________________________
> From: Paul Barker <paul@pbarker.dev>
> Sent: Monday, July 20, 2026 04:48
> To: yoann.congal@smile.fr <yoann.congal@smile.fr>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Cc: Gustavo Nihei <gustavo.nihei@espressif.com>
> Subject: Re: [OE-core][wrynose 10/17] u-boot: re-enable RISC-V compressed (c) ISA extension
>
> [You don't often get email from paul@pbarker.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> [External: This email originated outside Espressif]
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core][wrynose 10/17] u-boot: re-enable RISC-V compressed (c) ISA extension
From: Gustavo Nihei @ 2026-07-20 12:05 UTC (permalink / raw)
To: Paul Barker, yoann.congal@smile.fr,
openembedded-core@lists.openembedded.org
In-Reply-To: <342a1c637da6f078150b43045fdd48c5ae7a7a98.camel@pbarker.dev>
[-- Attachment #1: Type: text/plain, Size: 869 bytes --]
You're right, that was my mistake.
Should I send a v2 of this backport with the corrected "Fixes:" tag? The already-merged master commit (fef027f2350c) carries the same wrong tag.
Let me know if you'd like a follow-up fixup there too, or if it's fine to leave as-is.
Best regards,
Gustavo.
________________________________
From: Paul Barker <paul@pbarker.dev>
Sent: Monday, July 20, 2026 04:48
To: yoann.congal@smile.fr <yoann.congal@smile.fr>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Gustavo Nihei <gustavo.nihei@espressif.com>
Subject: Re: [OE-core][wrynose 10/17] u-boot: re-enable RISC-V compressed (c) ISA extension
[You don't often get email from paul@pbarker.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
[External: This email originated outside Espressif]
[-- Attachment #2: Type: text/html, Size: 2626 bytes --]
^ permalink raw reply
* Re: [OE-core][wrynose][PATCH 1/2] gnutls: Fix CVE-2026-3832
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:42 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org, yoann.congal@smile.fr
In-Reply-To: <DK3CWFWYP9UE.5WID74XZESIV@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 1868 bytes --]
Hi Yoann,
I have sent v2 of this CVEs as below:
1.
https://lists.openembedded.org/g/openembedded-core/topic/120357169
2.
https://lists.openembedded.org/g/openembedded-core/topic/120357170
Thanks for your review.
Regards,
Deepak
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Monday, July 20, 2026 4:49 PM
To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <deeratho@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][wrynose][PATCH 1/2] gnutls: Fix CVE-2026-3832
On Mon Jul 20, 2026 at 1:05 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream fix [1] and test coverage [2], as
> referenced in [3], to address multi-record OCSP response handling where
> GnuTLS could check revocation status from the wrong OCSP entry.
>
> [1] https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2
> [2] https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e
> [3] https://security-tracker.debian.org/tracker/CVE-2026-3832
>
> Reference:
> https://nvd.nist.gov/vuln/detail/CVE-2026-3832
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Hello,
All that series should be tagged v2 with a changelog where appropriate:
https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#taking-patch-review-into-account
Can you resend it with the v2 tag? You can use -v2 if you use git-send-email.
Adding these tags/changelog helps me a lot when tracking patch status.
Thanks!
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 5853 bytes --]
^ permalink raw reply
* [OE-core][wrynose][PATCH v2 1/2] gnutls: Fix CVE-2026-3832
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:40 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720110548.2458865-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix [1] and test coverage [2], as
referenced in [3], to address multi-record OCSP response handling where
GnuTLS could check revocation status from the wrong OCSP entry.
[1] https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2
[2] https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e
[3] https://security-tracker.debian.org/tracker/CVE-2026-3832
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-3832
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of the latest wrynose
branch merged commit.
.../gnutls/gnutls/CVE-2026-3832_p1.patch | 52 ++++++++
.../gnutls/gnutls/CVE-2026-3832_p2.patch | 114 ++++++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 168 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
new file mode 100644
index 0000000000..3786c578b9
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
@@ -0,0 +1,52 @@
+From 141c9b6015fc56cd05db3a853f08d03fcbd9b0f4 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Thu, 12 Mar 2026 09:48:57 +0100
+Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass
+
+In check_ocsp_response(), the code first searched
+for the SingleResponse that matches the certificate being validated.
+But later, the status was retrieved from entry 0 unconditionally,
+rather than from the matched resp_indx.
+As a result, if entry 0 corresponded to a different certificate and was good,
+while the matched entry for the peer certificate is revoked,
+the revocation check could've mistakenly accept the certificate.
+
+Reported-by: Oleh Konko (1seal) <security@1seal.org>
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1801
+Fixes: #1812
+Fixes: CVE-2026-3832
+Fixes: GNUTLS-SA-2026-04-29-12
+CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
+Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9
+
+CVE: CVE-2026-3832
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2]
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit 731861b9de8dccaf7d3b0c1446833051e48670c2)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/cert-session.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/cert-session.c b/lib/cert-session.c
+index 963f797ee..f48c7a1fb 100644
+--- a/lib/cert-session.c
++++ b/lib/cert-session.c
+@@ -343,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
+ goto cleanup;
+ }
+
+- ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,
+- &cert_status, &vtime, &ntime, &rtime,
+- NULL);
++ ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL,
++ NULL, &cert_status, &vtime, &ntime,
++ &rtime, NULL);
+ if (ret < 0) {
+ _gnutls_audit_log(
+ session,
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
new file mode 100644
index 0000000000..54ea38fe69
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
@@ -0,0 +1,114 @@
+From ac357f76abeaf59429bc15b8764ad01920df0ef1 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Thu, 12 Mar 2026 15:25:24 +0100
+Subject: [PATCH] tests/ocsp-tests/ocsp-must-staple-connection: test
+ CVE-2026-3832
+
+CVE: CVE-2026-3832
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e]
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ .../ocsp-tests/ocsp-must-staple-connection.sh | 70 +++++++++++++++++++
+ 1 file changed, 70 insertions(+)
+
+diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
+index 94d41ce24..5e100b9d9 100755
+--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
++++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
+@@ -85,6 +85,7 @@ OCSP_RESPONSE_FILE="$testdir/ms-resp.tmp"
+ OCSP_REQ_FILE="$testdir/ms-req.tmp"
+ INDEXFILE="$testdir/ocsp_index.txt"
+ ATTRFILE="${INDEXFILE}.attr"
++SERVER_CERT_BAD_FILE="$testdir/ms-cert-bad.pem.tmp"
+
+ stop_servers ()
+ {
+@@ -118,6 +119,20 @@ ${CERTTOOL} \
+ --load-privkey "${srcdir}/ocsp-tests/certs/server_good.key" \
+ --template "${TEMPLATE_FILE}" --outfile "${SERVER_CERT_FILE}" 2>/dev/null
+
++echo "=== Generating bad server certificate ==="
++
++rm -f "$TEMPLATE_FILE"
++cp "${srcdir}/ocsp-tests/certs/server_bad.template" "$TEMPLATE_FILE"
++chmod u+w "$TEMPLATE_FILE"
++echo "ocsp_uri=http://localhost:${OCSP_PORT}/ocsp/" >>"$TEMPLATE_FILE"
++
++${CERTTOOL} \
++ --attime "${CERTDATE}" \
++ --generate-certificate --load-ca-privkey "${srcdir}/ocsp-tests/certs/ca.key" \
++ --load-ca-certificate "${srcdir}/ocsp-tests/certs/ca.pem" \
++ --load-privkey "${srcdir}/ocsp-tests/certs/server_bad.key" \
++ --template "${TEMPLATE_FILE}" --outfile "${SERVER_CERT_BAD_FILE}" 2>/dev/null
++
+ echo "=== Bringing OCSP server up ==="
+
+ cp "${srcdir}/ocsp-tests/certs/ocsp_index.txt" ${INDEXFILE}
+@@ -486,6 +501,61 @@ kill "${TLS_SERVER_PID}"
+ wait "${TLS_SERVER_PID}"
+ unset TLS_SERVER_PID
+
++echo "=== Test 10: Server with revoked certificate - CVE-2026-3832 ==="
++
++# The revocation status was always mistakenly checked for the first cert.
