From: Darsh Kelaiya <[email protected]> Backport five security fixes to curl 8.19.0 on Wrynose. The series addresses CVE-2026-8926, CVE-2026-11564, CVE-2026-80255, CVE-2026-82208, and CVE-2026-80231.
This series is based on Jaipaul Cheernam's Wrynose patch for CVE-2026-80230 [1]. Apply that patch first. The five commits here add the remaining fixes on top of it. Changes in v2: - Address OE-core review comments: - CVE-2026-8926 [2]: a later login in one machine entry can reuse the previous login's password (bob/p 1 instead of bob/p2). Select credentials after reading the whole entry, keeping its final login and password so both credential orderings select bob/p2. Extend tests/data/test1304 and tests/unit/unit1304.c for both orderings, replaced logins, account values and macros. Keep the old parser API and test harness, and document differences from upstream's lexer/scanner rewrite. Retain password-only entries and the old blank-password API. - CVE-2026-11564 [3]: could retaining automatic client certificate selection introduce certificate confusion? Clarify that the backport preserves the existing Schannel opt-in assignment from CURLSSLOPT_AUTO_CLIENT_CERT, disabled by default. The native-CA setting is reset per transfer. The newer initial-origin restriction is not backported; Schannel redirect behavior has not been runtime tested. - CVE-2026-80255 [4]: missing per-attribute validation can turn Secure<TAB>HttpOnly into an unknown attribute and lose Secure. Carry the earlier TAB-value fix and validation from [7] in separate dependent_p1 and dependent_p2 patches before the main TAB-handling fix. Adapt the validation to the older parser before attribute dispatch. Extend test 2885 to reject this malformed cookie, retaining the TAB-before-Secure case and normal Secure control. - CVE-2026-82208 [5]: justify omitting the CURL_UNCONST ECH change and explain whether it affects ECH behavior. Explain that 8.19.0 already has a mutable char * from data->set.str, while upstream uses const char * from CURL_EASY_STR. The old pointer already matches the wolfSSL argument type; the ECH call and error handling are unchanged. Both store-setup security hunks are retained. - CVE-2026-80231 [6]: justify omitting the ossl_apply_session() hunk and establish what verification handling exists in 8.19.0. Map the moved flag to lib/urldata.h and the SSL helpers to lib/vtls/vtls.c. Explain the GnuTLS function-name differences. The omitted OpenSSL hunk only updates a flag access inside a later SecTrust session-reuse exception. That exception and its cached verification field are absent from 8.19.0. Its existing session verification check remains unchanged. [1] https://lists.openembedded.org/g/openembedded-core/message/248025 [2] https://lists.openembedded.org/g/openembedded-core/message/248286 [3] https://lists.openembedded.org/g/openembedded-core/message/248292 [4] https://lists.openembedded.org/g/openembedded-core/message/248294 [5] https://lists.openembedded.org/g/openembedded-core/message/248296 [6] https://lists.openembedded.org/g/openembedded-core/message/248297 [7] https://github.com/curl/curl/commit/67300814294ab0aa311b8568b460619ecc522949 Darsh Kelaiya (5): curl: fix CVE-2026-8926 curl: fix CVE-2026-11564 curl: fix CVE-2026-80255 curl: fix CVE-2026-82208 curl: fix CVE-2026-80231 .../curl/curl/CVE-2026-11564.patch | 139 ++++++++++ .../curl/curl/CVE-2026-80231.patch | 225 +++++++++++++++ .../curl/CVE-2026-80255-dependent_p1.patch | 139 ++++++++++ .../curl/CVE-2026-80255-dependent_p2.patch | 81 ++++++ .../curl/curl/CVE-2026-80255.patch | 115 ++++++++ .../curl/curl/CVE-2026-82208.patch | 54 ++++ .../curl/curl/CVE-2026-8926-dependent.patch | 140 ++++++++++ .../curl/curl/CVE-2026-8926_p1.patch | 258 ++++++++++++++++++ .../curl/curl/CVE-2026-8926_p2.patch | 84 ++++++ meta/recipes-support/curl/curl_8.19.0.bb | 9 + 10 files changed, 1244 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248493): https://lists.openembedded.org/g/openembedded-core/message/248493 Mute This Topic: https://lists.openembedded.org/mt/121897579/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
