From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
Retain the curl 8.19.0 option-completion API and existing opt-in automatic client certificate behavior. Reset native CA options per transfer without adding the newer initial-origin restriction. [1] https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891 [2] https://curl.se/docs/CVE-2026-11564.html Signed-off-by: Darsh Kelaiya <[email protected]> --- Changes in v2: - Clarify that Schannel selection remains opt-in and disabled by default, preserving the existing CURLSSLOPT_AUTO_CLIENT_CERT flag. - Document the per-transfer native-CA reset and omitted newer initial-origin restriction. Schannel redirect behavior has not been runtime tested. --- .../curl/curl/CVE-2026-11564.patch | 139 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 140 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-11564.patch b/meta/recipes-support/curl/curl/CVE-2026-11564.patch new file mode 100644 index 0000000000..86f0181630 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-11564.patch @@ -0,0 +1,139 @@ +From d69bfad3fa3daf5e72331f6870667607828d5891 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing <[email protected]> +Date: Mon, 8 Jun 2026 10:11:30 +0200 +Subject: [PATCH] ssl native_ca_store: always reinit + +Add bit `native_ca_store_opt` to keep the setting of +CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy +transfer if a native CA store shall be used or not. + +This avoids `native_ca_store` getting stuck on TRUE after being set +once. + +Closes #21902 + +CVE: CVE-2026-11564 +Upstream-Status: Backport [https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f6870667607828d5891] + +Backport Changes: +- Applied the option-completion helper to lib/vtls/vtls.c because curl + 8.19.0 does not have lib/vtls/vtls_config.c. +- Kept auto_client_cert derived from CURLSSLOPT_AUTO_CLIENT_CERT, as + in the old set_ssl_options(). This preserves the existing Schannel + opt-in behavior; automatic selection remains disabled by default. +- Omitted the initial-origin restriction from the newer origin-aware + configuration, introduced by [1]. + Curl 8.19.0 has no equivalent origin state. This backport resets + native CA options per transfer without adding that restriction. + +[1] https://github.com/curl/curl/commit/d3391229b0a0eb04f1ffe85f1483a890c5e00009 + +(cherry picked from commit d69bfad3fa3daf5e72331f6870667607828d5891) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + lib/doh.c | 3 ++- + lib/setopt.c | 20 ++------------------ + lib/vtls/vtls.c | 21 +++++++++++++++++++++ + 3 files changed, 25 insertions(+), 19 deletions(-) + +diff --git a/lib/doh.c b/lib/doh.c +index 4488d42..80da94b 100644 +--- a/lib/doh.c ++++ b/lib/doh.c +@@ -397,7 +397,8 @@ static CURLcode doh_probe_run(struct Curl_easy *data, + } + + (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS, +- (long)data->set.ssl.primary.ssl_options); ++ ((long)data->set.ssl.primary.ssl_options & ++ ~CURLSSLOPT_AUTO_CLIENT_CERT)); + + doh->state.internal = TRUE; + doh->master_mid = data->mid; /* master transfer of this one */ +diff --git a/lib/setopt.c b/lib/setopt.c +index 7e6960c..3603912 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -407,22 +407,6 @@ static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg) + } + #endif /* !CURL_DISABLE_RTSP */ + +-#ifdef USE_SSL +-static void set_ssl_options(struct ssl_config_data *ssl, +- struct ssl_primary_config *config, +- long arg) +-{ +- config->ssl_options = (unsigned char)(arg & 0xff); +- ssl->enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST); +- ssl->no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE); +- ssl->no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN); +- ssl->revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT); +- ssl->native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA); +- ssl->auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT); +- ssl->earlydata = !!(arg & CURLSSLOPT_EARLYDATA); +-} +-#endif +- + static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option, + long arg) + { +@@ -1002,11 +986,11 @@ static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option, + s->use_ssl = (unsigned char)arg; + break; + case CURLOPT_SSL_OPTIONS: +- set_ssl_options(&s->ssl, &s->ssl.primary, arg); ++ s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff); + break; + #ifndef CURL_DISABLE_PROXY + case CURLOPT_PROXY_SSL_OPTIONS: +- set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg); ++ s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff); + break; + #endif + case CURLOPT_SSL_ENABLE_NPN: +diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c +index 6dcc67d..35cb4f0 100644 +--- a/lib/vtls/vtls.c ++++ b/lib/vtls/vtls.c +@@ -306,6 +306,22 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc) + #endif + } + ++static void ssl_easy_config_compl_options(struct ssl_config_data *sslc) ++{ ++ uint8_t options = sslc->primary.ssl_options; ++ /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it. ++ * If not, we switch it on for supported backends if no custom ++ * ca settings exist. */ ++ sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); ++ sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST); ++ sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN); ++ sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE); ++ sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT); ++ sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA); ++ ++ sslc->auto_client_cert = !!(options & CURLSSLOPT_AUTO_CLIENT_CERT); ++} ++ + CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + { + struct ssl_config_data *sslc = &data->set.ssl; +@@ -314,6 +330,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + CURLcode result; + #endif + ++ ssl_easy_config_compl_options(sslc); ++ + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) +@@ -360,6 +378,9 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) + + #ifndef CURL_DISABLE_PROXY + sslc = &data->set.proxy_ssl; ++ /* no initial origin for proxy, it is not changed for redirects */ ++ ssl_easy_config_compl_options(sslc); ++ + if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { + #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) + if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index af76f5d53b..322304f47d 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -41,6 +41,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-8926-dependent.patch \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \ + file://CVE-2026-11564.patch \ file://CVE-2026-80230.patch \ " -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248491): https://lists.openembedded.org/g/openembedded-core/message/248491 Mute This Topic: https://lists.openembedded.org/mt/121897577/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