++# Check a pair of responses: (irrelevant good unrevoked, relevant bad revoked).
++
++rm -f "${OCSP_RESPONSE_FILE}"
++
++"$FAKETIME" "${TESTDATE}" \
++ ${OPENSSL} ocsp -index "${INDEXFILE}" \
++ -issuer "${srcdir}/ocsp-tests/certs/ca.pem" \
++ -CA "${srcdir}/ocsp-tests/certs/ca.pem" \
++ -rsigner "${srcdir}/ocsp-tests/certs/ocsp-server.pem" \
++ -rkey "${srcdir}/ocsp-tests/certs/ocsp-server.key" \
++ -cert "${SERVER_CERT_FILE}" \
++ -cert "${SERVER_CERT_BAD_FILE}" \
++ -respout "${OCSP_RESPONSE_FILE}"
++
++eval "${GETPORT}"
++# Port for gnutls-serv
++TLS_SERVER_PORT=$PORT
++PORT=${TLS_SERVER_PORT}
++launch_bare_server \
++ "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
++ --x509keyfile="${srcdir}/ocsp-tests/certs/server_bad.key" \
++ --x509certfile="${SERVER_CERT_BAD_FILE}" \
++ --port="${TLS_SERVER_PORT}" \
++ --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
++TLS_SERVER_PID="${!}"
++wait_server $TLS_SERVER_PID
++
++wait_for_port "${TLS_SERVER_PORT}"
++
++out=$(
++ echo "test 123456" | \
++ "${CLI}" -d1 --attime "${TESTDATE}" --ocsp \
++ --x509cafile "${srcdir}/ocsp-tests/certs/ca.pem" \
++ --port "${TLS_SERVER_PORT}" localhost \
++ 2>&1
++ rc=$?
++)
++printf '%s\n' "$out"
++
++if test "${rc}" = "0"; then
++ echo 'ERROR: client accepted a revoked leaf (CVE-2026-3832)'
++ exit 1
++fi
++if ! echo "${out}" | grep "The certificate was revoked via OCSP" >/dev/null
++then
++ echo '"The certificate was revoked via OCSP" not found in output'
++ exit 1
++fi
++
++kill "${TLS_SERVER_PID}"
++wait "${TLS_SERVER_PID}"
++unset TLS_SERVER_PID
+
+ kill ${OCSP_PID}
+ wait ${OCSP_PID}
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index b92470768c..03eee5c50e 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -32,6 +32,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0006-buffers-match-DTLS-datagrams-by-sequence-number.patch \
file://0007-tests-mini-dtls-fragments-1839-mismatching-message_s.patch \
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
+ file://CVE-2026-3832_p1.patch \
+ file://CVE-2026-3832_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 2/2] gnutls: Fix CVE-2026-42009
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:40 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720114046.2487998-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies upstream fixes [1] and [2], as referenced in [3],
to address a DTLS packet reordering flaw where duplicate sequence
numbers could lead to unstable ordering or undefined behavior.
Rebase CVE-2026-42009_p1.patch on top of the Wrynose
CVE-2026-33846 backport stack, which already includes the recv_buf
helper from upstream commit 9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0.
[1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
[2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
[3] https://security-tracker.debian.org/tracker/CVE-2026-42009
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-42009
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patch on top of the latest wrynose
branch merged commit.
.../gnutls/gnutls/CVE-2026-42009_p1.patch | 62 +++++++++++++++++++
.../gnutls/gnutls/CVE-2026-42009_p2.patch | 48 ++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 112 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
new file mode 100644
index 0000000000..f1ee618b48
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
@@ -0,0 +1,62 @@
+From d1191b910e63149a10647a089995d3cd85e16400 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Tue, 21 Apr 2026 16:52:48 +0200
+Subject: [PATCH] lib/buffers: ensure packets have differing sequence
+ numbers
+
+There should normally be no packets with same sequence number and
+differing handshake type, unless an adversary crafts them.
+Discarding them allows to get rid of packets
+with duplicate sequence ID in the buffer,
+relieving us from the question of how to sort them later.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d]
+
+Backport Changes:
+- Rebased on top of the Wrynose CVE-2026-33846 backport stack, which
+ already includes the recv_buf helper and sequence-number matching
+ prerequisite patches.
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit f01e21441e29052a6f0963840794c41d3b3ee66d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index 62f140ed3..e7f08b5625 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -971,8 +971,20 @@ static int merge_handshake_packet(gnutls_session_t session,
+ session->internals.handshake_recv_buffer;
+
+ for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) {
+- if (recv_buf[i].htype == hsk->htype &&
+- recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].htype != hsk->htype) {
++ _gnutls_audit_log(
++ session,
++ "Discarded unexpected handshake packet "
++ "with duplicate sequence %d, but "
++ "mismatched type %s (previously %s)\n",
++ hsk->sequence,
++ _gnutls_handshake2str(hsk->htype),
++ _gnutls_handshake2str(
++ recv_buf[i].htype));
++ _gnutls_handshake_buffer_clear(hsk);
++ return 0;
++ }
+ exists = 1;
+ pos = i;
+ break;
+--
+2.51.0
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
new file mode 100644
index 0000000000..6524cb47b4
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
@@ -0,0 +1,48 @@
+From 5374a6d584b8598511f7880b4e64ee52ee1f0cc5 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <joshua@joshua.hu>
+Date: Tue, 21 Apr 2026 18:11:39 +0200
+Subject: [PATCH] buffers: fix handshake_compare when sequence numbers
+ match
+
+The comparator function used for ordering DTLS packets
+by sequence numbers did not follow qsort comparator contracts
+in case of packets with duplicate sequence numbers,
+which could lead to unstable ordering or undefined behaviour.
