On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via lists.openembedded.org wrote: > From: Devansh Patel <[email protected]> > > This patch applies the upstream fix as referenced in [2], using the > commit shown in [1]. > > [1] > https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 > [2] https://curl.se/docs/CVE-2026-8286.html > > Signed-off-by: Devansh Patel <[email protected]> > --- > .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++ > meta/recipes-support/curl/curl_8.7.1.bb | 1 + > 2 files changed, 61 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch > b/meta/recipes-support/curl/curl/CVE-2026-8286.patch > new file mode 100644 > index 0000000000..ec2f6165c3 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch > @@ -0,0 +1,60 @@ > +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001 > +From: Stefan Eissing <[email protected]> > +Date: Thu, 7 May 2026 10:30:07 +0200 > +Subject: [PATCH] url: fix connection reuse for starttls protocols > + > +When a connection is tested for reuse in a transfer that *may* upgrade > +to TLS (commonly via STARTTLS), the SSL configuration must match the > +existing connection. > + > +Reported-by: Andrew Nesbit > +Closes #21522 > + > +CVE: CVE-2026-8286 > +Upstream-Status: Backport > [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16] > + > +Backport Changes: > +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream may-TLS > + and require-TLS distinction in ConnectionExists() and preserve the upstream > + TLS configuration matching behavior. > + > +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16) > +Signed-off-by: Devansh Patel <[email protected]> > +--- > + lib/url.c | 9 +++++---- > + 1 file changed, 5 insertions(+), 4 deletions(-) > +
Hello, This patch and the other ones in the series have formating issues: > +diff --git a/lib/url.c b/lib/url.c > +index dfcd6f4841..9e1ca0336c 100644 > +--- a/lib/url.c > ++++ b/lib/url.c > +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data, > + /* plain HTTP with upgrade */ > + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) && > + (needle->handler->protocol & CURLPROTO_HTTP); > +- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; > ++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; > ++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE; > + ^ For exemple, here it lacks a space to mark context. If you use interdiff to compare the upstream patch and yours, it is quite noticeable. Can you send a v2 with those fixed? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246207): https://lists.openembedded.org/g/openembedded-core/message/246207 Mute This Topic: https://lists.openembedded.org/mt/121083177/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
