From: Deepak Rathore <[email protected]>
This series addresses multiple curl security vulnerabilities affecting
the curl 8.19.0 version provided by the Wrynose branch.
Five changes backport upstream security fixes:
- CVE-2026-8286: Include TLS configuration when matching connections
that may be upgraded using STARTTLS.
- CVE-2026-8927: Clear Digest authentication state when an
environment-configured proxy changes.
- CVE-2026-8932: Include the complete mTLS client credential
configuration in connection reuse and TLS session-cache matching.
- CVE-2026-8458: Include the SASL service name in connection reuse
matching.
- CVE-2026-11856: Clear Digest authentication state when the origin,
proxy, or credentials change.
Three changes add CVE_STATUS annotations for vulnerabilities whose
applicability depends on the Wrynose curl configuration:
- CVE-2026-8924 is not applicable because the recipe explicitly builds
curl without Public Suffix List support using --without-libpsl.
- CVE-2026-9547 is not applicable because the vulnerable libssh backend
is not available in the recipe. The supported libssh2 backend is not
affected.
- CVE-2026-12064 is marked unpatched when the optional libssh2
PACKAGECONFIG is enabled and not-applicable-config otherwise, because
the affected SCP/SFTP support is provided through libssh2.
The manual adaptations required for curl 8.19.0 are documented in the
Backport Changes sections of the corresponding source patches.
Validation performed:
- All the curl patches are prepared on top of this upstream curl patch which is
under review: https://lists.openembedded.org/g/openembedded-core/topic/120530931
- All recipe changes apply using git am without three-way fallback.
- All existing Wrynose patches and the proposed source patches apply to
the checksum-verified curl 8.19.0 source with no fuzz.
- A host build using the GnuTLS backend completed successfully.
- Regression tests 1686, 3303, and 3304 passed.
Deepak Rathore (8):
curl: fix CVE-2026-8286
curl: set CVE_STATUS for CVE-2026-8924
curl: fix CVE-2026-8927
curl: fix CVE-2026-8932
curl: fix CVE-2026-8458
curl: fix CVE-2026-11856
curl: set CVE_STATUS for CVE-2026-9547
curl: set CVE_STATUS for CVE-2026-12064
.../curl/curl/CVE-2026-11856_p1.patch | 372 ++++++
.../curl/curl/CVE-2026-11856_p2.patch | 72 ++
.../curl/curl/CVE-2026-8286.patch | 81 ++
.../curl/curl/CVE-2026-8458.patch | 202 +++
.../curl/curl/CVE-2026-8927.patch | 349 +++++
.../curl/curl/CVE-2026-8932-dependent.patch | 71 +
.../curl/curl/CVE-2026-8932.patch | 1148 +++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 11 +
8 files changed, 2306 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11856_p1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11856_p2.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8458.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch
--
2.35.6
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#242838):
https://lists.openembedded.org/g/openembedded-core/message/242838
Mute This Topic: https://lists.openembedded.org/mt/120607420/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