+Returning 0 in such cases makes the sorting stable.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f]
+
+Signed-off-by: Joshua Rogers <joshua@joshua.hu>
+(cherry picked from commit f341441fad91142897d83b44a175ffc8f925b76f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index e7f08b5625..1ac27e4e96 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2)
+ {
+ const handshake_buffer_st *e1 = _e1;
+ const handshake_buffer_st *e2 = _e2;
+-
+- if (e1->sequence <= e2->sequence)
+- return 1;
+- else
+- return -1;
++ return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence);
+ }
+
+ #define SSL2_HEADERS 1
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index 03eee5c50e..3085a62310 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -34,6 +34,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
file://CVE-2026-3832_p1.patch \
file://CVE-2026-3832_p2.patch \
+ file://CVE-2026-42009_p1.patch \
+ file://CVE-2026-42009_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
--
2.35.6
^ permalink raw reply related
* Re: [OE-core][wrynose][PATCH 1/5] curl: ignore CVE-2026-4873
From: Yoann Congal @ 2026-07-20 11:35 UTC (permalink / raw)
To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco),
openembedded-core@lists.openembedded.org
In-Reply-To: <DM4PR11MB61893CF41B1EA33238B839A6C4C32@DM4PR11MB6189.namprd11.prod.outlook.com>
On Mon Jul 20, 2026 at 1:34 PM CEST, Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> I have sent the v2 of this curl patch series as below:
>
> 1.
> https://lists.openembedded.org/g/openembedded-core/topic/120357095
> 2.
> https://lists.openembedded.org/g/openembedded-core/topic/120357098
> 3.
> https://lists.openembedded.org/g/openembedded-core/topic/120357102
> 4.
> https://lists.openembedded.org/g/openembedded-core/topic/120357099
> 5.
> https://lists.openembedded.org/g/openembedded-core/topic/120357100
>
> Thanks for your review.
Thanks for the followup :)
>
> Regards,
> Deepak
>
> ________________________________
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
> Sent: Monday, July 20, 2026 4:47 PM
> To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <deeratho@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core][wrynose][PATCH 1/5] curl: ignore CVE-2026-4873
>
> On Mon Jul 20, 2026 at 12:56 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
>> From: Deepak Rathore <deeratho@cisco.com>
>>
>> - CVE-2026-4873 affects curl before 8.20.0 when a connection negotiated with
>> clear-text IMAP, POP3, or SMTP can later be reused for a TLS-required
>> transfer.
>> - In wrynose, these protocols are optional PACKAGECONFIG entries and are not
>> enabled by default in curl_8.19.0.bb, so record this CVE as configuration-not-applicable
>> for the default recipe configuration.
>>
>> Reference:
>> - https://curl.se/docs/CVE-2026-4873.html
>> - https://nvd.nist.gov/vuln/detail/CVE-2026-4873
>>
>> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
>
> Hello,
>
> All that series should be tagged v2 with a changelog where appropriate:
> https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#taking-patch-review-into-account
>
> Can you resend it with the v2 tag? You can use -v2 if you use git-send-email.
>
> Adding these tags/changelog helps me a lot when tracking patch status.
>
> Thanks!
> --
> Yoann Congal
> Smile ECS
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core][wrynose][PATCH 1/5] curl: ignore CVE-2026-4873
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:34 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org, yoann.congal@smile.fr
In-Reply-To: <DK3CUBQXME2E.3GE5VN0QYZB4J@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 2086 bytes --]
Hi Yoann,
I have sent the v2 of this curl patch series as below:
1.
https://lists.openembedded.org/g/openembedded-core/topic/120357095
2.
https://lists.openembedded.org/g/openembedded-core/topic/120357098
3.
https://lists.openembedded.org/g/openembedded-core/topic/120357102
4.
https://lists.openembedded.org/g/openembedded-core/topic/120357099
5.
https://lists.openembedded.org/g/openembedded-core/topic/120357100
Thanks for your review.
Regards,
Deepak
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Monday, July 20, 2026 4:47 PM
To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <deeratho@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][wrynose][PATCH 1/5] curl: ignore CVE-2026-4873
On Mon Jul 20, 2026 at 12:56 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> - CVE-2026-4873 affects curl before 8.20.0 when a connection negotiated with
> clear-text IMAP, POP3, or SMTP can later be reused for a TLS-required
> transfer.
> - In wrynose, these protocols are optional PACKAGECONFIG entries and are not
> enabled by default in curl_8.19.0.bb, so record this CVE as configuration-not-applicable
> for the default recipe configuration.
>
> Reference:
> - https://curl.se/docs/CVE-2026-4873.html
> - https://nvd.nist.gov/vuln/detail/CVE-2026-4873
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Hello,
All that series should be tagged v2 with a changelog where appropriate:
https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#taking-patch-review-into-account
Can you resend it with the v2 tag? You can use -v2 if you use git-send-email.
Adding these tags/changelog helps me a lot when tracking patch status.
Thanks!
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 6846 bytes --]
^ permalink raw reply
* [OE-core][wrynose][PATCH v2 3/5] curl: fix CVE-2026-6253
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:30 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720113041.2479444-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for the proxy credential leak on redirect
described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f
[2] https://curl.se/docs/CVE-2026-6253.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-6253
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patches on top of the latest
wrynose branch.
.../curl/curl/CVE-2026-6253.patch | 389 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 390 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6253.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6253.patch b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
new file mode 100644
index 0000000000..0e7dd72612
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
@@ -0,0 +1,389 @@
+From 188c2f166a20fa97c2325b2da7d0e5cecc13725f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 13 Apr 2026 17:17:23 +0200
+Subject: [PATCH] http: clear the proxy credentials as well on port or scheme
+ change
+
+Add tests 2009-2011 to verify switching between proxies with credentials
+when the switch is driven by a redirect
+
+Reported-by: Dwij Mehta
+
+Closes #21304
+
+CVE: CVE-2026-6253
+Upstream-Status: Backport [https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f]
+
+Backport Changes:
+- Adapted the redirect credential reset hunk to curl 8.19.0 Curl_http_follow() after the existing wrynose CVE-2026-6276 backport.
+- Adapted tests/data/Makefile.am placement for the wrynose test list.
