mirror of
https://git.yoctoproject.org/poky
synced 2026-09-16 09:49:35 +02:00
curl: patch CVE-2026-3783
CVE-2026-3783-pre1.patch is dependency patch for CVE-2026-3783.patch
cherry picked from upstream commit:
d7b970e46b
https://github.com/curl/curl/commit/e3d7401a32a46516c9e5ee877
Reference: https://curl.se/docs/CVE-2026-3783.html
(From OE-Core rev: a904e52def0a789ce20f58bcbf2edd7b762c1c1e)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Vijay Anusuri
committed by
Paul Barker
Paul Barker
parent
33fab72fa7
commit
6bdb27cfe1
66
meta/recipes-support/curl/curl/CVE-2026-3783-pre1.patch
Normal file
66
meta/recipes-support/curl/curl/CVE-2026-3783-pre1.patch
Normal file
@@ -0,0 +1,66 @@
|
|||||||
|
From d7b970e46ba29a7e558e21d19f485977ffed6266 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Stenberg <daniel@haxx.se>
|
||||||
|
Date: Fri, 29 Apr 2022 22:56:47 +0200
|
||||||
|
Subject: [PATCH] http: move Curl_allow_auth_to_host()
|
||||||
|
|
||||||
|
It was mistakenly put within the CURL_DISABLE_HTTP_AUTH #ifdef
|
||||||
|
|
||||||
|
Reported-by: Michael Olbrich
|
||||||
|
Fixes #8772
|
||||||
|
Closes #8775
|
||||||
|
|
||||||
|
Upstream-Status: Backport [https://github.com/curl/curl/commit/d7b970e46ba29a7e558e21d19f485977ffed6266]
|
||||||
|
CVE: CVE-2026-3783 #Dependency Patch
|
||||||
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||||
|
---
|
||||||
|
lib/http.c | 30 +++++++++++++++---------------
|
||||||
|
1 file changed, 15 insertions(+), 15 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/http.c b/lib/http.c
|
||||||
|
index 0d5c449bc72a..b215307dcaaa 100644
|
||||||
|
--- a/lib/http.c
|
||||||
|
+++ b/lib/http.c
|
||||||
|
@@ -651,6 +651,21 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data)
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * Curl_allow_auth_to_host() tells if authentication, cookies or other
|
||||||
|
+ * "sensitive data" can (still) be sent to this host.
|
||||||
|
+ */
|
||||||
|
+bool Curl_allow_auth_to_host(struct Curl_easy *data)
|
||||||
|
+{
|
||||||
|
+ struct connectdata *conn = data->conn;
|
||||||
|
+ return (!data->state.this_is_a_follow ||
|
||||||
|
+ data->set.allow_auth_to_other_hosts ||
|
||||||
|
+ (data->state.first_host &&
|
||||||
|
+ strcasecompare(data->state.first_host, conn->host.name) &&
|
||||||
|
+ (data->state.first_remote_port == conn->remote_port) &&
|
||||||
|
+ (data->state.first_remote_protocol == conn->handler->protocol)));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
#ifndef CURL_DISABLE_HTTP_AUTH
|
||||||
|
/*
|
||||||
|
* Output the correct authentication header depending on the auth type
|
||||||
|
@@ -775,21 +790,6 @@ output_auth_headers(struct Curl_easy *data,
|
||||||
|
return CURLE_OK;
|
||||||
|
}
|
||||||
|
|
||||||
|
-/*
|
||||||
|
- * Curl_allow_auth_to_host() tells if authentication, cookies or other
|
||||||
|
- * "sensitive data" can (still) be sent to this host.
