On Wed Aug 5, 2026 at 10:31 AM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > This patch applies the upstream curl security fix backport for > CVE-2026-8458. The upstream fix commit is referenced in [1], > and the public curl advisory is referenced in [2]. The backported > commit link is also recorded in the embedded patch header. > > [1] > https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d > [2] https://curl.se/docs/CVE-2026-8458.html > > Signed-off-by: Deepak Rathore <[email protected]> > --- > .../curl/curl/CVE-2026-8458.patch | 202 ++++++++++++++++++ > meta/recipes-support/curl/curl_8.19.0.bb | 1 + > 2 files changed, 203 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8458.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2026-8458.patch > b/meta/recipes-support/curl/curl/CVE-2026-8458.patch > new file mode 100644 > index 0000000000..6340f5305f > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2026-8458.patch > @@ -0,0 +1,202 @@ > +From 01ce94b67888e6efa4196247302e59cf68e77b2d Mon Sep 17 00:00:00 2001 > +From: Stefan Eissing <[email protected]> > +Date: Mon, 13 Jul 2026 23:13:37 -0700 > +Subject: [PATCH] creds: add sasl service name > + > +The SASL service name, used in authentication, is part of curl's credentials > +when authenticating to a server/proxy. Make it part of `struct Curl_creds`. > + > +Change code to use `creds` to obtain a service name. By tying creds used > +to the connection, connection reuse is also only allowed when the service > +name matches. > + > +Closes #21585 > + > +CVE: CVE-2026-8458 > +Upstream-Status: Backport > [https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d] > + > +Backport Changes: > +- Wrynose curl 8.19.0 does not have upstream struct Curl_creds. > + This backport stores the optional SASL service name on the existing > + connectdata/proxy_info structures and compares it during connection > + reuse for the same security behavior. > +- Omitted the upstream unit1304 Curl_creds_create() signature > + adjustment because Wrynose 8.19.0 does not contain Curl_creds. > + > +(cherry picked from commit 5e99b73cf441d9c369768b9cd48b5389b9a2503d) > +Signed-off-by: Deepak Rathore <[email protected]> > +--- > + lib/url.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++----- > + lib/urldata.h | 2 ++ > + 2 files changed, 58 insertions(+), 5 deletions(-)
This patch looks nothing like the upstream patch and is basically new code. I'm not confortable merging this. I'll hold this one for now and continue with the rest of the series. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244551): https://lists.openembedded.org/g/openembedded-core/message/244551 Mute This Topic: https://lists.openembedded.org/mt/120607432/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
