From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
[1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a [2] https://curl.se/docs/CVE-2026-82208.html Signed-off-by: Darsh Kelaiya <[email protected]> --- Changes in v2: - Explain that curl 8.19.0 already supplies char * from data->set.str; upstream supplies const char * from CURL_EASY_STR. - Clarify that the ECH call and error handling are unchanged and both store-setup security hunks are retained. --- .../curl/curl/CVE-2026-82208.patch | 54 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 55 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch new file mode 100644 index 0000000000..1ff3794c17 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch @@ -0,0 +1,54 @@ +From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001 +From: Stefan Eissing <[email protected]> +Date: Wed, 26 Aug 2026 13:46:13 +0200 +Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice + +The flag preventing a rerun was not set when a cached_store +was used. + +CURL_UNCONST an ech string for my old wolfssl version + +Closes #22689 + +CVE: CVE-2026-82208 +Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a] + +Backport Changes: +- Omitted CURL_UNCONST(b64val) in wolfSSL_SetEchConfigsBase64(). In + curl 8.19.0, b64val is already char * from + data->set.str[STRING_ECH_CONFIG]; upstream uses const char * from + CURL_EASY_STR. The old pointer already matches the wolfSSL argument + type, so the ECH call and error handling need no change. + +(cherry picked from commit ed0338befd1d865a8ea1fbaa90013a096dedd07a) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + lib/vtls/wolfssl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c +index 74bd247..fdf33a8 100644 +--- a/lib/vtls/wolfssl.c ++++ b/lib/vtls/wolfssl.c +@@ -597,9 +597,6 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf, + bool imported_native_ca = FALSE; + bool imported_ca_info_blob = FALSE; + +- /* We do not want to do this again, no matter the outcome */ +- wssl->x509_store_setup = TRUE; +- + #ifndef NO_FILESYSTEM + /* load native CA certificates */ + if(ssl_config->native_ca_store) { +@@ -802,6 +799,9 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf, + WOLFSSL_X509_STORE *cached_store; + bool cache_criteria_met; + ++ /* We do not want to do this again, no matter the outcome */ ++ wssl->x509_store_setup = TRUE; ++ + /* Consider the X509 store cacheable if it comes exclusively from a CAfile, + or no source is provided and we are falling back to wolfSSL's built-in + default. */ +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 096e27570c..e8e4a7e998 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -45,6 +45,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \ file://CVE-2026-80255-dependent_p1.patch \ file://CVE-2026-80255-dependent_p2.patch \ file://CVE-2026-80255.patch \ + file://CVE-2026-82208.patch \ file://CVE-2026-80230.patch \ " -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248492): https://lists.openembedded.org/g/openembedded-core/message/248492 Mute This Topic: https://lists.openembedded.org/mt/121897578/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