|
||||||
|
- */
|
||||||
|
-bool Curl_allow_auth_to_host(struct Curl_easy *data)
|
||||||
|
-{
|
||||||
|
- struct connectdata *conn = data->conn;
|
||||||
|
- return (!data->state.this_is_a_follow ||
|
||||||
|
- data->set.allow_auth_to_other_hosts ||
|
||||||
|
- (data->state.first_host &&
|
||||||
|
- strcasecompare(data->state.first_host, conn->host.name) &&
|
||||||
|
- (data->state.first_remote_port == conn->remote_port) &&
|
||||||
|
- (data->state.first_remote_protocol == conn->handler->protocol)));
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
/**
|
||||||
|
* Curl_http_output_auth() setups the authentication headers for the
|
||||||
|
* host/proxy and the correct authentication
|
||||||
157
meta/recipes-support/curl/curl/CVE-2026-3783.patch
Normal file
157
meta/recipes-support/curl/curl/CVE-2026-3783.patch
Normal file
@@ -0,0 +1,157 @@
|
|||||||
|
From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Stenberg <daniel@haxx.se>
|
||||||
|
Date: Fri, 6 Mar 2026 23:13:07 +0100
|
||||||
|
Subject: [PATCH] http: only send bearer if auth is allowed
|
||||||
|
|
||||||
|
Verify with test 2006
|
||||||
|
|
||||||
|
Closes #20843
|
||||||
|
|
||||||
|
Curl_auth_allowed_to_host() function got renamed from
|
||||||
|
Curl_allow_auth_to_host() by the commit
|
||||||
|
https://github.com/curl/curl/commit/72652c0613d37ce18e99cca17a42887f12ad43da
|
||||||
|
|
||||||
|
Current curl version 7.82.0 has function Curl_allow_auth_to_host()
|
||||||
|
|
||||||
|
Upstream-Status: Backport [https://github.com/curl/curl/commit/e3d7401a32a46516c9e5ee877]
|
||||||
|
CVE: CVE-2026-3783
|
||||||
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||||
|
---
|
||||||
|
lib/http.c | 1 +
|
||||||
|
tests/data/Makefile.inc | 2 +-
|
||||||
|
tests/data/test2006 | 98 +++++++++++++++++++++++++++++++++++++++++
|
||||||
|
3 files changed, 100 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 tests/data/test2006
|
||||||
|
|
||||||
|
diff --git a/lib/http.c b/lib/http.c
|
||||||
|
index 691091b..6acd537 100644
|
||||||
|
--- a/lib/http.c
|
||||||
|
+++ b/lib/http.c
|
||||||
|
@@ -757,6 +757,7 @@ output_auth_headers(struct Curl_easy *data,
|
||||||
|
if(authstatus->picked == CURLAUTH_BEARER) {
|
||||||
|
/* Bearer */
|
||||||
|
if((!proxy && data->set.str[STRING_BEARER] &&
|
||||||
|
+ Curl_allow_auth_to_host(data) &&
|
||||||
|
!Curl_checkheaders(data, STRCONST("Authorization")))) {
|
||||||
|
auth = "Bearer";
|
||||||
|
result = http_output_bearer(data);
|
||||||
|
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
||||||
|
index ad41a5e..e641cb8 100644
|
||||||
|
--- a/tests/data/Makefile.inc
|
||||||
|
+++ b/tests/data/Makefile.inc
|
||||||
|
@@ -221,7 +221,7 @@ test1916 test1917 test1918 \
|
||||||
|
\
|
||||||
|
test1933 test1934 test1935 test1936 test1937 test1938 test1939 \
|
||||||
|
\
|
||||||
|
-test2000 test2001 test2002 test2003 test2004 \
|
||||||
|
+test2000 test2001 test2002 test2003 test2004 test2006 \
|
||||||
|
\
|
||||||
|
test2023 \
|
||||||
|
test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
|
||||||
|
diff --git a/tests/data/test2006 b/tests/data/test2006
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..200d30a
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/data/test2006
