CVE fixed in 8.22.0: Info gathered from [1] based First and Last CVE-2026-13608 CVE-2026-18924 CVE-2026-19931 CVE-2026-80229 CVE-2026-80230 CVE-2026-80231 CVE-2026-80255 CVE-2026-82208 CVE-2026-82209
[1] https://curl.se/docs/vuln-8.21.0.html Signed-off-by: Jaipaul Cheernam <[email protected]> --- meta/recipes-support/curl/curl/no-test-timeout.patch | 8 ++++---- .../curl/{curl_8.21.0.bb => curl_8.22.0.bb} | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) rename meta/recipes-support/curl/{curl_8.21.0.bb => curl_8.22.0.bb} (98%) diff --git a/meta/recipes-support/curl/curl/no-test-timeout.patch b/meta/recipes-support/curl/curl/no-test-timeout.patch index f432279728..93c2627bdd 100644 --- a/meta/recipes-support/curl/curl/no-test-timeout.patch +++ b/meta/recipes-support/curl/curl/no-test-timeout.patch @@ -1,4 +1,4 @@ -From 30fb6d1ce4cc721feef5665934f2b7f83fb50efb Mon Sep 17 00:00:00 2001 +From 4bc84380d2d0d85ed5a57cf9f78286531a19de48 Mon Sep 17 00:00:00 2001 From: Ross Burton <[email protected]> Date: Fri, 15 Mar 2024 14:37:37 +0000 Subject: [PATCH] Set the max-time timeout to 600 so the timeout is 10 minutes @@ -12,15 +12,15 @@ Signed-off-by: Ross Burton <[email protected]> 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/servers.pm b/tests/servers.pm -index 5d5d98b..442cfaf 100644 +index 99db988..81a7572 100644 --- a/tests/servers.pm +++ b/tests/servers.pm -@@ -124,7 +124,7 @@ +@@ -123,7 +123,7 @@ my $sshdverstr; # for socks server, ssh daemon version string my $sshderror; # for socks server, ssh daemon version error my %doesntrun; # servers that do not work, identified by pidfile my %PORT = (nolisten => 47); # port we use for a local non-listening service -my $server_response_maxtime = 13; +my $server_response_maxtime = 600; - my $httptlssrv = find_httptlssrv(); my %run; # running server my %runcert; # cert file currently in use by an SSL running server + my $CLIENTIP = "127.0.0.1"; # address which curl uses for incoming connections diff --git a/meta/recipes-support/curl/curl_8.21.0.bb b/meta/recipes-support/curl/curl_8.22.0.bb similarity index 98% rename from meta/recipes-support/curl/curl_8.21.0.bb rename to meta/recipes-support/curl/curl_8.22.0.bb index e8c024d18a..ad3e6b728f 100644 --- a/meta/recipes-support/curl/curl_8.21.0.bb +++ b/meta/recipes-support/curl/curl_8.22.0.bb @@ -20,7 +20,7 @@ SRC_URI:append:class-nativesdk = " \ file://environment.d-curl.sh \ " -SRC_URI[sha256sum] = "aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6" +SRC_URI[sha256sum] = "f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7" # Curl has used many names over the years... CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245012): https://lists.openembedded.org/g/openembedded-core/message/245012 Mute This Topic: https://lists.openembedded.org/mt/121065675/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
