Hi Yoann, Thanks for the review. I regenerated the patches and also adapted few CVE_STATUSES from Wrynose, sent a new fresh v1 series combining CVEs with Deepak's two fixes for CVE-2026-6429 & CVE-2026-7168 :
New Series: https://patchwork.yoctoproject.org/project/oe-core/list/?series=51870 The series applies to Scarthgap and curl 8.7.1. Please consider my earlier six-patch series superseded. Regards, Devansh On Fri, Sep 18, 2026 at 03:10 PM, Yoann Congal wrote: > > On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via > lists.openembedded.org wrote: > >> From: Devansh Patel <[email protected]> >> >> This patch applies the upstream fix as referenced in [2], using the >> commit shown in [1]. >> >> [1] >> https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 >> >> [2] https://curl.se/docs/CVE-2026-8286.html >> >> Signed-off-by: Devansh Patel <[email protected]> >> --- >> .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++ >> meta/recipes-support/curl/curl_8.7.1.bb | 1 + >> 2 files changed, 61 insertions(+) >> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch >> >> diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch >> b/meta/recipes-support/curl/curl/CVE-2026-8286.patch >> new file mode 100644 >> index 0000000000..ec2f6165c3 >> --- /dev/null >> +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch >> @@ -0,0 +1,60 @@ >> +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001 >> +From: Stefan Eissing <[email protected]> >> +Date: Thu, 7 May 2026 10:30:07 +0200 >> +Subject: [PATCH] url: fix connection reuse for starttls protocols >> + >> +When a connection is tested for reuse in a transfer that *may* upgrade >> +to TLS (commonly via STARTTLS), the SSL configuration must match the >> +existing connection. >> + >> +Reported-by: Andrew Nesbit >> +Closes #21522 >> + >> +CVE: CVE-2026-8286 >> +Upstream-Status: Backport [ >> https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 >> ] >> + >> +Backport Changes: >> +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream >> may-TLS >> + and require-TLS distinction in ConnectionExists() and preserve the >> upstream >> + TLS configuration matching behavior. >> + >> +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16) >> +Signed-off-by: Devansh Patel <[email protected]> >> +--- >> + lib/url.c | 9 +++++---- >> + 1 file changed, 5 insertions(+), 4 deletions(-) >> + > > Hello, > > This patch and the other ones in the series have formating issues: > > >> +diff --git a/lib/url.c b/lib/url.c >> +index dfcd6f4841..9e1ca0336c 100644 >> +--- a/lib/url.c >> ++++ b/lib/url.c >> +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data, >> + /* plain HTTP with upgrade */ >> + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) && >> + (needle->handler->protocol & CURLPROTO_HTTP); >> +- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; >> ++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; >> ++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE; >> + > > ^ For exemple, here it lacks a space to mark context. > > If you use interdiff to compare the upstream patch and yours, it is > quite noticeable. > > Can you send a v2 with those fixed? > > Thanks! > -- > Yoann Congal > Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247396): https://lists.openembedded.org/g/openembedded-core/message/247396 Mute This Topic: https://lists.openembedded.org/mt/121083177/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
