Thanks, Yoann, for the update!! Regards, Deepak ________________________________ From: Yoann Congal <[email protected]> Sent: Thursday, August 27, 2026 12:23 PM To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][wrynose][PATCH 1/8] curl: fix CVE-2026-8286
On Wed Aug 26, 2026 at 10:47 AM CEST, Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > Hi Yoann, > Thank you for your review and feedback. > These patches were originally prepared on top of the curl CVE fix > series that is currently under review and already present in the > wrynose/wrynose-nut review branches: > > * > curl: fix CVE-2026-4873 - openembedded-core-contrib - OpenEmbedded Core user > contribution > trees<https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/wrynose-nut&id=7e44b94a57a1b7d9ec043554fb7f1f4c3fbfbbaf> > * > [wrynose,v4] curl: fix CVE-2026-4873 - > Patchwork<https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/> > > Because the remaining curl CVE patches in this series were developed > on top of that patch, rebasing everything on the current wrynose > review branch would require additional rebasing work once > CVE-2026-4873 is merged. If you apply current curl patches on top of > this CVE-2026-4873 fix, then there will be no build failure. Could you > please advise on the preferred approach in this situation? > I appreciate your guidance. > Regards, > Deepak Rathore Ok, there was a bad interaction with other curl patches in my series but those are gone now. So, this series does apply cleanly and I've added it to my review branch. Thanks! > ________________________________ > From: Yoann Congal <[email protected]> > Sent: Tuesday, August 25, 2026 8:34 PM > To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) > <[email protected]>; [email protected] > <[email protected]> > Subject: Re: [OE-core][wrynose][PATCH 1/8] curl: fix CVE-2026-8286 > > On Wed Aug 5, 2026 at 10:30 AM CEST, Deepak Rathore via > lists.openembedded.org wrote: >> From: Deepak Rathore <[email protected]> >> >> This patch applies the upstream curl security fix backport for >> CVE-2026-8286. The upstream fix commit is referenced in [1], >> and the public curl advisory is referenced in [2]. The backported >> commit link is also recorded in the embedded patch header. >> >> [1] >> https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 >> [2] https://curl.se/docs/CVE-2026-8286.html >> >> Signed-off-by: Deepak Rathore <[email protected]> >> --- >> .../curl/curl/CVE-2026-8286.patch | 81 +++++++++++++++++++ >> meta/recipes-support/curl/curl_8.19.0.bb | 1 + >> 2 files changed, 82 insertions(+) >> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch > > Hello, > > This series does not apply on top of the review branch anymore: > https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review > |ERROR: curl-8.19.0-r0 do_patch: Applying patch > '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl/CVE-2026-8927.patch' > on target directory > '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/sources/curl-8.19.0' > |CmdError('quilt --quiltrc > .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/recipe-sysroot-native/etc/quiltrc > push', 0, 'stdout: Applying patch CVE-2026-8927.patch > |patching file lib/url.c > |patching file lib/urldata.h > |patching file tests/data/Makefile.am > |Hunk #1 FAILED at 218. > |1 out of 1 hunk FAILED -- rejects in file tests/data/Makefile.am > |patching file tests/data/test1647 > |patching file tests/libtest/Makefile.inc > |Hunk #1 FAILED at 100. > |1 out of 1 hunk FAILED -- rejects in file tests/libtest/Makefile.inc > |patching file tests/libtest/lib1647.c > |Patch CVE-2026-8927.patch does not apply (enforce with -f) > | > |stderr: ') > |ERROR: Logfile of failure stored in: > .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/curl/8.19.0/temp/log.do_patch.468848 > |ERROR: Task > (.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/curl/curl_8.19.0.bb:do_patch) > failed with exit code '1' > > Can you please rebase and send a v2? > > Please note that there are other pending curl CVE patches, I'd recommand > reviewing/testing patches to identify conflict at the earliest. > > Thanks! > -- > Yoann Congal > Smile ECS -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244473): https://lists.openembedded.org/g/openembedded-core/message/244473 Mute This Topic: https://lists.openembedded.org/mt/120607423/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
