From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
Apply prerequisite [3] to reject TABs in attribute values, then prerequisite [4] for per-attribute name/value validation. Carry them as separate dependent_p1 and dependent_p2 patches before the main TAB-handling fix. Preserve test 1685 and the invalid_octets() adaptation required by the older parser. Keep test 2885's Secure<TAB>HttpOnly regression case alongside the upstream TAB-before-Secure case and normal Secure control. [1] https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a [2] https://curl.se/docs/CVE-2026-80255.html [3] https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d [4] https://github.com/curl/curl/commit/67300814294ab0aa311b8568b460619ecc522949 Signed-off-by: Darsh Kelaiya <[email protected]> --- Changes in v2: - Reject malformed attribute names/values before dispatch so a cookie cannot lose its Secure flag. - Carry the TAB-value fix and adapted validation in separate dependent_p1 and dependent_p2 patches before the main fix. - Extend test 2885 with the malformed attribute case, retaining the TAB-before-Secure and normal Secure controls. --- .../curl/CVE-2026-80255-dependent_p1.patch | 139 ++++++++++++++++++ .../curl/CVE-2026-80255-dependent_p2.patch | 81 ++++++++++ .../curl/curl/CVE-2026-80255.patch | 115 +++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 3 + 4 files changed, 338 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch new file mode 100644 index 0000000000..ca7737e5dd --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch @@ -0,0 +1,139 @@ +From 8e8bdd36048c146fe843d8948a912fbd398d1c5d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Wed, 1 Apr 2026 08:09:47 +0200 +Subject: [PATCH] cookie: fix rejection when tabs in value + +A previous refactor changed the TAB check so that the octet could be +accepted in the 'path', which would cause an invalid line in the saved +cookie file so not possible to read the cookie back. Not terrible +because the path cannot contain a raw tab anyway so it would never match +anyway. + +Add test 1685 to verify + +Reported-by: Izan on hackerone + +Closes #21185 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d] + +Backport Changes: +- Registered test 1685 in the older curl 8.19.0 test-list row. + +(cherry picked from commit 8e8bdd36048c146fe843d8948a912fbd398d1c5d) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + lib/cookie.c | 14 ++++++------- + tests/data/Makefile.am | 2 +- + tests/data/test1685 | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 65 insertions(+), 8 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 4d53cc4..cd95130 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -461,6 +461,13 @@ parse_cookie_header(struct Curl_easy *data, + sep = TRUE; /* a '=' was used */ + if(!curlx_str_cspn(&ptr, &val, ";\r\n")) + curlx_str_trimblanks(&val); ++ ++ /* Reject cookies with a TAB inside the value */ ++ if(curlx_strlen(&val) && ++ memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { ++ infof(data, "cookie contains TAB, dropping"); ++ return CURLE_OK; ++ } + } + else + curlx_str_init(&val); +@@ -489,13 +496,6 @@ parse_cookie_header(struct Curl_easy *data, + return CURLE_OK; + } + +- /* Reject cookies with a TAB inside the value */ +- if(curlx_strlen(&val) && +- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { +- infof(data, "cookie contains TAB, dropping"); +- return CURLE_OK; +- } +- + /* Check if we have a reserved prefix set. */ + if(!strncmp("__Secure-", curlx_str(&name), 9)) + co->prefix_secure = TRUE; +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index ea700cd..5bb4f7e 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -226,7 +226,7 @@ test1660 test1661 test1662 test1663 test1664 test1665 \ + \ + test1670 test1671 \ + \ +-test1680 test1681 test1682 test1683 \ ++test1680 test1681 test1682 test1683 test1685 \ + \ + test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \ + test1708 test1709 test1710 test1711 test1712 \ +diff --git a/tests/data/test1685 b/tests/data/test1685 +new file mode 100644 +index 0000000..b98dc20 +--- /dev/null ++++ b/tests/data/test1685 +@@ -0,0 +1,57 @@ ++<?xml version="1.0" encoding="US-ASCII"?> ++<testcase> ++<info> ++<keywords> ++HTTP ++cookies ++</keywords> ++</info> ++ ++# Server-side ++<reply> ++<data crlf="headers"> ++HTTP/1.0 200 OK swsclose ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Type: text/html ++Set-Cookie: name=content; path=/we%TABwant ++Set-Cookie: accept=this; path=/only/this ++ ++boo ++</data> ++</reply> ++ ++# Client-side ++<client> ++<server> ++http ++</server> ++<name> ++HTTP, reject cookie with tab in path ++</name> ++<command> ++http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt ++</command> ++ ++<features> ++cookies ++</features> ++</client> ++ ++# Verify data after the test has been "shot" ++<verify> ++<protocol crlf="headers"> ++GET / HTTP/1.1 ++Host: %HOSTIP:%HTTPPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++</protocol> ++<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text"> ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis ++</file> ++</verify> ++</testcase> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch new file mode 100644 index 0000000000..8950b28784 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch @@ -0,0 +1,81 @@ +From 67300814294ab0aa311b8568b460619ecc522949 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Wed, 3 Jun 2026 08:10:14 +0200 +Subject: [PATCH] cookie: refactor parse_cookie_header + +- introduce a few static helper functions +- simplify the bad octet checks +- simplify the too long cookie/value check + +Closes #21854 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/67300814294ab0aa311b8568b460619ecc522949] + +Backport Changes: +- Kept parse_cookie_header() in its curl 8.19.0 form instead of + extracting parse_first_pair(), parse_flag(), parse_domain(), + parse_maxage() and parse_expires(). +- Applied the control-octet checks to that existing parser: reject + TAB in invalid_octets(), validate every attribute name/value, + and remove the duplicate first-pair checks. +- Kept the older cookie name/value length limits; omitted upstream's + separate simplification of those limits. + +(cherry picked from commit 67300814294ab0aa311b8568b460619ecc522949) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + lib/cookie.