From: Siddharth Doshi <[email protected]> Picking patch as per [1], and same patch is mentioned in [2]
[1] https://curl.se/docs/CVE-2026-80255.html [2] https://security-tracker.debian.org/tracker/CVE-2026-80255 Signed-off-by: Siddharth Doshi <[email protected]> --- .../curl/curl/CVE-2026-80255.patch | 106 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 107 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch new file mode 100644 index 0000000000..964193bcbd --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch @@ -0,0 +1,106 @@ +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Thu, 27 Aug 2026 08:33:30 +0200 +Subject: [PATCH] cookie: improve TAB handling + +For entries with a leading tab. Verified in test 2885. + +Reported-by: Stanislav Fort +Closes #22699 + +Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a] +CVE: CVE-2026-80255 +Signed-off-by: Siddharth Doshi <[email protected]> +--- + lib/cookie.c | 2 +- + tests/data/Makefile.am | 1 + + tests/data/test2885 | 52 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 54 insertions(+), 1 deletion(-) + create mode 100644 tests/data/test2885 + +diff --git a/lib/cookie.c b/lib/cookie.c +index 4d53cc4..30ec890 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data, + struct Curl_str val; + + /* we have a <name>=<value> pair or a stand-alone word here */ +- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) { ++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) { + bool sep = FALSE; + curlx_str_trimblanks(&name); + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index f9d20a9..8bf374f 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -272,6 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \ + test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \ + test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \ + test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \ ++test2885 \ + \ + test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \ + test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \ +diff --git a/tests/data/test2885 b/tests/data/test2885 +new file mode 100644 +index 0000000..456224f +--- /dev/null ++++ b/tests/data/test2885 +@@ -0,0 +1,52 @@ ++<?xml version="1.0" encoding="US-ASCII"?> ++<testcase> ++<info> ++<keywords> ++HTTP ++cookies ++</keywords> ++</info> ++ ++<reply> ++<data crlf="headers"> ++HTTP/1.1 200 OK ++Content-Length: 0 ++Set-Cookie: thisis=SECRET;%TABSecure ++Set-Cookie: also=notab; Secure ++ ++</data> ++</reply> ++ ++<client> ++<features> ++cookies ++</features> ++<server> ++https ++</server> ++<name> ++Cookies with TAB before 'secure' ++</name> ++<command> ++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure ++</command> ++</client> ++ ++<verify> ++<protocol crlf="headers"> ++GET /%TESTNUMBER HTTP/1.1 ++Host: cookie.example:%HTTPSPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++</protocol> ++<file name="%LOGDIR/cookies.txt" mode="text"> ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET ++</file> ++</verify> ++</testcase> +-- +2.34.1 + diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index a55cea4e31..a5606c5eb1 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -30,6 +30,7 @@ SRC_URI = " \ file://CVE-2026-13608.patch \ file://CVE-2026-18924.patch \ file://CVE-2026-80229.patch \ + file://CVE-2026-80255.patch \ " SRC_URI:append:class-nativesdk = " \ -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245497): https://lists.openembedded.org/g/openembedded-core/message/245497 Mute This Topic: https://lists.openembedded.org/mt/121170242/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
