Thanks, Yoann, for your review. Let me review your suggestion and comments in both patches.
Regards, Deepak ________________________________ From: Yoann Congal <[email protected]> Sent: Friday, August 28, 2026 8:54 PM To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][wrynose][PATCH 6/8] curl: fix CVE-2026-11856 On Wed Aug 5, 2026 at 10:31 AM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > This patch applies the upstream curl security backports for > CVE-2026-11856. The main fix commit is referenced in [1], the > Digest proxy-state follow-up is referenced in [2], and the public > curl advisory is referenced in [3]. The individual backported commit > links are recorded in the embedded patch headers. > > [1] > https://github.com/curl/curl/commit/5c6b4880357ab3e72967c1c45cae0f96ffabc535 > [2] > https://github.com/curl/curl/commit/7ec25148c06b049d3252172ff17fae85b19c54c9 > [3] https://curl.se/docs/CVE-2026-11856.html > > Signed-off-by: Deepak Rathore <[email protected]> > --- > .../curl/curl/CVE-2026-11856_p1.patch | 372 ++++++++++++++++++ > .../curl/curl/CVE-2026-11856_p2.patch | 72 ++++ > meta/recipes-support/curl/curl_8.19.0.bb | 2 + > 3 files changed, 446 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11856_p1.patch > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11856_p2.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2026-11856_p1.patch > b/meta/recipes-support/curl/curl/CVE-2026-11856_p1.patch > new file mode 100644 > index 0000000000..80fb18a7c1 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2026-11856_p1.patch > @@ -0,0 +1,372 @@ > +From 3349fbcb7876456cadc3cc3a8d3e8aff29406906 Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <[email protected]> > +Date: Mon, 13 Jul 2026 23:17:23 -0700 > +Subject: [PATCH] digest: flush state on origin or credential change > + > +Verified by test 1686 > + > +Closes #21944 > + > +CVE: CVE-2026-11856 > +Upstream-Status: Backport > [https://github.com/curl/curl/commit/5c6b4880357ab3e72967c1c45cae0f96ffabc535] > + > +Backport Changes: > +- Wrynose curl 8.19.0 does not have upstream Curl_peer or > + struct Curl_creds. This backport stores the host Digest origin > + and user/password on digestdata, then flushes stale host Digest > + state before reuse when either value changes. > +- Kept Wrynose test-list ordering and added only the upstream > + test1686/lib1686 regression coverage. Same as previous patch of the series, this is new code that does not look like the fix from upstream (I can't accept/understand backporting adaptation but here, I feel like this is too much) I'll hold this one as well. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244761): https://lists.openembedded.org/g/openembedded-core/message/244761 Mute This Topic: https://lists.openembedded.org/mt/120607433/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
