On Mon Jul 20, 2026 at 1:30 PM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > Backport the upstream fix [1] for proxy Digest state reuse across proxy > switches described in [2] and tracked by [3]. > > [1] > https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 > [2] https://curl.se/docs/CVE-2026-7168.html > [3] https://nvd.nist.gov/vuln/detail/CVE-2026-7168 > > Signed-off-by: Deepak Rathore <[email protected]> > --- > - Changes from v1 to v2: Refresh the patches on top of the latest > wrynose branch. > .../curl/curl/CVE-2026-7168.patch | 373 ++++++++++++++++++ > meta/recipes-support/curl/curl_8.19.0.bb | 1 + > 2 files changed, 374 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch > b/meta/recipes-support/curl/curl/CVE-2026-7168.patch > new file mode 100644 > index 0000000000..b848fbaf84 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch > @@ -0,0 +1,373 @@ > +From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Mon, 27 Apr 2026 09:14:51 +0200 > +Subject: [PATCH] setopt: clear proxy auth properties when switching > + > +Verify with test 1588 > + > +Closes #21453 > + > +CVE: CVE-2026-7168 > +Upstream-Status: Backport > [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507] > + > +Backport Changes: > +- Adapted setproxy() insertion and test-list placement to the curl 8.19.0 > wrynose layout. > + > +(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507) > +Signed-off-by: Deepak Rathore <[email protected]> > +--- > + lib/setopt.c | 14 +++- > + lib/vauth/vauth.h | 1 + > + tests/data/Makefile.am | 2 +- > + tests/data/test1588 | 106 ++++++++++++++++++++++++++ > + tests/libtest/Makefile.inc | 2 +- > + tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++ > + 6 files changed, 272 insertions(+), 3 deletions(-) > + create mode 100644 tests/data/test1588 > + create mode 100644 tests/libtest/lib1588.c > + > +diff --git a/lib/setopt.c b/lib/setopt.c > +index 84f3e02..d12ffb6 100644 > +--- a/lib/setopt.c > ++++ b/lib/setopt.c > +@@ -49,6 +49,7 @@ > + #include "curlx/strdup.h" > + #include "escape.h" > + #include "bufref.h" > ++#include "vauth/vauth.h" > + > + static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs) > + { > +@@ -1664,6 +1665,17 @@ static CURLcode cookiefile(struct Curl_easy *data, > const char *ptr) > + #endif > + > + #ifndef CURL_DISABLE_PROXY > ++static CURLcode setproxy(struct Curl_easy *data, const char *proxy) > ++{ > ++ if((data->set.str[STRING_PROXY] && proxy) && > ++ !strcmp(data->set.str[STRING_PROXY], proxy)) > ++ return CURLE_OK;
Upstream patch has comments in this function. Please keep them. I already reviewed patches 1-4/5, so, could you send a v2 with the comment preserved only for this patch? In general, please review the output of the tool you use to create those patches. On my side, I use a wrapper around interdiff: https://linux.die.net/man/1/interdiff Maybe you can add something similar into your workflow? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241506): https://lists.openembedded.org/g/openembedded-core/message/241506 Mute This Topic: https://lists.openembedded.org/mt/120357100/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
