Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package curl for openSUSE:Factory checked in at 2026-10-16 20:06:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/curl (Old) and /work/SRC/openSUSE:Factory/.curl.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "curl" Fri Oct 16 20:06:51 2026 rev:228 rq:1384992 version:8.23.0 Changes: -------- --- /work/SRC/openSUSE:Factory/curl/curl.changes 2026-09-07 11:26:26.410903580 +0200 +++ /work/SRC/openSUSE:Factory/.curl.new.3698736/curl.changes 2026-10-16 20:07:02.894521154 +0200 @@ -1,0 +2,87 @@ +Thu Oct 15 08:59:18 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 8.23.0: + * Security fixes: + - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016) + - CVE-2026-92389: TFTP direction confusion (bsc#1285015) + - CVE-2026-87866: wolfSSL public-key pinning bypass (bsc#1285019) + - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023) + - CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024) + - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021) + - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022) + - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030) + - CVE-2026-87865: knownhost callback mismatches key as missing (bsc#1285020) + - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017) + - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018) + - CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028) + - CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027) + - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026) + - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012) + - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010) + - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013) + - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014) + - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008) + - CVE-2026-107928: info leak uploading over WebSockets with GnuTLS (bsc#1285009) + - CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011) + - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031) + - CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029) + * Changes: + - lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK + - SMB: drop support + - tool_cb_wrt: inject the no-clobber number before the extension + - tool_cb_wrt: try up to .9999 when no-clobbering + * Bugfixes: + - conncache: never discard a connection still in use + - curl-openssl.m4: sync LibreSSL detection method with rest of forks + - cw-out: avoid O(n^2) work while buffering paused output + - cw-pause: fix O(N^2) list traversal in cw_pause_flush + - DEPRECATE: Common Name support in TLS certificates for OpenSSL + - ftp: require TLS on the data connection for implicit FTPS + - ftp: tighten use_ssl check for conn reuse + - global_init: tidy up, simplify, fix issues + - GnuTLS: remove our own OCSP signature verification + - gtls: no early return on verify fail + - headers: avoid O(n^2) rescans in curl_easy_nextheader() + - hsts: cap max-age to two years + - HTTP-CONNECT: do not react to 401 responses + - http2: don't send a CURLE_SEND_ERROR after a valid http2 response + - http2: fix reset after 1xx response + - http2: initialize URL handle for server pushes + - http2: limit trailers and headers count + - http: abide to close-rules when transfer-encoding off + - http: ignore Proxy-Authenticate unless the response comes from a proxy + - http: only enable Negotiate/NTLM to allowed origins + - http: reject empty header names + - http: reject resumed uploads + - http_aws_sigv4: fix the s3express service name + - if2ip: check interface name case sensitive + - imap: compare selected mailbox names case-sensitively + - libssh2: match hashed known_hosts entries by host + - libssh2: skip repeat checkp() for already-absent hashed key types + - libssh: work with empty priv_key + - openssl/gtls: reject CRLfile with native CA store, matching rustls + - openssl: fix OpenSSL v4.1 no-deprecated build + - openssl: support X509 store caching when CApath is configured + - openssl: use non-deprecated API for MD5/MD4 + - ossl_verifyhost: remove assumption of null-termination of ASN1_STRING. + - peer: compare zoneid case sensitive + - peer: parsing a zoneid as number fix + - peer: preserve ipv6 props from "connect-to" + - pingpong: schedule server response timeouts for the socket API + - rtsp: do not send a learned session id to another origin + - rustls: break recv loop on empty plain text + - rustls: consume CURLOPT_SSLCERT_BLOB / CURLOPT_SSLKEY_BLOB + - schannel: retain close_notify records across send retries + - socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH + - socks: track SOCKS5 authentication per socket, not per connection + - sws: fix connection-monitor for connections closed before a request + - telnet: make it work through proxy tunnels + - tool: (re)set SSL verification in --libcurl output + - tool_getparam: restore --socks5-gssapi-service + - url: match connections without force reuse and candidates + - url: ntlm/negotiate, prohibit connection reuse on follows + - vtls_scache: remember lock state locally + * Remove now unrecognized option: --disable-tls-srp + * Rebase libcurl-ocloexec.patch + +------------------------------------------------------------------- @@ -12 +99 @@ - - CVE-2026-82209: curl: domain-scoped PSL domain cookie (bsc#1278173) + - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173) Old: ---- curl-8.22.0.tar.xz curl-8.22.0.tar.xz.asc New: ---- curl-8.23.0.tar.xz curl-8.23.0.