+
+(cherry picked from commit 188c2f166a20fa97c2325b2da7d0e5cecc13725f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/http.c | 12 +++++++
+ lib/transfer.c | 51 +++++++++++++++++++++---------
+ lib/transfer.h | 2 ++
+ tests/data/Makefile.am | 1 +
+ tests/data/test2009 | 70 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2010 | 71 ++++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2011 | 70 +++++++++++++++++++++++++++++++++++++++++
+ 7 files changed, 262 insertions(+), 15 deletions(-)
+ create mode 100644 tests/data/test2009
+ create mode 100644 tests/data/test2010
+ create mode 100644 tests/data/test2011
+
+diff --git a/lib/http.c b/lib/http.c
+index 7ebbdfa..b960d79 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1252,12 +1252,24 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+ curlx_free(scheme);
+ }
+ if(clear) {
++ CURLcode result = Curl_reset_userpwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
++ }
+ Curl_safefree(data->state.aptr.user);
+ Curl_safefree(data->state.aptr.passwd);
+ }
+ }
+ }
+ DEBUGASSERT(follow_url);
++ {
++ CURLcode result = Curl_reset_proxypwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
++ }
++ }
+
+ if(type == FOLLOW_FAKE) {
+ /* we are only figuring out the new URL if we would have followed locations
+diff --git a/lib/transfer.c b/lib/transfer.c
+index 6dd2f52..af5bee2 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -439,6 +439,40 @@ void Curl_init_CONNECT(struct Curl_easy *data)
+ data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
+ }
+
++/*
++ * Restore the user credentials to those set in options.
++ */
++CURLcode Curl_reset_userpwd(struct Curl_easy *data)
++{
++ CURLcode result;
++ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD])
++ data->state.creds_from = CREDS_OPTION;
++ result = Curl_setstropt(&data->state.aptr.user,
++ data->set.str[STRING_USERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.passwd,
++ data->set.str[STRING_PASSWORD]);
++ return result;
++}
++
++/*
++ * Restore the proxy credentials to those set in options.
++ */
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data)
++{
++#ifndef CURL_DISABLE_PROXY
++ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser,
++ data->set.str[STRING_PROXYUSERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.proxypasswd,
++ data->set.str[STRING_PROXYPASSWORD]);
++ return result;
++#else
++ (void)data;
++ return CURLE_OK;
++#endif
++}
++
+ /*
+ * Curl_pretransfer() is called immediately before a transfer starts, and only
+ * once for one transfer no matter if it has redirects or do multi-pass
+@@ -584,23 +618,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+- if(data->set.str[STRING_USERNAME] ||
+- data->set.str[STRING_PASSWORD])
+- data->state.creds_from = CREDS_OPTION;
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.user,
+- data->set.str[STRING_USERNAME]);
++ result = Curl_reset_userpwd(data);
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.passwd,
+- data->set.str[STRING_PASSWORD]);
+-#ifndef CURL_DISABLE_PROXY
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxyuser,
+- data->set.str[STRING_PROXYUSERNAME]);
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxypasswd,
+- data->set.str[STRING_PROXYPASSWORD]);
+-#endif
++ result = Curl_reset_proxypwd(data);
+
+ data->req.headerbytecount = 0;
+ Curl_headers_cleanup(data);
+diff --git a/lib/transfer.h b/lib/transfer.h
+index 05a5f89..131e31a 100644
+--- a/lib/transfer.h
++++ b/lib/transfer.h
+@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data,
+
+ void Curl_init_CONNECT(struct Curl_easy *data);
+
++CURLcode Curl_reset_userpwd(struct Curl_easy *data);
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data);
+ CURLcode Curl_pretransfer(struct Curl_easy *data);
+
+ CURLcode Curl_sendrecv(struct Curl_easy *data);
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index da0f8f5..00a5221 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -244,6 +244,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
+ test1978 test1979 test1980 test1981 \
+ \
+ test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
++test2009 test2010 test2011 \
+ \
+ test2023 \
+ test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+diff --git a/tests/data/test2009 b/tests/data/test2009
+new file mode 100644
+index 0000000..d2fd79e
+--- /dev/null
++++ b/tests/data/test2009
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via env variables, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2010 b/tests/data/test2010
+new file mode 100644
+index 0000000..443ae9d
+--- /dev/null
++++ b/tests/data/test2010
+@@ -0,0 +1,71 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via options for two proxies, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2011 b/tests/data/test2011
+new file mode 100644
+index 0000000..dd4e534
+--- /dev/null
++++ b/tests/data/test2011
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy creds via env, cross-scheme redirect, --location-trusted
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --location-trusted --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 558a2d311e..b1ee0f8b9b 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -18,6 +18,7 @@ SRC_URI = " \
file://CVE-2026-5773.patch \
file://mbedtls.patch \
file://CVE-2026-5545.patch \
+ file://CVE-2026-6253.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 5/5] curl: fix CVE-2026-7168
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:30 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720113041.2479444-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for proxy Digest state reuse across proxy
switches described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
[2] https://curl.se/docs/CVE-2026-7168.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-7168
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patches on top of the latest
wrynose branch.
.../curl/curl/CVE-2026-7168.patch | 373 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 374 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
new file mode 100644
index 0000000000..b848fbaf84
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
@@ -0,0 +1,373 @@
+From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 27 Apr 2026 09:14:51 +0200
+Subject: [PATCH] setopt: clear proxy auth properties when switching
+
+Verify with test 1588
+
+Closes #21453
+
+CVE: CVE-2026-7168
+Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507]
+
+Backport Changes:
+- Adapted setproxy() insertion and test-list placement to the curl 8.19.0 wrynose layout.
+
+(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/setopt.c | 14 +++-
+ lib/vauth/vauth.h | 1 +
+ tests/data/Makefile.am | 2 +-
+ tests/data/test1588 | 106 ++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc | 2 +-
+ tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 272 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test1588
+ create mode 100644 tests/libtest/lib1588.c
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 84f3e02..d12ffb6 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -49,6 +49,7 @@
+ #include "curlx/strdup.h"
+ #include "escape.h"
+ #include "bufref.h"
++#include "vauth/vauth.h"
+
+ static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs)
+ {
+@@ -1664,6 +1665,17 @@ static CURLcode cookiefile(struct Curl_easy *data, const char *ptr)
+ #endif
+
+ #ifndef CURL_DISABLE_PROXY
++static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
++{
++ if((data->set.str[STRING_PROXY] && proxy) &&
++ !strcmp(data->set.str[STRING_PROXY], proxy))
++ return CURLE_OK;
++
++ Curl_auth_digest_cleanup(&data->state.proxydigest);
++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
++}
++
+ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+ const char *ptr)
+ {
+@@ -1759,7 +1771,7 @@ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+ * Setting it to NULL, means no proxy but allows the environment variables
+ * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
+ */
+- return Curl_setstropt(&s->str[STRING_PROXY], ptr);
++ return setproxy(data, ptr);
+ case CURLOPT_PRE_PROXY:
+ /*
+ * Set proxy server:port to use as SOCKS proxy.
+diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
+index 3e66c89..20ee51e 100644
+--- a/lib/vauth/vauth.h
++++ b/lib/vauth/vauth.h
+@@ -117,6 +117,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
+ /* This is used to clean up the digest specific data */
+ void Curl_auth_digest_cleanup(struct digestdata *digest);
+ #else
++#define Curl_auth_digest_cleanup(x)
+ #define Curl_auth_is_digest_supported() FALSE
+ #endif /* !CURL_DISABLE_DIGEST_AUTH */
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 1b76b01..1e84b26 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -208,7 +208,7 @@ test1548 test1549 test1550 test1551 test1552 test1553 test1554 test1555 \
+ test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \
+ test1564 test1565 test1566 test1567 test1568 test1569 test1570 test1571 \
+ test1572 test1573 test1574 test1575 test1576 test1577 test1578 test1579 \
+-test1580 test1581 test1582 test1583 test1584 test1585 \
++test1580 test1581 test1582 test1583 test1584 test1585 test1588 \
+ \
+ test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
+ test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \
+diff --git a/tests/data/test1588 b/tests/data/test1588
+new file mode 100644
+index 0000000..753e98c
+--- /dev/null
++++ b/tests/data/test1588
+@@ -0,0 +1,106 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<datacheck crlf="headers">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</datacheck>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest
++</features>
++<name>
++HTTP proxy auth Digest, then change proxy and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 2f77c16..96b82bc 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -97,7 +97,7 @@ TESTS_C = \
+ lib1559.c lib1560.c lib1564.c lib1565.c \
+ lib1567.c lib1568.c lib1569.c lib1571.c \
+ lib1576.c \
+- lib1582.c \
++ lib1582.c lib1588.c \
+ lib1591.c lib1592.c lib1593.c lib1594.c lib1597.c \
+ lib1598.c lib1599.c \
+ lib1662.c \
+diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
+new file mode 100644
+index 0000000..9b12f36
+--- /dev/null
++++ b/tests/libtest/lib1588.c
+@@ -0,0 +1,150 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = URL
++ * argv2 = proxy host
++ * argv3 = proxy port
++ * argv4 = proxyuser:password
++ */
++
++#include "first.h"
++
++static CURLcode init1588(CURL *curl, const char *url,
++ const char *userpwd, const char *proxy)
++{
++ CURLcode result = CURLE_OK;
++
++ res_easy_setopt(curl, CURLOPT_URL, url);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++ if(result)
++ goto init_failed;
++#if 0
++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
++ if(result)
++ goto init_failed;
++#endif
++
++ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
++ if(result)
++ goto init_failed;
++
++ return CURLE_OK; /* success */
++
++init_failed:
++ return result; /* failure */
++}
++
++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
++ const char *proxy)
++{
++ CURLcode result = CURLE_OK;
++
++ result = init1588(curl, url, userpwd, proxy);
++ if(result)
++ return result;
++
++ return curl_easy_perform(curl);
++}
++
++static CURLcode test_lib1588(const char *URL)
++{
++ CURLcode result = CURLE_OK;
++ CURL *curl = NULL;
++ const char *proxyuserpws = libtest_arg4;
++ struct curl_slist *host = NULL;
++ struct curl_slist *host2 = NULL;
++ char proxy1_resolve[128];
++ char proxy2_resolve[128];
++ char proxy1_connect[128];
++ char proxy2_connect[128];
++
++ if(test_argc < 3)
++ return TEST_ERR_MAJOR_BAD;
++
++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
++
++ /* we connect to the fake host name but the right port number */
++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
++ "firstproxy:%s", libtest_arg3);
++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
++ "secondproxy:%s", libtest_arg3);
++
++ res_global_init(CURL_GLOBAL_ALL);
++ if(result)
++ return result;
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ host = curl_slist_append(NULL, proxy1_resolve);
++ if(!host)
++ goto test_cleanup;
++ host2 = curl_slist_append(host, proxy2_resolve);
++ if(!host2)
++ goto test_cleanup;
++ host = host2;
++
++ start_test_timing();
++
++ easy_setopt(curl, CURLOPT_RESOLVE, host);
++
++ result = run1588(curl, URL, proxyuserpws, proxy1_connect);
++ if(result)
++ goto test_cleanup;
++
++ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
++
++ result = run1588(curl, URL, proxyuserpws, proxy2_connect);
++
++test_cleanup:
++
++ /* proper cleanup sequence - type PB */
++
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++ curl_slist_free_all(host);
++ return result;
++}
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 683163bfa6..7996aa7d00 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -21,6 +21,7 @@ SRC_URI = " \
file://CVE-2026-6253.patch \
file://CVE-2026-6429-dependent.patch \
file://CVE-2026-6429.patch \
+ file://CVE-2026-7168.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 4/5] curl: fix CVE-2026-6429
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:30 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720113041.2479444-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] and the required dependent change [2] to
address the netrc credential leak across redirects, as mentioned in [3] and
tracked by [4].
[1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
[2] https://github.com/curl/curl/commit/32a513e180ce83d5e9b708211306045407074134
[3] https://curl.se/docs/CVE-2026-6429.html
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-6429
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Fixed curl-native compilation issue and
Refresh the patches on top of the latest wrynose branch.
.../curl/curl/CVE-2026-6429-dependent.patch | 81 +++++
.../curl/curl/CVE-2026-6429.patch | 325 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 2 +
3 files changed, 408 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
new file mode 100644
index 0000000000..a3f68ae539
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
@@ -0,0 +1,81 @@
+From 6b1769c54659f1e6d6323891cb45c682c22182b7 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 15 Apr 2026 10:43:12 +0200
+Subject: [PATCH] urlapi: same origin tests
+
+Add new internal `curl_url_same_origin()` to check if a href has the
+same origin as a base URL. Add test cases in test1675 and use this in
+http2 push handling.
+
+Closes #21328
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/32a513e180ce83d5e9b708211306045407074134]
+
+Backport Changes:
+- curl 8.19.0 does not provide Curl_url_same_origin(), but the CVE-2026-6429
+ fix from https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
+ uses it in lib/http.c.
+- kept only the helper declaration and implementation of
+ lib/urlapi-int.h and lib/urlapi.c.
+- Excluded unrelated upstream test and HTTP/2 changes from that commit.
