mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-22 07:08:19 +00:00
Code Issues Projects Releases Wiki Activity

curl: fix CVE-2026-8286

Browse Source 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
[2] https://curl.se/docs/CVE-2026-8286.html

(From OE-Core rev: bff4e98852cdb376eb4dd3c69ea73ea5181a723d)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Devansh Patel authored and Paul Barker committed 2026-10-19 09:03:18 +01:00
1 parent 8d37b38956
commit 704558d8a1
2 files changed
+61
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-support/curl/curl/CVE-2026-8286.patch
+60
View File
@@ -0,0 +1,60 @@
From 9fcd9cead5edb8638d4d767bd0077c405b0390be Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Thu, 7 May 2026 10:30:07 +0200
Subject: [PATCH] url: fix connection reuse for starttls protocols
When a connection is tested for reuse in a transfer that *may* upgrade
to TLS (commonly via STARTTLS), the SSL configuration must match the
existing connection.
Reported-by: Andrew Nesbit
Closes #21522
CVE: CVE-2026-8286
Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
Backport Changes:
- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream
may-TLS and require-TLS distinction in ConnectionExists() and keep
the upstream TLS configuration matching behavior.
(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
lib/url.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/lib/url.c b/lib/url.c
index dfcd6f4841..9e1ca0336c 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
/* plain HTTP with upgrade */
bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
(needle->handler->protocol & CURLPROTO_HTTP);
- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
+ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
+ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
*usethis = NULL;
*force_reuse = FALSE;
@@ -1054,7 +1055,7 @@ ConnectionExists(struct Curl_easy *data,
continue;
if(!(needle->handler->flags & PROTOPT_SSL) &&
- req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
+ require_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
continue;
if(needle->bits.conn_to_host != check->bits.conn_to_host)
@@ -1202,8 +1203,8 @@ ConnectionExists(struct Curl_easy *data,
needle->remote_port != check->remote_port)
continue;
- /* If talking TLS, check needs to use the same SSL options. */
- if((needle->handler->flags & PROTOPT_SSL) &&
+ /* If talking/upgrading to TLS, check needs the same SSL options. */
+ if(((needle->handler->flags & PROTOPT_SSL) || may_tls) &&
!Curl_ssl_conn_config_match(data, check, FALSE)) {
DEBUGF(infof(data,
"Connection #%" CURL_FORMAT_CURL_OFF_T
meta/recipes-support/curl/curl_8.7.1.bb
+1
View File
@@ -42,6 +42,7 @@ SRC_URI = " \
file://CVE-2026-6253.patch \
file://CVE-2026-4873.patch \
file://CVE-2026-13608.patch \
file://CVE-2026-8286.patch \
"
SRC_URI:append:class-nativesdk = " \