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ curl.spec ++++++ --- /var/tmp/diff_new_pack.GR32FF/_old 2026-10-16 20:07:04.095571340 +0200 +++ /var/tmp/diff_new_pack.GR32FF/_new 2026-10-16 20:07:04.098571466 +0200 @@ -36,7 +36,7 @@ %endif Name: curl%{?psuffix} -Version: 8.22.0 +Version: 8.23.0 Release: 0 Summary: A Tool for Transferring Data from URLs License: curl @@ -196,7 +196,6 @@ --disable-smtp \ --disable-telnet \ --disable-tftp \ - --disable-tls-srp \ --disable-websockets \ --without-brotli \ --without-libssh \ ++++++ curl-8.22.0.tar.xz -> curl-8.23.0.tar.xz ++++++ ++++ 76478 lines of diff (skipped) ++++++ libcurl-ocloexec.patch ++++++ --- /var/tmp/diff_new_pack.GR32FF/_old 2026-10-16 20:07:05.871645554 +0200 +++ /var/tmp/diff_new_pack.GR32FF/_new 2026-10-16 20:07:05.874645679 +0200 @@ -7,11 +7,11 @@ compile time is not enough. -Index: curl-8.20.0/lib/file.c +Index: curl-8.23.0/lib/file.c =================================================================== ---- curl-8.20.0.orig/lib/file.c -+++ curl-8.20.0/lib/file.c -@@ -230,7 +230,7 @@ static CURLcode file_connect(struct Curl +--- curl-8.23.0.orig/lib/file.c ++++ curl-8.23.0/lib/file.c +@@ -262,7 +262,7 @@ static CURLcode file_connect(struct Curl } } #else @@ -20,22 +20,19 @@ file->path = real_path; #endif #endif -@@ -298,9 +298,9 @@ static CURLcode file_upload(struct Curl_ - data->set.new_file_perms & (_S_IREAD | _S_IWRITE)); - #elif (defined(ANDROID) || defined(__ANDROID__)) && \ - (defined(__i386__) || defined(__arm__)) -- fd = curlx_open(file->path, mode, (mode_t)data->set.new_file_perms); -+ fd = curlx_open(file->path, mode|O_CLOEXEC, (mode_t)data->set.new_file_perms); +@@ -331,7 +331,7 @@ static CURLcode file_upload(struct Curl_ + else + mode |= O_TRUNC; + +- fd = curlx_open(file->path, mode, ++ fd = curlx_open(file->path, mode|O_CLOEXEC, + #ifdef _WIN32 + data->set.new_file_perms & (_S_IREAD | _S_IWRITE) #else -- fd = curlx_open(file->path, mode, data->set.new_file_perms); -+ fd = curlx_open(file->path, mode|O_CLOEXEC, data->set.new_file_perms); - #endif - if(fd < 0) { - failf(data, "cannot open %s for writing", file->path); -Index: curl-8.20.0/lib/if2ip.c +Index: curl-8.23.0/lib/if2ip.c =================================================================== ---- curl-8.20.0.orig/lib/if2ip.c -+++ curl-8.20.0/lib/if2ip.c +--- curl-8.23.0.orig/lib/if2ip.c ++++ curl-8.23.0/lib/if2ip.c @@ -202,7 +202,7 @@ if2ip_result_t Curl_if2ip(int af, if(len >= sizeof(req.ifr_name)) return IF2IP_NOT_FOUND; @@ -45,11 +42,11 @@ if(dummy == CURL_SOCKET_BAD) return IF2IP_NOT_FOUND; -Index: curl-8.20.0/configure.ac +Index: curl-8.23.0/configure.ac =================================================================== ---- curl-8.20.0.orig/configure.ac -+++ curl-8.20.0/configure.ac -@@ -509,6 +509,8 @@ AC_DEFINE_UNQUOTED(CURL_OS, "${host}", [ +--- curl-8.23.0.orig/configure.ac ++++ curl-8.23.0/configure.ac +@@ -548,6 +548,8 @@ AC_DEFINE_UNQUOTED(CURL_OS, "${host}", [ dnl Silence warning: ar: 'u' modifier ignored since 'D' is the default AC_SUBST(AR_FLAGS, [cr]) @@ -58,10 +55,10 @@ dnl This defines _ALL_SOURCE for AIX CURL_CHECK_AIX_ALL_SOURCE -Index: curl-8.20.0/lib/vdns/hostip.c +Index: curl-8.23.0/lib/vdns/hostip.c =================================================================== ---- curl-8.20.0.orig/lib/vdns/hostip.c -+++ curl-8.20.0/lib/vdns/hostip.c +--- curl-8.23.0.orig/lib/vdns/hostip.c ++++ curl-8.23.0/lib/vdns/hostip.c @@ -43,6 +43,7 @@ #include <setjmp.h> /* for sigjmp_buf, sigsetjmp() */ #include <signal.h> @@ -70,7 +67,7 @@ #include "urldata.h" #include "curl_addrinfo.h" #include "curl_trc.h" -@@ -293,7 +294,7 @@ static struct Curl_addrinfo *get_localho +@@ -289,7 +290,7 @@ static struct Curl_addrinfo *get_localho CURLcode Curl_probeipv6(struct Curl_multi *multi) { /* probe to see if we have a working IPv6 stack */ @@ -79,11 +76,11 @@ multi->ipv6_works = FALSE; if(s == CURL_SOCKET_BAD) { if(SOCKERRNO == SOCKENOMEM) -Index: curl-8.20.0/lib/cf-socket.c +Index: curl-8.23.0/lib/cf-socket.c =================================================================== ---- curl-8.20.0.orig/lib/cf-socket.c -+++ curl-8.20.0/lib/cf-socket.c -@@ -338,7 +338,8 @@ static CURLcode socket_open(struct Curl_ +--- curl-8.23.0.orig/lib/cf-socket.c ++++ curl-8.23.0/lib/cf-socket.c +@@ -462,7 +462,8 @@ static CURLcode socket_open(struct Curl_ return CURLE_COULDNT_CONNECT; } #endif