+
+(cherry picked from commit 32a513e180ce83d5e9b708211306045407074134)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/urlapi-int.h | 2 ++
+ lib/urlapi.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/lib/urlapi-int.h b/lib/urlapi-int.h
+index 29d4fe5f39..591062035b 100644
+--- a/lib/urlapi-int.h
++++ b/lib/urlapi-int.h
+@@ -40,4 +40,6 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
+ #define U_CURLU_URLDECODE (unsigned int)CURLU_URLDECODE
+ #define U_CURLU_PATH_AS_IS (unsigned int)CURLU_PATH_AS_IS
+
++bool Curl_url_same_origin(CURLU *base, CURLU *href);
++
+ #endif /* HEADER_CURL_URLAPI_INT_H */
+diff --git a/lib/urlapi.c b/lib/urlapi.c
+index a4b82f31bd..20c6585b55 100644
+--- a/lib/urlapi.c
++++ b/lib/urlapi.c
+@@ -1996,3 +1996,36 @@ nomem:
+ }
+ return CURLUE_OK;
+ }
++
++bool Curl_url_same_origin(CURLU *base, CURLU *href)
++{
++ const struct Curl_scheme *s = NULL;
++
++ /* base must be an absolute URL */
++ if(!base->scheme || !base->host)
++ return FALSE;
++ if(href->scheme && !curl_strequal(base->scheme, href->scheme))
++ return FALSE;
++ if(href->host) {
++ if(!curl_strequal(base->host, href->host))
++ return FALSE;
++ if(!curl_strequal(base->port, href->port)) {
++ /* This may still match if only one has an explicit port
++ * and it is the default for the scheme. */
++ if(base->port && href->port)
++ return FALSE;
++
++ s = Curl_get_scheme(base->scheme);
++ if(!s) /* Cannot match default port for unknown scheme */
++ return FALSE;
++
++ /* The port which is set must be the default one */
++ if((base->port && (base->portnum != s->defport)) ||
++ (href->port && (href->portnum != s->defport)))
++ return FALSE;
++ }
++ }
++ else if(href->port) /* no host in href, then there must be no port */
++ return FALSE;
++ return TRUE;
++}
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
new file mode 100644
index 0000000000..76711aafc0
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
@@ -0,0 +1,325 @@
+From 1d36681ca0e453faf199f44c483077d929899906 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 16 Apr 2026 14:26:20 +0200
+Subject: [PATCH] http: clear credentials better on redirect
+
+Verify with test 2506: netrc with redirect using proxy
+
+Updated test 998 which was wrong.
+
+Reported-by: Muhamad Arga Reksapati
+
+Closes #21345
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306]
+
+Backport Changes:
+- Aligned with curl 8.19.0 by using the existing
+ Curl_safefree() instead of the curlx_safefree() macro.
+- The curlx_safefree() macro was introduced in curl 8.20.0 by:
+ https://github.com/curl/curl/commit/0df6c01db398f5e25d00a062aae56f2a89d8ff55
+
+(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/http.c | 84 ++++++++++++--------------------------
+ tests/data/Makefile.am | 2 +-
+ tests/data/test2506 | 64 +++++++++++++++++++++++++++++
+ tests/data/test998 | 1 -
+ tests/libtest/Makefile.inc | 2 +-
+ tests/libtest/lib2506.c | 71 ++++++++++++++++++++++++++++++++
+ 6 files changed, 162 insertions(+), 62 deletions(-)
+ create mode 100644 tests/data/test2506
+ create mode 100644 tests/libtest/lib2506.c
+
+diff --git a/lib/http.c b/lib/http.c
+index b960d790a4..2596b4b3a2 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1201,75 +1201,41 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+ return CURLE_OUT_OF_MEMORY;
+ }
+ else {
+- uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
+- if(uc)
++ bool same_origin;
++ CURLcode result;
++ CURLU *u = curl_url();
++ if(!u)
++ return CURLE_OUT_OF_MEMORY;
++ uc = curl_url_set(u, CURLUPART_URL,
++ Curl_bufref_ptr(&data->state.url),
++ CURLU_URLENCODE | CURLU_ALLOW_SPACE);
++ if(!uc)
++ uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
++ if(uc) {
++ curl_url_cleanup(u);
+ return Curl_uc_to_curlcode(uc);
++ }
+
+- /* Clear auth if this redirects to a different port number or protocol,
+- unless permitted */
+- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
+- int port;
+- bool clear = FALSE;
+-
+- if(data->set.use_port && data->state.allow_port)
+- /* a custom port is used */
+- port = (int)data->set.use_port;
+- else {
+- curl_off_t value;
+- char *portnum;
+- const char *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
+- CURLU_DEFAULT_PORT);
+- if(uc) {
+- curlx_free(follow_url);
+- return Curl_uc_to_curlcode(uc);
+- }
+- p = portnum;
+- curlx_str_number(&p, &value, 0xffff);
+- port = (int)value;
+- curlx_free(portnum);
+- }
+- if(port != data->info.conn_remote_port) {
+- infof(data, "Clear auth, redirects to port from %u to %u",
+- data->info.conn_remote_port, port);
+- clear = TRUE;
+- }
+- else {
+- char *scheme;
+- const struct Curl_scheme *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
+- if(uc) {
+- curlx_free(follow_url);
+- return Curl_uc_to_curlcode(uc);
+- }
++ same_origin = Curl_url_same_origin(u, data->state.uh);
++ curl_url_cleanup(u);
+
+- p = Curl_get_scheme(scheme);
+- if(p && (p->protocol != data->info.conn_protocol)) {
+- infof(data, "Clear auth, redirects scheme from %s to %s",
+- data->info.conn_scheme, scheme);
+- clear = TRUE;
+- }
+- curlx_free(scheme);
+- }
+- if(clear) {
+- CURLcode result = Curl_reset_userpwd(data);
+- if(result) {
+- curlx_free(follow_url);
+- return result;
+- }
+- Curl_safefree(data->state.aptr.user);
+- Curl_safefree(data->state.aptr.passwd);
++ if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
++ !data->set.str[STRING_USERNAME]) {
++ result = Curl_reset_userpwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
+ }
++ Curl_safefree(data->state.aptr.user);
++ Curl_safefree(data->state.aptr.passwd);
+ }
+- }
+- DEBUGASSERT(follow_url);
+- {
+- CURLcode result = Curl_reset_proxypwd(data);
++ result = Curl_reset_proxypwd(data);
+ if(result) {
+ curlx_free(follow_url);
+ return result;
+ }
+ }
++ DEBUGASSERT(follow_url);
+
+ if(type == FOLLOW_FAKE) {
+ /* we are only figuring out the new URL if we would have followed locations
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 00a5221d1f..1b76b01a8c 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -265,7 +265,7 @@ test2309 \
+ \
+ test2400 test2401 test2402 test2403 test2404 test2405 test2406 test2407 \
+ \
+-test2500 test2501 test2502 test2503 test2504 \
++test2500 test2501 test2502 test2503 test2504 test2506 \
+ \
+ test2600 test2601 test2602 test2603 test2604 test2605 \
+ \
+diff --git a/tests/data/test2506 b/tests/data/test2506
+new file mode 100644
+index 0000000000..9c65002496
+--- /dev/null
++++ b/tests/data/test2506
+@@ -0,0 +1,64 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++<reply>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 3
++Location: http://numbertwo.example/%TESTNUMBER0002
++
++ok
++</data>
++<data2 crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 4
++
++yes
++</data2>
++</reply>
++
++<client>
++<server>
++http
++</server>
++<features>
++proxy
++</features>
++<tool>
++lib%TESTNUMBER
++</tool>
++<name>
++netrc with redirect using proxy
++</name>
++<file name="%LOGDIR/netrc2506">
++machine site.example login batman password robin
++</file>
++<command>
++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
++</command>
++</client>
++
++<verify>
++<protocol crlf="headers">
++GET http://site.example/ HTTP/1.1
++Host: site.example
++Authorization: Basic %b64[batman:robin]b64%
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://numbertwo.example/25060002 HTTP/1.1
++Host: numbertwo.example
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test998 b/tests/data/test998
+index 24d1d3dd4e..56dbc0c891 100644
+--- a/tests/data/test998
++++ b/tests/data/test998
+@@ -77,7 +77,6 @@ Proxy-Connection: Keep-Alive
+
+ GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
+ Host: somewhere.else.example
