On Wed Sep 9, 2026 at 10:33 PM CEST, Siddharth Doshi via lists.openembedded.org wrote: > From: Siddharth Doshi <[email protected]> > > Picking patch as per [1], and same patch is mentioned in [2] > > [1] https://curl.se/docs/CVE-2026-80255.html > [2] https://security-tracker.debian.org/tracker/CVE-2026-80255 > > Signed-off-by: Siddharth Doshi <[email protected]> > --- > .../curl/curl/CVE-2026-80255.patch | 106 ++++++++++++++++++ > meta/recipes-support/curl/curl_8.19.0.bb | 1 + > 2 files changed, 107 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch > b/meta/recipes-support/curl/curl/CVE-2026-80255.patch > new file mode 100644 > index 0000000000..964193bcbd > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch > @@ -0,0 +1,106 @@ > +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Thu, 27 Aug 2026 08:33:30 +0200 > +Subject: [PATCH] cookie: improve TAB handling > + > +For entries with a leading tab. Verified in test 2885. > + > +Reported-by: Stanislav Fort > +Closes #22699 > + > +Upstream-Status: Backport > [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a] > +CVE: CVE-2026-80255 > +Signed-off-by: Siddharth Doshi <[email protected]> > +--- > + lib/cookie.c | 2 +- > + tests/data/Makefile.am | 1 + > + tests/data/test2885 | 52 ++++++++++++++++++++++++++++++++++++++++++ > + 3 files changed, 54 insertions(+), 1 deletion(-) > + create mode 100644 tests/data/test2885
Hello, I believe this patch is responsible for ptests failures: qemux86-64-ptest debian12-vk-8 wrynose completed at 2026-09-14 22:47:23+00:00 https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4557 qemuarm64-ptest ubuntu2404-vk-arm2 wrynose completed at 2026-09-14 23:24:50+00:00 https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4530 qemuriscv64-ptest alma9-vk-2 wrynose completed at 2026-09-15 00:01:40+00:00 https://autobuilder.yoctoproject.org/valkyrie/?#/builders/56/builds/2408 qemuarm64-musl-ptest stream10-vk-arm1 wrynose completed at 2026-09-14 22:49:53+00:00 https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1202 qemux86-64-musl-ptest fedora43-vk-2 wrynose completed at 2026-09-14 22:48:49+00:00 https://autobuilder.yoctoproject.org/valkyrie/?#/builders/110/builds/1185 Failed ptests: {'curl': ['1105_-_HTTP_with_cookie_parser_and_header_recording_-_output']} I could reproduce this locally with bitbake core-image-ptest-curl && bitbake core-image-ptest-curl -c testimage Can you look into this? In the meantime, I'll keep 1-3,5-6/6 in my branch. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245966): https://lists.openembedded.org/g/openembedded-core/message/245966 Mute This Topic: https://lists.openembedded.org/mt/121170242/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