|
||||||
|
@@ -0,0 +1,98 @@
|
||||||
|
+<?xml version="1.0" encoding="US-ASCII"?>
|
||||||
|
+<testcase>
|
||||||
|
+<info>
|
||||||
|
+<keywords>
|
||||||
|
+netrc
|
||||||
|
+HTTP
|
||||||
|
+</keywords>
|
||||||
|
+</info>
|
||||||
|
+# Server-side
|
||||||
|
+<reply>
|
||||||
|
+<data crlf="headers">
|
||||||
|
+HTTP/1.1 301 Follow this you fool
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||||
|
+ETag: "21025-dc7-39462498"
|
||||||
|
+Accept-Ranges: bytes
|
||||||
|
+Content-Length: 6
|
||||||
|
+Connection: close
|
||||||
|
+Location: http://b.com/%TESTNUMBER0002
|
||||||
|
+
|
||||||
|
+-foo-
|
||||||
|
+</data>
|
||||||
|
+
|
||||||
|
+<data2 crlf="headers">
|
||||||
|
+HTTP/1.1 200 OK
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||||
|
+ETag: "21025-dc7-39462498"
|
||||||
|
+Accept-Ranges: bytes
|
||||||
|
+Content-Length: 7
|
||||||
|
+Connection: close
|
||||||
|
+
|
||||||
|
+target
|
||||||
|
+</data2>
|
||||||
|
+
|
||||||
|
+<datacheck crlf="headers">
|
||||||
|
+HTTP/1.1 301 Follow this you fool
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||||
|
+ETag: "21025-dc7-39462498"
|
||||||
|
+Accept-Ranges: bytes
|
||||||
|
+Content-Length: 6
|
||||||
|
+Connection: close
|
||||||
|
+Location: http://b.com/%TESTNUMBER0002
|
||||||
|
+
|
||||||
|
+HTTP/1.1 200 OK
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
|
||||||
|
+ETag: "21025-dc7-39462498"
|
||||||
|
+Accept-Ranges: bytes
|
||||||
|
+Content-Length: 7
|
||||||
|
+Connection: close
|
||||||
|
+
|
||||||
|
+target
|
||||||
|
+</datacheck>
|
||||||
|
+</reply>
|
||||||
|
+
|
||||||
|
+# Client-side
|
||||||
|
+<client>
|
||||||
|
+<server>
|
||||||
|
+http
|
||||||
|
+</server>
|
||||||
|
+<features>
|
||||||
|
+proxy
|
||||||
|
+</features>
|
||||||
|
+<name>
|
||||||
|
+.netrc default with redirect plus oauth2-bearer
|
||||||
|
+</name>
|
||||||
|
+<command>
|
||||||
|
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
|
||||||
|
+</command>
|
||||||
|
+<file name="%LOGDIR/netrc%TESTNUMBER" >
|
||||||
|
+default login testuser password testpass
|
||||||
|
+</file>
|
||||||
|
+</client>
|
||||||
|
+
|
||||||
|
+<verify>
|
||||||
|
+<protocol crlf="headers">
|
||||||
|
+GET http://a.com/ HTTP/1.1
|
||||||
|
+Host: a.com
|
||||||
|
+Authorization: Bearer SECRET_TOKEN
|
||||||
|
+User-Agent: curl/%VERSION
|
||||||
|
+Accept: */*
|
||||||
|
+Proxy-Connection: Keep-Alive
|
||||||
|
+
|
||||||
|
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
|
||||||
|
+Host: b.com
|
||||||
|
+User-Agent: curl/%VERSION
|
||||||
|
+Accept: */*
|
||||||
|
+Proxy-Connection: Keep-Alive
|
||||||
|
+
|
||||||
|
+</protocol>
|
||||||
|
+</verify>
|
||||||
|
+</testcase>
|
||||||
|
--
|
||||||
|
2.25.1
|
||||||
|
|
||||||
@@ -73,6 +73,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
|
|||||||
file://CVE-2025-14524.patch \
|
file://CVE-2025-14524.patch \
|
||||||
file://CVE-2026-1965-1.patch \
|
file://CVE-2026-1965-1.patch \
|
||||||
file://CVE-2026-1965-2.patch \
|
file://CVE-2026-1965-2.patch \
|
||||||
|
file://CVE-2026-3783-pre1.patch \
|
||||||
|
file://CVE-2026-3783.patch \
|
||||||
"
|
"
|
||||||
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
|
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user