+-Authorization: Basic %b64[alberto:einstein]b64%
+ User-Agent: curl/%VERSION
+ Accept: */*
+ Proxy-Connection: Keep-Alive
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 2319bafe72..2f77c16975 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -113,7 +113,7 @@ TESTS_C = \
+ lib2023.c lib2032.c lib2082.c \
+ lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \
+ lib2402.c lib2404.c lib2405.c \
+- lib2502.c lib2504.c \
++ lib2502.c lib2504.c lib2506.c \
+ lib2700.c \
+ lib3010.c lib3025.c lib3026.c lib3027.c lib3033.c lib3034.c \
+ lib3100.c lib3101.c lib3102.c lib3103.c lib3104.c lib3105.c \
+diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c
+new file mode 100644
+index 0000000000..8b3b3429f9
+--- /dev/null
++++ b/tests/libtest/lib2506.c
+@@ -0,0 +1,71 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "first.h"
++
++#include "testtrace.h"
++
++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud)
++{
++ (void)ptr;
++ (void)ud;
++ return size * nmemb;
++}
++
++static CURLcode test_lib2506(const char *URL)
++{
++ CURL *curl;
++ CURLcode result = CURLE_OUT_OF_MEMORY;
++
++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
++ curl_mfprintf(stderr, "curl_global_init() failed\n");
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506);
++ test_setopt(curl, CURLOPT_PROXY, URL);
++ test_setopt(curl, CURLOPT_URL, libtest_arg2);
++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
++ test_setopt(curl, CURLOPT_VERBOSE, 1L);
++
++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
++ credentials come from netrc */
++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
++
++ result = curl_easy_perform(curl);
++
++test_cleanup:
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++
++ return result;
++}
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index b1ee0f8b9b..683163bfa6 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -19,6 +19,8 @@ SRC_URI = " \
file://mbedtls.patch \
file://CVE-2026-5545.patch \
file://CVE-2026-6253.patch \
+ file://CVE-2026-6429-dependent.patch \
+ file://CVE-2026-6429.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 2/5] curl: fix CVE-2026-5545
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:30 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720113041.2479444-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for the Negotiate-authenticated connection
reuse issue described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd
[2] https://curl.se/docs/CVE-2026-5545.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-5545
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patches on top of the latest
wrynose branch.
.../curl/curl/CVE-2026-5545.patch | 43 +++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 44 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-5545.patch b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
new file mode 100644
index 0000000000..bb3b1407d4
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
@@ -0,0 +1,43 @@
+From 33e43985b8f3b9e66691d06e70be0395849856cd Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 2 Apr 2026 11:33:39 +0200
+Subject: [PATCH] url: improve connection reuse on negotiate
+
+Check state of negotiate to allow proper connection reuse.
+
+Closes #21203
+
+CVE: CVE-2026-5545
+Upstream-Status: Backport [https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd]
+
+(cherry picked from commit 33e43985b8f3b9e66691d06e70be0395849856cd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index b9e308a..7c24f1a 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1110,11 +1110,17 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+ if(m->want_ntlm_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+ Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
+-
+ /* we prefer a credential match, but this is at least a connection
+- that can be reused and "upgraded" to NTLM */
+- if(conn->http_ntlm_state == NTLMSTATE_NONE)
++ that can be reused and "upgraded" to NTLM if it does
++ not have any auth ongoing. */
++#ifdef USE_SPNEGO
++ if((conn->http_ntlm_state == NTLMSTATE_NONE)
++ && (conn->http_negotiate_state == GSS_AUTHNONE)) {
++#else
++ if(conn->http_ntlm_state == NTLMSTATE_NONE) {
++#endif
+ m->found = conn;
++ }
+ return FALSE;
+ }
+ }
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 1cda69401b..558a2d311e 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -17,6 +17,7 @@ SRC_URI = " \
file://CVE-2026-6276.patch \
file://CVE-2026-5773.patch \
file://mbedtls.patch \
+ file://CVE-2026-5545.patch \
"
SRC_URI:append:class-nativesdk = " \
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH v2 1/5] curl: ignore CVE-2026-4873
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:30 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720105647.2451180-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
- CVE-2026-4873 affects curl before 8.20.0 when a connection negotiated with
clear-text IMAP, POP3, or SMTP can later be reused for a TLS-required
transfer.
- In wrynose, these protocols are optional PACKAGECONFIG entries and are not
enabled by default in curl_8.19.0.bb, so record this CVE as configuration-not-applicable
for the default recipe configuration.
Reference:
- https://curl.se/docs/CVE-2026-4873.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4873
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
- Changes from v1 to v2: Refresh the patches on top of the latest
wrynose branch.
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 3326f478b5..1cda69401b 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -28,6 +28,7 @@ SRC_URI[sha256sum] = "4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d33
# Curl has used many names over the years...
CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
+CVE_STATUS[CVE-2026-4873] = "${@bb.utils.contains_any('PACKAGECONFIG', 'imap pop3 smtp', 'unpatched', 'not-applicable-config: clear-text imap/pop3/smtp support is not enabled in PACKAGECONFIG', d)}"
inherit autotools pkgconfig binconfig multilib_header ptest
--
2.35.6
^ permalink raw reply related
* Re: [OE-core][wrynose][PATCH 1/2] gnutls: Fix CVE-2026-3832
From: Yoann Congal @ 2026-07-20 11:19 UTC (permalink / raw)
To: deeratho, openembedded-core
In-Reply-To: <20260720110548.2458865-1-deeratho@cisco.com>
On Mon Jul 20, 2026 at 1:05 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream fix [1] and test coverage [2], as
> referenced in [3], to address multi-record OCSP response handling where
> GnuTLS could check revocation status from the wrong OCSP entry.
>
> [1] https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2
> [2] https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e
> [3] https://security-tracker.debian.org/tracker/CVE-2026-3832
>
> Reference:
> https://nvd.nist.gov/vuln/detail/CVE-2026-3832
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Hello,
All that series should be tagged v2 with a changelog where appropriate:
https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#taking-patch-review-into-account
Can you resend it with the v2 tag? You can use -v2 if you use git-send-email.
Adding these tags/changelog helps me a lot when tracking patch status.
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core][wrynose][PATCH 1/5] curl: ignore CVE-2026-4873
From: Yoann Congal @ 2026-07-20 11:17 UTC (permalink / raw)
To: deeratho, openembedded-core
In-Reply-To: <20260720105647.2451180-1-deeratho@cisco.com>
On Mon Jul 20, 2026 at 12:56 PM CEST, Deepak Rathore via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> - CVE-2026-4873 affects curl before 8.20.0 when a connection negotiated with
> clear-text IMAP, POP3, or SMTP can later be reused for a TLS-required
> transfer.