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index cd95130..b3b1ebd 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -354,9 +354,9 @@ static bool bad_domain(const char *domain, size_t len) + static bool invalid_octets(const char *ptr, size_t len) + { + const unsigned char *p = (const unsigned char *)ptr; +- /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */ ++ /* Reject all bytes \x01 - \x1f + \x7f */ + while(len && *p) { +- if(((*p != 9) && (*p < 0x20)) || (*p == 0x7f)) ++ if((*p < 0x20) || (*p == 0x7f)) + return TRUE; + p++; + len--; +@@ -457,15 +457,18 @@ parse_cookie_header(struct Curl_easy *data, + bool sep = FALSE; + curlx_str_trimblanks(&name); + ++ if(invalid_octets(curlx_str(&name), curlx_strlen(&name))) { ++ infof(data, "invalid octets in name, cookie dropped"); ++ return CURLE_OK; ++ } ++ + if(!curlx_str_single(&ptr, '=')) { + sep = TRUE; /* a '=' was used */ + if(!curlx_str_cspn(&ptr, &val, ";\r\n")) + curlx_str_trimblanks(&val); + +- /* Reject cookies with a TAB inside the value */ +- if(curlx_strlen(&val) && +- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) { +- infof(data, "cookie contains TAB, dropping"); ++ if(invalid_octets(curlx_str(&val), curlx_strlen(&val))) { ++ infof(data, "invalid octets in value, cookie dropped"); + return CURLE_OK; + } + } +@@ -476,8 +479,6 @@ parse_cookie_header(struct Curl_easy *data, + /* The first name/value pair is the actual cookie name */ + if(!sep || + /* Bad name/value pair. */ +- invalid_octets(curlx_str(&name), curlx_strlen(&name)) || +- invalid_octets(curlx_str(&val), curlx_strlen(&val)) || + !curlx_strlen(&name)) { + infof(data, "invalid octets in name/value, cookie dropped"); + return CURLE_OK; +-- +2.35.6 + diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch new file mode 100644 index 0000000000..43ef27f9bc --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch @@ -0,0 +1,115 @@ +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Thu, 27 Aug 2026 08:33:30 +0200 +Subject: [PATCH] cookie: improve TAB handling + +For entries with a leading tab. Verified in test 2885. + +Reported-by: Stanislav Fort +Closes #22699 + +CVE: CVE-2026-80255 +Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a] + +Backport Changes: +- Extended test 2885 to reject Secure<TAB>HttpOnly, alongside the + upstream TAB-before-Secure case and normal Secure control. +- Registered test 2885 in the older curl 8.19.0 test-list layout. + +(cherry picked from commit 4f6aa41a0145e930e766775dbe860883d350aa0a) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + lib/cookie.c | 2 +- + tests/data/Makefile.am | 2 +- + tests/data/test2885 | 53 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 55 insertions(+), 2 deletions(-) + create mode 100644 tests/data/test2885 + +diff --git a/lib/cookie.c b/lib/cookie.c +index b3b1ebd..a8959a6 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data, + struct Curl_str val; + + /* we have a <name>=<value> pair or a stand-alone word here */ +- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) { ++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) { + bool sep = FALSE; + curlx_str_trimblanks(&name); + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 5bb4f7e..e157596 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -272,7 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \ + test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \ + test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \ + test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \ +-\ ++test2885 \ + test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \ + test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \ + test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \ +diff --git a/tests/data/test2885 b/tests/data/test2885 +new file mode 100644 +index 0000000..2635b6f +--- /dev/null ++++ b/tests/data/test2885 +@@ -0,0 +1,53 @@ ++<?xml version="1.0" encoding="US-ASCII"?> ++<testcase> ++<info> ++<keywords> ++HTTP ++cookies ++</keywords> ++</info> ++ ++<reply> ++<data crlf="headers"> ++HTTP/1.1 200 OK ++Content-Length: 0 ++Set-Cookie: thisis=SECRET;%TABSecure ++Set-Cookie: malformed=SECRET; Secure%TABHttpOnly ++Set-Cookie: also=notab; Secure ++ ++</data> ++</reply> ++ ++<client> ++<features> ++cookies ++</features> ++<server> ++https ++</server> ++<name> ++Cookies with TAB before 'secure' ++</name> ++<command> ++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure ++</command> ++</client> ++ ++<verify> ++<protocol crlf="headers"> ++GET /%TESTNUMBER HTTP/1.1 ++Host: cookie.example:%HTTPSPORT ++User-Agent: curl/%VERSION ++Accept: */* ++ ++</protocol> ++<file name="%LOGDIR/cookies.txt" mode="text"> ++# Netscape HTTP Cookie File ++# https://curl.se/docs/http-cookies.html ++# This file was generated by libcurl! Edit at your own risk. ++ ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab ++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET ++</file> ++</verify> ++</testcase> +-- +2.35.6 + diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 322304f47d..096e27570c 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -42,6 +42,9 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-8926_p1.patch \ file://CVE-2026-8926_p2.patch \ file://CVE-2026-11564.patch \ + file://CVE-2026-80255-dependent_p1.patch \ + file://CVE-2026-80255-dependent_p2.patch \ + file://CVE-2026-80255.patch \ file://CVE-2026-80230.patch \ " -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248494): https://lists.openembedded.org/g/openembedded-core/message/248494 Mute This Topic: https://lists.openembedded.org/mt/121897580/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
