Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package curl for openSUSE:Factory checked in at 2026-09-07 11:26:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/curl (Old) and /work/SRC/openSUSE:Factory/.curl.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "curl" Mon Sep 7 11:26:24 2026 rev:227 rq:1375592 version:8.22.0 Changes: -------- --- /work/SRC/openSUSE:Factory/curl/curl.changes 2026-07-09 22:17:57.967243039 +0200 +++ /work/SRC/openSUSE:Factory/.curl.new.1265/curl.changes 2026-09-07 11:26:26.410903580 +0200 @@ -1,0 +2,56 @@ +Thu Sep 3 08:00:09 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 8.22.0: + * Security fixes: + - CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476) + - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477) + - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478) + - CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479) + - CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480) + - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482) + - CVE-2026-82209: curl: domain-scoped PSL domain cookie (bsc#1278173) + * Changes: + - gssapi: add support for Apple GSS Framework + - hardening: add API guards + - RFC 9421 HTTP Message Signatures support + - spnego: block NTLM fallback in SPNEGO negotiation + - TLS: drop support for TLS-SRP + - vquic: add option to use Apple fast UDP + * Bugfixes: + - altsvc: continue after unknown parameters + - asyn-thrdd: retry link-local ipv6 if missing scope id + - autotools: minor fixes and improvements + - cd2nroff: fix backslashes for 4-space indent lines + - cd2nroff: stricter checks for asterisks for italics + - cfilters: fix event-based connection shutdown + - conncache: apply multi limits to transfers using a shared pool + - connect: only set connect timer on first socket + - connection reuse: check SSL configs when doing a scheme upgrade + - cookie: cookies set for an exact PSL domain is host-only + - cookie: improve TAB handling + - cookie: refuse to load cookies set against a PSL domain + - FTP: fix TLS session reuse on the data connection + - hostip: only cache negative resolves for authoritative answers + - http digest: tie peer/credentials on input + - http2: make server push transfers inherit share from parent + - ldap: reject control characters in URL-decoded filter values + - ldap: support empty username and password + - md5: replace magic numbers with `MD5_DIGEST_LEN` + - mime.c: avoid integer overflow in base64 size calculation + - mprintf: acknowledge %F + - ngtcp2+openssL: fix early data + - ngtcp2: avoid NULL deref in cf_ngtcp2_send + - openssl+sectrust: fix session reuse + - openssl+sectrust: move session verified set into result check + - openssl: avoid conn reuse if provider is used + - openssl: avoid strlen() on the data from OpenSSL + - openssl: prefer modern API flavors for `EVP_MD_CTX` new/free + - openssl: replace stray legacy API variant with `EVP_DigestInit_ex()` + - url: fix handling of empty user in NTLM matching + - url: fix negotiate/ntlm connection reuse + - urlapi: allow URLs to not have userauth (hostname) + - urlapi: clear password buffer on error path + - vtls: move 'native_ca_store' ssl_config_data => ssl_primary_config + * Rebase libcurl-ocloexec.patch + +------------------------------------------------------------------- Old: ---- curl-8.21.0.tar.xz curl-8.21.0.tar.xz.asc New: ---- curl-8.22.0.tar.xz curl-8.22.0.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ curl.spec ++++++ --- /var/tmp/diff_new_pack.V23Bd6/_old 2026-09-07 11:26:27.317935311 +0200 +++ /var/tmp/diff_new_pack.V23Bd6/_new 2026-09-07 11:26:27.319935381 +0200 @@ -36,7 +36,7 @@ %endif Name: curl%{?psuffix} -Version: 8.21.0 +Version: 8.22.0 Release: 0 Summary: A Tool for Transferring Data from URLs License: curl ++++++ curl-8.21.0.tar.xz -> curl-8.22.0.tar.xz ++++++ ++++ 119647 lines of diff (skipped) ++++++ libcurl-ocloexec.patch ++++++ --- /var/tmp/diff_new_pack.V23Bd6/_old 2026-09-07 11:26:28.812987613 +0200 +++ /var/tmp/diff_new_pack.V23Bd6/_new 2026-09-07 11:26:28.817987788 +0200 @@ -58,10 +58,10 @@ dnl This defines _ALL_SOURCE for AIX CURL_CHECK_AIX_ALL_SOURCE -Index: curl-8.20.0/lib/hostip.c +Index: curl-8.20.0/lib/vdns/hostip.c =================================================================== ---- curl-8.20.0.orig/lib/hostip.c -+++ curl-8.20.0/lib/hostip.c +--- curl-8.20.0.orig/lib/vdns/hostip.c ++++ curl-8.20.0/lib/vdns/hostip.c @@ -43,6 +43,7 @@ #include <setjmp.h> /* for sigjmp_buf, sigsetjmp() */ #include <signal.h>