> - In wrynose, these protocols are optional PACKAGECONFIG entries and are not
> enabled by default in curl_8.19.0.bb, so record this CVE as configuration-not-applicable
> for the default recipe configuration.
>
> Reference:
> - https://curl.se/docs/CVE-2026-4873.html
> - https://nvd.nist.gov/vuln/detail/CVE-2026-4873
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Hello,
All that series should be tagged v2 with a changelog where appropriate:
https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#taking-patch-review-into-account
Can you resend it with the v2 tag? You can use -v2 if you use git-send-email.
Adding these tags/changelog helps me a lot when tracking patch status.
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core][wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:11 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org, yoann.congal@smile.fr
In-Reply-To: <DK0X83RP88XU.1TF6MFXVOZMYZ@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 3202 bytes --]
Hi Yoann Congal,
I am working with Sudhir Dumbhare on these fixes. As Sudhir is currently unavailable due to a personal matter, I have taken over the follow-up and rebased the gnutls patches on top of the latest changes recently merged into the wrynose branch, as requested.
The updated patches have been submitted to the upstream mailing list:
1.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 1/2] gnutls: Fix CVE-2026-3832<https://lists.openembedded.org/g/openembedded-core/topic/120356870>
2.
openembedded-core@lists.openembedded.org | [wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009<https://lists.openembedded.org/g/openembedded-core/topic/120356873>
Thank you for pointing out the issue and reviewing the updates.
Best regards,
Deepak Rathore
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Friday, July 17, 2026 8:07 PM
To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) <sudumbha@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009
On Fri Jul 10, 2026 at 11:54 AM CEST, Sudhir Dumbhare via lists.openembedded.org wrote:
> From: Sudhir Dumbhare <sudumbha@cisco.com>
>
> This patch applies the upstream fix [1] and [2], as referenced in [3],
> to address a DTLS packet reordering flaw where duplicate sequence numbers
> could lead to unstable ordering or undefined behavior.
>
> [1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
> [2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
> [3] https://security-tracker.debian.org/tracker/CVE-2026-42009
>
> Reference:
> https://nvd.nist.gov/vuln/detail/CVE-2026-42009
>
> Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Hello,
I guess a recent gnutls patch broke this series:
ERROR: gnutls-3.8.12-r0 do_patch: Applying patch '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch' on target directory '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/gnutls/3.8.12/sources/gnutls-3.8.12'
CmdError('quilt --quiltrc .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/gnutls/3.8.12/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-42009_p1.patch
patching file lib/buffers.c
Hunk #1 FAILED at 968.
1 out of 1 hunk FAILED -- rejects in file lib/buffers.c
Patch CVE-2026-42009_p1.patch does not apply (enforce with -f)
stderr: ')
ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/gnutls/3.8.12/temp/log.do_patch.2529206
ERROR: Task (.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/gnutls/gnutls_3.8.12.bb:do_patch) failed with exit code '1'
Can you rebase on the recently merged wrynose and resend?
Thanks!
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 6937 bytes --]
^ permalink raw reply
* [OE-core][wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 11:05 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720110548.2458865-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies upstream fixes [1] and [2], as referenced in [3],
to address a DTLS packet reordering flaw where duplicate sequence
numbers could lead to unstable ordering or undefined behavior.
Rebase CVE-2026-42009_p1.patch on top of the Wrynose
CVE-2026-33846 backport stack, which already includes the recv_buf
helper from upstream commit 9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0.
[1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
[2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
[3] https://security-tracker.debian.org/tracker/CVE-2026-42009
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-42009
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../gnutls/gnutls/CVE-2026-42009_p1.patch | 62 +++++++++++++++++++
.../gnutls/gnutls/CVE-2026-42009_p2.patch | 48 ++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 112 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
new file mode 100644
index 0000000000..f1ee618b48
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
@@ -0,0 +1,62 @@
+From d1191b910e63149a10647a089995d3cd85e16400 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Tue, 21 Apr 2026 16:52:48 +0200
+Subject: [PATCH] lib/buffers: ensure packets have differing sequence
+ numbers
+
+There should normally be no packets with same sequence number and
+differing handshake type, unless an adversary crafts them.
+Discarding them allows to get rid of packets
+with duplicate sequence ID in the buffer,
+relieving us from the question of how to sort them later.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d]
+
+Backport Changes:
+- Rebased on top of the Wrynose CVE-2026-33846 backport stack, which
+ already includes the recv_buf helper and sequence-number matching
+ prerequisite patches.
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit f01e21441e29052a6f0963840794c41d3b3ee66d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index 62f140ed3..e7f08b5625 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -971,8 +971,20 @@ static int merge_handshake_packet(gnutls_session_t session,
+ session->internals.handshake_recv_buffer;
+
+ for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) {
+- if (recv_buf[i].htype == hsk->htype &&
+- recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].htype != hsk->htype) {
++ _gnutls_audit_log(
++ session,
++ "Discarded unexpected handshake packet "
++ "with duplicate sequence %d, but "
++ "mismatched type %s (previously %s)\n",
++ hsk->sequence,
++ _gnutls_handshake2str(hsk->htype),
++ _gnutls_handshake2str(
++ recv_buf[i].htype));
++ _gnutls_handshake_buffer_clear(hsk);
++ return 0;
++ }
+ exists = 1;
+ pos = i;
+ break;
+--
+2.51.0
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
new file mode 100644
index 0000000000..6524cb47b4
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
@@ -0,0 +1,48 @@
+From 5374a6d584b8598511f7880b4e64ee52ee1f0cc5 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <joshua@joshua.hu>
+Date: Tue, 21 Apr 2026 18:11:39 +0200
+Subject: [PATCH] buffers: fix handshake_compare when sequence numbers
+ match
+
+The comparator function used for ordering DTLS packets
+by sequence numbers did not follow qsort comparator contracts
+in case of packets with duplicate sequence numbers,
+which could lead to unstable ordering or undefined behaviour.
+Returning 0 in such cases makes the sorting stable.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f]
+
+Signed-off-by: Joshua Rogers <joshua@joshua.hu>
+(cherry picked from commit f341441fad91142897d83b44a175ffc8f925b76f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index e7f08b5625..1ac27e4e96 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2)
+ {
+ const handshake_buffer_st *e1 = _e1;
+ const handshake_buffer_st *e2 = _e2;
+-
+- if (e1->sequence <= e2->sequence)
+- return 1;
+- else
+- return -1;
++ return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence);
+ }
+
+ #define SSL2_HEADERS 1
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index 03eee5c50e..3085a62310 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -34,6 +34,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
file://CVE-2026-3832_p1.patch \
file://CVE-2026-3832_p2.patch \
+ file://CVE-2026-42009_p1.patch \
+ file://CVE-2026-42009_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
--
2.35.6
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox