diff --git a/SPECS/curl/CVE-2025-0167.patch b/SPECS/curl/CVE-2025-0167.patch deleted file mode 100644 index eaf30708ca8..00000000000 --- a/SPECS/curl/CVE-2025-0167.patch +++ /dev/null @@ -1,38 +0,0 @@ -From eb239c24ea6ab8d2f1f3190572cdc6b646341cb0 Mon Sep 17 00:00:00 2001 -From: Kanishk-Bansal -Date: Thu, 13 Feb 2025 19:53:56 +0000 -Subject: [PATCH] CVE-2025-0167 -Upstream source: https://github.com/curl/curl/commit/0e120c5b925e8ca75d5319e ---- - lib/netrc.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - -diff --git a/lib/netrc.c b/lib/netrc.c -index d5ee3c0..b5002fb 100644 ---- a/lib/netrc.c -+++ b/lib/netrc.c -@@ -309,11 +309,16 @@ static int parsenetrc(struct store_netrc *store, - - out: - Curl_dyn_free(&token); -- if(!retcode && !password && our_login) { -- /* success without a password, set a blank one */ -- password = strdup(""); -- if(!password) -- retcode = 1; /* out of memory */ -+ if(!retcode) { -+ if(!password && our_login) { -+ /* success without a password, set a blank one */ -+ password = strdup(""); -+ if(!password) -+ retcode = 1; /* out of memory */ -+ } -+ else if(!login && !password) -+ /* a default with no credentials */ -+ retcode = NETRC_FILE_MISSING; - } - if(!retcode) { - /* success */ --- -2.45.2 - diff --git a/SPECS/curl/CVE-2025-0665.patch b/SPECS/curl/CVE-2025-0665.patch deleted file mode 100644 index 5b0979fd4cb..00000000000 --- a/SPECS/curl/CVE-2025-0665.patch +++ /dev/null @@ -1,33 +0,0 @@ -From ff5091aa9f73802e894b1cbdf24ab84e103200e2 Mon Sep 17 00:00:00 2001 -From: Andy Pan -Date: Thu, 12 Dec 2024 12:48:56 +0000 -Subject: [PATCH] async-thread: avoid closing eventfd twice - -When employing eventfd for socketpair, there is only one file -descriptor. Closing that fd twice might result in fd corruption. -Thus, we should avoid closing the eventfd twice, following the -pattern in lib/multi.c. - -Fixes #15725 -Closes #15727 -Reported-by: Christian Heusel ---- - lib/asyn-thread.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/asyn-thread.c b/lib/asyn-thread.c -index a58e4b790494..32d496b107cb 100644 ---- a/lib/asyn-thread.c -+++ b/lib/asyn-thread.c -@@ -195,9 +195,11 @@ void destroy_thread_sync_data(struct thread_sync_data *tsd) - * close one end of the socket pair (may be done in resolver thread); - * the other end (for reading) is always closed in the parent thread. - */ -+#ifndef USE_EVENTFD - if(tsd->sock_pair[1] != CURL_SOCKET_BAD) { - wakeup_close(tsd->sock_pair[1]); - } -+#endif - #endif - memset(tsd, 0, sizeof(*tsd)); - } diff --git a/SPECS/curl/CVE-2025-0725.patch b/SPECS/curl/CVE-2025-0725.patch deleted file mode 100644 index 3dce3d91cda..00000000000 --- a/SPECS/curl/CVE-2025-0725.patch +++ /dev/null @@ -1,470 +0,0 @@ -From 83aaf92e0231bccf127a5e55e6b6e57ed58706d1 Mon Sep 17 00:00:00 2001 -From: Kanishk-Bansal -Date: Fri, 14 Feb 2025 05:03:13 +0000 -Subject: [PATCH] CVE-2025-0725 - ---- - docs/INTERNALS.md | 2 +- - lib/content_encoding.c | 274 ++++------------------------------------- - 2 files changed, 25 insertions(+), 251 deletions(-) - -diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md -index ae77f0e..4e42f4f 100644 ---- a/docs/INTERNALS.md -+++ b/docs/INTERNALS.md -@@ -26,7 +26,7 @@ versions of libs and build tools. - - - OpenSSL 0.9.7 - - GnuTLS 3.1.10 -- - zlib 1.1.4 -+ - zlib 1.2.0.4 - - libssh2 1.0 - - c-ares 1.16.0 - - libidn2 2.0.0 -diff --git a/lib/content_encoding.c b/lib/content_encoding.c -index a4b16dd..d7babbf 100644 ---- a/lib/content_encoding.c -+++ b/lib/content_encoding.c -@@ -68,31 +68,13 @@ - - #define DSIZ CURL_MAX_WRITE_SIZE /* buffer size for decompressed data */ - -- - #ifdef HAVE_LIBZ - --/* Comment this out if zlib is always going to be at least ver. 1.2.0.4 -- (doing so will reduce code size slightly). */ --#define OLD_ZLIB_SUPPORT 1 -- --#define GZIP_MAGIC_0 0x1f --#define GZIP_MAGIC_1 0x8b -- --/* gzip flag byte */ --#define ASCII_FLAG 0x01 /* bit 0 set: file probably ASCII text */ --#define HEAD_CRC 0x02 /* bit 1 set: header CRC present */ --#define EXTRA_FIELD 0x04 /* bit 2 set: extra field present */ --#define ORIG_NAME 0x08 /* bit 3 set: original filename present */ --#define COMMENT 0x10 /* bit 4 set: file comment present */ --#define RESERVED 0xE0 /* bits 5..7: reserved */ -- - typedef enum { - ZLIB_UNINIT, /* uninitialized */ - ZLIB_INIT, /* initialized */ - ZLIB_INFLATING, /* inflating started. */ - ZLIB_EXTERNAL_TRAILER, /* reading external trailer */ -- ZLIB_GZIP_HEADER, /* reading gzip header */ -- ZLIB_GZIP_INFLATING, /* inflating gzip stream */ - ZLIB_INIT_GZIP /* initialized in transparent gzip mode */ - } zlibInitState; - -@@ -137,9 +119,6 @@ static CURLcode - exit_zlib(struct Curl_easy *data, - z_stream *z, zlibInitState *zlib_init, CURLcode result) - { -- if(*zlib_init == ZLIB_GZIP_HEADER) -- Curl_safefree(z->next_in); -- - if(*zlib_init != ZLIB_UNINIT) { - if(inflateEnd(z) != Z_OK && result == CURLE_OK) - result = process_zlib_error(data, z); -@@ -188,8 +167,7 @@ static CURLcode inflate_stream(struct Curl_easy *data, - /* Check state. */ - if(zp->zlib_init != ZLIB_INIT && - zp->zlib_init != ZLIB_INFLATING && -- zp->zlib_init != ZLIB_INIT_GZIP && -- zp->zlib_init != ZLIB_GZIP_INFLATING) -+ zp->zlib_init != ZLIB_INIT_GZIP) - return exit_zlib(data, z, &zp->zlib_init, CURLE_WRITE_ERROR); - - /* Dynamically allocate a buffer for decompression because it is uncommonly -@@ -278,7 +256,7 @@ static CURLcode inflate_stream(struct Curl_easy *data, - - /* Deflate handler. */ - static CURLcode deflate_do_init(struct Curl_easy *data, -- struct Curl_cwriter *writer) -+ struct Curl_cwriter *writer) - { - struct zlib_writer *zp = (struct zlib_writer *) writer; - z_stream *z = &zp->z; /* zlib state structure */ -@@ -294,8 +272,8 @@ static CURLcode deflate_do_init(struct Curl_easy *data, - } - - static CURLcode deflate_do_write(struct Curl_easy *data, -- struct Curl_cwriter *writer, int type, -- const char *buf, size_t nbytes) -+ struct Curl_cwriter *writer, int type, -+ const char *buf, size_t nbytes) - { - struct zlib_writer *zp = (struct zlib_writer *) writer; - z_stream *z = &zp->z; /* zlib state structure */ -@@ -315,7 +293,7 @@ static CURLcode deflate_do_write(struct Curl_easy *data, - } - - static void deflate_do_close(struct Curl_easy *data, -- struct Curl_cwriter *writer) -+ struct Curl_cwriter *writer) - { - struct zlib_writer *zp = (struct zlib_writer *) writer; - z_stream *z = &zp->z; /* zlib state structure */ -@@ -335,124 +313,34 @@ static const struct Curl_cwtype deflate_encoding = { - - /* Gzip handler. */ - static CURLcode gzip_do_init(struct Curl_easy *data, -- struct Curl_cwriter *writer) -+ struct Curl_cwriter *writer) - { - struct zlib_writer *zp = (struct zlib_writer *) writer; - z_stream *z = &zp->z; /* zlib state structure */ -+ const char *v = zlibVersion(); - - /* Initialize zlib */ - z->zalloc = (alloc_func) zalloc_cb; - z->zfree = (free_func) zfree_cb; - -- if(strcmp(zlibVersion(), "1.2.0.4") >= 0) { -- /* zlib ver. >= 1.2.0.4 supports transparent gzip decompressing */ -+ if(strcmp(v, "1.2.0.4") >= 0) { -+ /* zlib version >= 1.2.0.4 supports transparent gzip decompressing */ - if(inflateInit2(z, MAX_WBITS + 32) != Z_OK) { - return process_zlib_error(data, z); - } - zp->zlib_init = ZLIB_INIT_GZIP; /* Transparent gzip decompress state */ - } - else { -- /* we must parse the gzip header and trailer ourselves */ -- if(inflateInit2(z, -MAX_WBITS) != Z_OK) { -- return process_zlib_error(data, z); -- } -- zp->trailerlen = 8; /* A CRC-32 and a 32-bit input size (RFC 1952, 2.2) */ -- zp->zlib_init = ZLIB_INIT; /* Initial call state */ -+ failf(data, "too old zlib version: %s", v); -+ return CURLE_FAILED_INIT; - } - - return CURLE_OK; - } - --#ifdef OLD_ZLIB_SUPPORT --/* Skip over the gzip header */ --typedef enum { -- GZIP_OK, -- GZIP_BAD, -- GZIP_UNDERFLOW --} gzip_status; -- --static gzip_status check_gzip_header(unsigned char const *data, ssize_t len, -- ssize_t *headerlen) --{ -- int method, flags; -- const ssize_t totallen = len; -- -- /* The shortest header is 10 bytes */ -- if(len < 10) -- return GZIP_UNDERFLOW; -- -- if((data[0] != GZIP_MAGIC_0) || (data[1] != GZIP_MAGIC_1)) -- return GZIP_BAD; -- -- method = data[2]; -- flags = data[3]; -- -- if(method != Z_DEFLATED || (flags & RESERVED) != 0) { -- /* cannot handle this compression method or unknown flag */ -- return GZIP_BAD; -- } -- -- /* Skip over time, xflags, OS code and all previous bytes */ -- len -= 10; -- data += 10; -- -- if(flags & EXTRA_FIELD) { -- ssize_t extra_len; -- -- if(len < 2) -- return GZIP_UNDERFLOW; -- -- extra_len = (data[1] << 8) | data[0]; -- -- if(len < (extra_len + 2)) -- return GZIP_UNDERFLOW; -- -- len -= (extra_len + 2); -- data += (extra_len + 2); -- } -- -- if(flags & ORIG_NAME) { -- /* Skip over NUL-terminated filename */ -- while(len && *data) { -- --len; -- ++data; -- } -- if(!len || *data) -- return GZIP_UNDERFLOW; -- -- /* Skip over the NUL */ -- --len; -- ++data; -- } -- -- if(flags & COMMENT) { -- /* Skip over NUL-terminated comment */ -- while(len && *data) { -- --len; -- ++data; -- } -- if(!len || *data) -- return GZIP_UNDERFLOW; -- -- /* Skip over the NUL */ -- --len; -- } -- -- if(flags & HEAD_CRC) { -- if(len < 2) -- return GZIP_UNDERFLOW; -- -- len -= 2; -- } -- -- *headerlen = totallen - len; -- return GZIP_OK; --} --#endif -- - static CURLcode gzip_do_write(struct Curl_easy *data, -- struct Curl_cwriter *writer, int type, -- const char *buf, size_t nbytes) -+ struct Curl_cwriter *writer, int type, -+ const char *buf, size_t nbytes) - { - struct zlib_writer *zp = (struct zlib_writer *) writer; - z_stream *z = &zp->z; /* zlib state structure */ -@@ -468,117 +356,8 @@ static CURLcode gzip_do_write(struct Curl_easy *data, - return inflate_stream(data, writer, type, ZLIB_INIT_GZIP); - } - --#ifndef OLD_ZLIB_SUPPORT -- /* Support for old zlib versions is compiled away and we are running with -- an old version, so return an error. */ -+ /* We are running with an old version: return error. */ - return exit_zlib(data, z, &zp->zlib_init, CURLE_WRITE_ERROR); -- --#else -- /* This next mess is to get around the potential case where there is not -- * enough data passed in to skip over the gzip header. If that happens, we -- * malloc a block and copy what we have then wait for the next call. If -- * there still is not enough (this is definitely a worst-case scenario), we -- * make the block bigger, copy the next part in and keep waiting. -- * -- * This is only required with zlib versions < 1.2.0.4 as newer versions -- * can handle the gzip header themselves. -- */ -- -- switch(zp->zlib_init) { -- /* Skip over gzip header? */ -- case ZLIB_INIT: -- { -- /* Initial call state */ -- ssize_t hlen; -- -- switch(check_gzip_header((unsigned char *) buf, nbytes, &hlen)) { -- case GZIP_OK: -- z->next_in = (Bytef *) buf + hlen; -- z->avail_in = (uInt) (nbytes - hlen); -- zp->zlib_init = ZLIB_GZIP_INFLATING; /* Inflating stream state */ -- break; -- -- case GZIP_UNDERFLOW: -- /* We need more data so we can find the end of the gzip header. it is -- * possible that the memory block we malloc here will never be freed if -- * the transfer abruptly aborts after this point. Since it is unlikely -- * that circumstances will be right for this code path to be followed in -- * the first place, and it is even more unlikely for a transfer to fail -- * immediately afterwards, it should seldom be a problem. -- */ -- z->avail_in = (uInt) nbytes; -- z->next_in = malloc(z->avail_in); -- if(!z->next_in) { -- return exit_zlib(data, z, &zp->zlib_init, CURLE_OUT_OF_MEMORY); -- } -- memcpy(z->next_in, buf, z->avail_in); -- zp->zlib_init = ZLIB_GZIP_HEADER; /* Need more gzip header data state */ -- /* We do not have any data to inflate yet */ -- return CURLE_OK; -- -- case GZIP_BAD: -- default: -- return exit_zlib(data, z, &zp->zlib_init, process_zlib_error(data, z)); -- } -- -- } -- break; -- -- case ZLIB_GZIP_HEADER: -- { -- /* Need more gzip header data state */ -- ssize_t hlen; -- z->avail_in += (uInt) nbytes; -- z->next_in = Curl_saferealloc(z->next_in, z->avail_in); -- if(!z->next_in) { -- return exit_zlib(data, z, &zp->zlib_init, CURLE_OUT_OF_MEMORY); -- } -- /* Append the new block of data to the previous one */ -- memcpy(z->next_in + z->avail_in - nbytes, buf, nbytes); -- -- switch(check_gzip_header(z->next_in, (ssize_t)z->avail_in, &hlen)) { -- case GZIP_OK: -- /* This is the zlib stream data */ -- free(z->next_in); -- /* Do not point into the malloced block since we just freed it */ -- z->next_in = (Bytef *) buf + hlen + nbytes - z->avail_in; -- z->avail_in = z->avail_in - (uInt)hlen; -- zp->zlib_init = ZLIB_GZIP_INFLATING; /* Inflating stream state */ -- break; -- -- case GZIP_UNDERFLOW: -- /* We still do not have any data to inflate! */ -- return CURLE_OK; -- -- case GZIP_BAD: -- default: -- return exit_zlib(data, z, &zp->zlib_init, process_zlib_error(data, z)); -- } -- -- } -- break; -- -- case ZLIB_EXTERNAL_TRAILER: -- z->next_in = (Bytef *) buf; -- z->avail_in = (uInt) nbytes; -- return process_trailer(data, zp); -- -- case ZLIB_GZIP_INFLATING: -- default: -- /* Inflating stream state */ -- z->next_in = (Bytef *) buf; -- z->avail_in = (uInt) nbytes; -- break; -- } -- -- if(z->avail_in == 0) { -- /* We do not have any data to inflate; wait until next time */ -- return CURLE_OK; -- } -- -- /* We have parsed the header, now uncompress the data */ -- return inflate_stream(data, writer, type, ZLIB_GZIP_INFLATING); --#endif - } - - static void gzip_do_close(struct Curl_easy *data, -@@ -601,7 +380,6 @@ static const struct Curl_cwtype gzip_encoding = { - - #endif /* HAVE_LIBZ */ - -- - #ifdef HAVE_BROTLI - /* Brotli writer. */ - struct brotli_writer { -@@ -648,7 +426,7 @@ static CURLcode brotli_map_error(BrotliDecoderErrorCode be) - } - - static CURLcode brotli_do_init(struct Curl_easy *data, -- struct Curl_cwriter *writer) -+ struct Curl_cwriter *writer) - { - struct brotli_writer *bp = (struct brotli_writer *) writer; - (void) data; -@@ -658,8 +436,8 @@ static CURLcode brotli_do_init(struct Curl_easy *data, - } - - static CURLcode brotli_do_write(struct Curl_easy *data, -- struct Curl_cwriter *writer, int type, -- const char *buf, size_t nbytes) -+ struct Curl_cwriter *writer, int type, -+ const char *buf, size_t nbytes) - { - struct brotli_writer *bp = (struct brotli_writer *) writer; - const uint8_t *src = (const uint8_t *) buf; -@@ -731,7 +509,6 @@ static const struct Curl_cwtype brotli_encoding = { - }; - #endif - -- - #ifdef HAVE_ZSTD - /* Zstd writer. */ - struct zstd_writer { -@@ -741,7 +518,7 @@ struct zstd_writer { - }; - - static CURLcode zstd_do_init(struct Curl_easy *data, -- struct Curl_cwriter *writer) -+ struct Curl_cwriter *writer) - { - struct zstd_writer *zp = (struct zstd_writer *) writer; - -@@ -753,8 +530,8 @@ static CURLcode zstd_do_init(struct Curl_easy *data, - } - - static CURLcode zstd_do_write(struct Curl_easy *data, -- struct Curl_cwriter *writer, int type, -- const char *buf, size_t nbytes) -+ struct Curl_cwriter *writer, int type, -+ const char *buf, size_t nbytes) - { - CURLcode result = CURLE_OK; - struct zstd_writer *zp = (struct zstd_writer *) writer; -@@ -785,7 +562,7 @@ static CURLcode zstd_do_write(struct Curl_easy *data, - } - if(out.pos > 0) { - result = Curl_cwriter_write(data, writer->next, type, -- zp->decomp, out.pos); -+ zp->decomp, out.pos); - if(result) - break; - } -@@ -823,7 +600,6 @@ static const struct Curl_cwtype zstd_encoding = { - }; - #endif - -- - /* Identity handler. */ - static const struct Curl_cwtype identity_encoding = { - "identity", -@@ -834,7 +610,6 @@ static const struct Curl_cwtype identity_encoding = { - sizeof(struct Curl_cwriter) - }; - -- - /* supported general content decoders. */ - static const struct Curl_cwtype * const general_unencoders[] = { - &identity_encoding, -@@ -898,7 +673,7 @@ void Curl_all_content_encodings(char *buf, size_t blen) - - /* Deferred error dummy writer. */ - static CURLcode error_do_init(struct Curl_easy *data, -- struct Curl_cwriter *writer) -+ struct Curl_cwriter *writer) - { - (void)data; - (void)writer; -@@ -906,8 +681,8 @@ static CURLcode error_do_init(struct Curl_easy *data, - } - - static CURLcode error_do_write(struct Curl_easy *data, -- struct Curl_cwriter *writer, int type, -- const char *buf, size_t nbytes) -+ struct Curl_cwriter *writer, int type, -+ const char *buf, size_t nbytes) - { - (void) writer; - (void) buf; -@@ -1082,5 +857,4 @@ void Curl_all_content_encodings(char *buf, size_t blen) - strcpy(buf, CONTENT_ENCODING_DEFAULT); - } - -- - #endif /* CURL_DISABLE_HTTP */ --- -2.45.2 - diff --git a/SPECS/curl/CVE-2025-10148.patch b/SPECS/curl/CVE-2025-10148.patch deleted file mode 100644 index bbfdb81a387..00000000000 --- a/SPECS/curl/CVE-2025-10148.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 966ee40365d33b352191241506251e2c3c135cd5 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Thu, 11 Sep 2025 15:47:20 +0000 -Subject: [PATCH] ws: get a new mask for each new outgoing - frame\n\nReported-by: Calvin Ruocco\nCloses #18496 - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa.patch ---- - lib/ws.c | 24 ++++++++++++++++-------- - 1 file changed, 16 insertions(+), 8 deletions(-) - -diff --git a/lib/ws.c b/lib/ws.c -index 3d739a5..41565e2 100644 ---- a/lib/ws.c -+++ b/lib/ws.c -@@ -618,6 +618,21 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data, - enc->payload_remain = enc->payload_len = payload_len; - ws_enc_info(enc, data, "sending"); - -+ /* 4 bytes random */ -+ { -+ CURLcode result; -+ result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask)); -+ if(result) { -+ *err = result; -+ return -1; -+ } -+#ifdef DEBUGBUILD -+ if(getenv("CURL_WS_FORCE_ZERO_MASK")) -+ /* force the bit mask to 0x00000000, effectively disabling masking */ -+ memset(&enc->mask, 0, sizeof(enc->mask)); -+#endif -+ } -+ - /* add 4 bytes mask */ - memcpy(&head[hlen], &enc->mask, 4); - hlen += 4; -@@ -808,14 +823,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data, - subprotocol not requested by the client), the client MUST Fail - the WebSocket Connection. */ - -- /* 4 bytes random */ -- -- result = Curl_rand(data, (unsigned char *)&ws->enc.mask, -- sizeof(ws->enc.mask)); -- if(result) -- return result; -- infof(data, "Received 101, switch to WebSocket; mask %02x%02x%02x%02x", -- ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]); -+ infof(data, "[WS] Received 101, switch to WebSocket"); - - /* Install our client writer that decodes WS frames payload */ - result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode, --- -2.45.4 - diff --git a/SPECS/curl/CVE-2025-14017.patch b/SPECS/curl/CVE-2025-14017.patch deleted file mode 100644 index 468c422d429..00000000000 --- a/SPECS/curl/CVE-2025-14017.patch +++ /dev/null @@ -1,117 +0,0 @@ -From 477745dc74450c96f10afdacdcfecac67b50f138 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Fri, 9 Jan 2026 03:55:08 +0000 -Subject: [PATCH] ldap: call ldap_init() before setting the options; set - options on server; adjust CACERTFILE and REQUIRE_CERT; move init earlier and - remove duplicate init; update error message; consistent with upstream patch - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/39d1976b7f709a516e324333.patch ---- - lib/ldap.c | 49 +++++++++++++++++++------------------------------ - 1 file changed, 19 insertions(+), 30 deletions(-) - -diff --git a/lib/ldap.c b/lib/ldap.c -index 2cbdb9c..a1e60b0 100644 ---- a/lib/ldap.c -+++ b/lib/ldap.c -@@ -367,16 +367,29 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - passwd = conn->passwd; - } - -+#ifdef USE_WIN32_LDAP -+ if(ldap_ssl) -+ server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1); -+ else -+#else -+ server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port); -+#endif -+ if(!server) { -+ failf(data, "LDAP: cannot setup connect to %s:%u", -+ conn->host.dispname, conn->primary.remote_port); -+ result = CURLE_COULDNT_CONNECT; -+ goto quit; -+ } -+ - #ifdef LDAP_OPT_NETWORK_TIMEOUT -- ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout); -+ ldap_set_option(server, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout); - #endif -- ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto); -+ ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto); - - if(ldap_ssl) { - #ifdef HAVE_LDAP_SSL - #ifdef USE_WIN32_LDAP - /* Win32 LDAP SDK does not support insecure mode without CA! */ -- server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1); - ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON); - #else - int ldap_option; -@@ -444,7 +457,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - goto quit; - } - infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca); -- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca); -+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca); - if(rc != LDAP_SUCCESS) { - failf(data, "LDAP local: ERROR setting PEM CA cert: %s", - ldap_err2string(rc)); -@@ -456,20 +469,13 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - else - ldap_option = LDAP_OPT_X_TLS_NEVER; - -- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option); -+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option); - if(rc != LDAP_SUCCESS) { - failf(data, "LDAP local: ERROR setting cert verify mode: %s", - ldap_err2string(rc)); - result = CURLE_SSL_CERTPROBLEM; - goto quit; - } -- server = ldap_init(host, conn->primary.remote_port); -- if(!server) { -- failf(data, "LDAP local: Cannot connect to %s:%u", -- conn->host.dispname, conn->primary.remote_port); -- result = CURLE_COULDNT_CONNECT; -- goto quit; -- } - ldap_option = LDAP_OPT_X_TLS_HARD; - rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option); - if(rc != LDAP_SUCCESS) { -@@ -478,15 +484,6 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - result = CURLE_SSL_CERTPROBLEM; - goto quit; - } --/* -- rc = ldap_start_tls_s(server, NULL, NULL); -- if(rc != LDAP_SUCCESS) { -- failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s", -- ldap_err2string(rc)); -- result = CURLE_SSL_CERTPROBLEM; -- goto quit; -- } --*/ - #else - (void)ldap_option; - (void)ldap_ca; -@@ -505,15 +502,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - result = CURLE_NOT_BUILT_IN; - goto quit; - } -- else { -- server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port); -- if(!server) { -- failf(data, "LDAP local: Cannot connect to %s:%u", -- conn->host.dispname, conn->primary.remote_port); -- result = CURLE_COULDNT_CONNECT; -- goto quit; -- } -- } -+ - #ifdef USE_WIN32_LDAP - ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto); - rc = ldap_win_bind(data, server, user, passwd); --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-10536.patch b/SPECS/curl/CVE-2026-10536.patch deleted file mode 100644 index eedb115e307..00000000000 --- a/SPECS/curl/CVE-2026-10536.patch +++ /dev/null @@ -1,339 +0,0 @@ -From 58384112815014d94d5b35ddbe4b96b033224b81 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Wed, 8 Jul 2026 11:01:50 +0000 -Subject: [PATCH] http2: remove stream dependency tracking - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/bfbff7852f050232edd3e5ca.patch ---- - docs/libcurl/curl_easy_setopt.md | 5 +- - docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md | 8 ++ - docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md | 8 ++ - docs/libcurl/symbols-in-versions | 4 +- - include/curl/curl.h | 6 +- - lib/http2.c | 18 ++--- - lib/setopt.c | 9 +- - lib/url.c | 96 ------------------------- - lib/urldata.h | 8 -- - 9 files changed, 34 insertions(+), 128 deletions(-) - -diff --git a/docs/libcurl/curl_easy_setopt.md b/docs/libcurl/curl_easy_setopt.md -index e0fe95c..73e240d 100644 ---- a/docs/libcurl/curl_easy_setopt.md -+++ b/docs/libcurl/curl_easy_setopt.md -@@ -1146,11 +1146,12 @@ Redirect stderr to another stream. See CURLOPT_STDERR(3) - - ## CURLOPT_STREAM_DEPENDS - --This HTTP/2 stream depends on another. See CURLOPT_STREAM_DEPENDS(3) -+**Deprecated option** This HTTP/2 stream depends on another. See -+CURLOPT_STREAM_DEPENDS(3) - - ## CURLOPT_STREAM_DEPENDS_E - --This HTTP/2 stream depends on another exclusively. See -+**Deprecated option** This HTTP/2 stream depends on another exclusively. See - CURLOPT_STREAM_DEPENDS_E(3) - - ## CURLOPT_STREAM_WEIGHT -diff --git a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md -index 1429de1..4fc90b8 100644 ---- a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md -+++ b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md -@@ -44,6 +44,10 @@ an error. It must be another easy handle, and it also needs to be a handle of - a transfer that is about to be sent over the same HTTP/2 connection for this - option to have an actual effect. - -+Since version 8.21.0 setting this option no longer has an effect. HTTP/2 -+stream dependencies were introduced in RFC 7540 and then later deprecated -+in RFC 9113. -+ - # DEFAULT - - NULL -@@ -69,6 +73,10 @@ int main(void) - } - ~~~ - -+# DEPRECATED -+ -+Deprecated since 8.21.0. -+ - # %AVAILABILITY% - - # RETURN VALUE -diff --git a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md -index bddfead..0e85b72 100644 ---- a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md -+++ b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md -@@ -47,6 +47,10 @@ an error. It must be another easy handle, and it also needs to be a handle of - a transfer that is about to be sent over the same HTTP/2 connection for this - option to have an actual effect. - -+Since version 8.21.0 setting this option no longer has an effect. HTTP/2 -+stream dependencies were introduced in RFC 7540 and then later deprecated -+in RFC 9113. -+ - # DEFAULT - - NULL -@@ -72,6 +76,10 @@ int main(void) - } - ~~~ - -+# DEPRECATED -+ -+Deprecated since 8.21.0. -+ - # %AVAILABILITY% - - # RETURN VALUE -diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions -index ddda26d..b56527b 100644 ---- a/docs/libcurl/symbols-in-versions -+++ b/docs/libcurl/symbols-in-versions -@@ -858,8 +858,8 @@ CURLOPT_SSLKEYPASSWD 7.9.3 7.17.0 - CURLOPT_SSLKEYTYPE 7.9.3 - CURLOPT_SSLVERSION 7.1 - CURLOPT_STDERR 7.1 --CURLOPT_STREAM_DEPENDS 7.46.0 --CURLOPT_STREAM_DEPENDS_E 7.46.0 -+CURLOPT_STREAM_DEPENDS 7.46.0 8.21.0 -+CURLOPT_STREAM_DEPENDS_E 7.46.0 8.21.0 - CURLOPT_STREAM_WEIGHT 7.46.0 - CURLOPT_SUPPRESS_CONNECT_HEADERS 7.54.0 - CURLOPT_TCP_FASTOPEN 7.49.0 -diff --git a/include/curl/curl.h b/include/curl/curl.h -index 1883558..8e04952 100644 ---- a/include/curl/curl.h -+++ b/include/curl/curl.h -@@ -1960,10 +1960,12 @@ typedef enum { - CURLOPT(CURLOPT_STREAM_WEIGHT, CURLOPTTYPE_LONG, 239), - - /* Set stream dependency on another CURL handle */ -- CURLOPT(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240), -+ CURLOPTDEPRECATED(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240, -+ 8.21.0, "Has no function"), - - /* Set E-xclusive stream dependency on another CURL handle */ -- CURLOPT(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241), -+ CURLOPTDEPRECATED(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241, -+ 8.21.0, "Has no function"), - - /* Do not send any tftp option requests to the server */ - CURLOPT(CURLOPT_TFTP_NO_OPTIONS, CURLOPTTYPE_LONG, 242), -diff --git a/lib/http2.c b/lib/http2.c -index ef29686..2871c3d 100644 ---- a/lib/http2.c -+++ b/lib/http2.c -@@ -1872,16 +1872,12 @@ static int sweight_in_effect(const struct Curl_easy *data) - * struct. - */ - --static void h2_pri_spec(struct cf_h2_ctx *ctx, -- struct Curl_easy *data, -+static void h2_pri_spec(struct Curl_easy *data, - nghttp2_priority_spec *pri_spec) - { - struct Curl_data_priority *prio = &data->set.priority; -- struct h2_stream_ctx *depstream = H2_STREAM_CTX(ctx, prio->parent); -- int32_t depstream_id = depstream ? depstream->id : 0; -- nghttp2_priority_spec_init(pri_spec, depstream_id, -- sweight_wanted(data), -- data->set.priority.exclusive); -+ nghttp2_priority_spec_init(pri_spec, 0, -+ sweight_wanted(data), FALSE); - data->state.priority = *prio; - } - -@@ -1899,13 +1895,11 @@ static CURLcode h2_progress_egress(struct Curl_cfilter *cf, - int rv = 0; - - if(stream && stream->id > 0 && -- ((sweight_wanted(data) != sweight_in_effect(data)) || -- (data->set.priority.exclusive != data->state.priority.exclusive) || -- (data->set.priority.parent != data->state.priority.parent)) ) { -+ (sweight_wanted(data) != sweight_in_effect(data))) { - /* send new weight and/or dependency */ - nghttp2_priority_spec pri_spec; - -- h2_pri_spec(ctx, data, &pri_spec); -+ h2_pri_spec(data, &pri_spec); - CURL_TRC_CF(data, cf, "[%d] Queuing PRIORITY", stream->id); - DEBUGASSERT(stream->id != -1); - rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE, -@@ -2210,7 +2205,7 @@ static ssize_t h2_submit(struct h2_stream_ctx **pstream, - goto out; - } - -- h2_pri_spec(ctx, data, &pri_spec); -+ h2_pri_spec(data, &pri_spec); - if(!nghttp2_session_check_request_allowed(ctx->h2)) - CURL_TRC_CF(data, cf, "send request NOT allowed (via nghttp2)"); - -diff --git a/lib/setopt.c b/lib/setopt.c -index 1ab0d1e..6b8cbb3 100644 ---- a/lib/setopt.c -+++ b/lib/setopt.c -@@ -1652,13 +1652,10 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option, - - #ifdef USE_HTTP2 - case CURLOPT_STREAM_DEPENDS: -- case CURLOPT_STREAM_DEPENDS_E: { -- struct Curl_easy *dep = va_arg(param, struct Curl_easy *); -- if(!dep || GOOD_EASY_HANDLE(dep)) -- return Curl_data_priority_add_child(dep, data, -- option == CURLOPT_STREAM_DEPENDS_E); -+ case CURLOPT_STREAM_DEPENDS_E: -+ /* not doing stream dependencies any longer, but accept options -+ * for backward compatibility */ - break; -- } - #endif - - default: -diff --git a/lib/url.c b/lib/url.c -index cd8dbcc..7923485 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -130,12 +130,6 @@ - #define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0])) - #endif - --#ifdef USE_NGHTTP2 --static void data_priority_cleanup(struct Curl_easy *data); --#else --#define data_priority_cleanup(x) --#endif -- - /* Some parts of the code (e.g. chunked encoding) assume this buffer has at - * more than just a few bytes to play with. Do not let it become too small or - * bad things will happen. -@@ -298,7 +292,6 @@ CURLcode Curl_close(struct Curl_easy **datap) - Curl_resolver_cancel(data); - Curl_resolver_cleanup(data->state.async.resolver); - -- data_priority_cleanup(data); - - /* No longer a dirty share, if it exists */ - if(data->share) { -@@ -3957,96 +3949,7 @@ CURLcode Curl_init_do(struct Curl_easy *data, struct connectdata *conn) - - #if defined(USE_HTTP2) || defined(USE_HTTP3) - --#ifdef USE_NGHTTP2 -- --static void priority_remove_child(struct Curl_easy *parent, -- struct Curl_easy *child) --{ -- struct Curl_data_prio_node **pnext = &parent->set.priority.children; -- struct Curl_data_prio_node *pnode = parent->set.priority.children; -- -- DEBUGASSERT(child->set.priority.parent == parent); -- while(pnode && pnode->data != child) { -- pnext = &pnode->next; -- pnode = pnode->next; -- } -- -- DEBUGASSERT(pnode); -- if(pnode) { -- *pnext = pnode->next; -- free(pnode); -- } -- -- child->set.priority.parent = 0; -- child->set.priority.exclusive = FALSE; --} -- --CURLcode Curl_data_priority_add_child(struct Curl_easy *parent, -- struct Curl_easy *child, -- bool exclusive) --{ -- if(child->set.priority.parent) { -- priority_remove_child(child->set.priority.parent, child); -- } -- -- if(parent) { -- struct Curl_data_prio_node **tail; -- struct Curl_data_prio_node *pnode; -- -- pnode = calloc(1, sizeof(*pnode)); -- if(!pnode) -- return CURLE_OUT_OF_MEMORY; -- pnode->data = child; -- -- if(parent->set.priority.children && exclusive) { -- /* exclusive: move all existing children underneath the new child */ -- struct Curl_data_prio_node *node = parent->set.priority.children; -- while(node) { -- node->data->set.priority.parent = child; -- node = node->next; -- } -- -- tail = &child->set.priority.children; -- while(*tail) -- tail = &(*tail)->next; -- -- DEBUGASSERT(!*tail); -- *tail = parent->set.priority.children; -- parent->set.priority.children = 0; -- } -- -- tail = &parent->set.priority.children; -- while(*tail) { -- (*tail)->data->set.priority.exclusive = FALSE; -- tail = &(*tail)->next; -- } -- -- DEBUGASSERT(!*tail); -- *tail = pnode; -- } -- -- child->set.priority.parent = parent; -- child->set.priority.exclusive = exclusive; -- return CURLE_OK; --} -- --#endif /* USE_NGHTTP2 */ -- --#ifdef USE_NGHTTP2 --static void data_priority_cleanup(struct Curl_easy *data) --{ -- while(data->set.priority.children) { -- struct Curl_easy *tmp = data->set.priority.children->data; -- priority_remove_child(data, tmp); -- if(data->set.priority.parent) -- Curl_data_priority_add_child(data->set.priority.parent, tmp, FALSE); -- } -- -- if(data->set.priority.parent) -- priority_remove_child(data->set.priority.parent, data); --} --#endif - - void Curl_data_priority_clear_state(struct Curl_easy *data) - { - memset(&data->state.priority, 0, sizeof(data->state.priority)); -diff --git a/lib/urldata.h b/lib/urldata.h -index 9d4c33a..f12958d 100644 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -1145,15 +1145,7 @@ struct Curl_data_prio_node { - * TODO: we need to adapt it to the new priority scheme as defined in RFC 9218 - */ - struct Curl_data_priority { --#ifdef USE_NGHTTP2 -- /* tree like dependencies only implemented in nghttp2 */ -- struct Curl_easy *parent; -- struct Curl_data_prio_node *children; --#endif - int weight; --#ifdef USE_NGHTTP2 -- BIT(exclusive); --#endif - }; - - /* Timers */ --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-12064.patch b/SPECS/curl/CVE-2026-12064.patch deleted file mode 100644 index ffdda5d09c2..00000000000 --- a/SPECS/curl/CVE-2026-12064.patch +++ /dev/null @@ -1,237 +0,0 @@ -From 649a7aa2d45f2a8abb1bac38edcceeccca44bc7e Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Tue, 7 Jul 2026 07:14:08 +0000 -Subject: [PATCH] config2setopts: use default protocol properly - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e.patch ---- - docs/cmdline-opts/proto-default.md | 6 +++- - src/tool_operate.c | 39 +++++++++++++++++++++---------- - tests/data/Makefile.am | 4 +- - tests/data/test1724 | 53 +++++++++++++++++++++++++++++++++++++++ - tests/data/test1725 | 29 +++++++++++++++++++++++ - tests/data/test2036 | 26 +++++++++++++++++++++ - 6 files changed, 144 insertions(+), 16 deletions(-) - create mode 100644 tests/data/test1724 - create mode 100644 tests/data/test1725 - create mode 100644 tests/data/test2036 - -diff --git a/docs/cmdline-opts/proto-default.md b/docs/cmdline-opts/proto-default.md -index 209e5cdc83da..903fac73a5e5 100644 ---- a/docs/cmdline-opts/proto-default.md -+++ b/docs/cmdline-opts/proto-default.md -@@ -16,7 +16,8 @@ Example: - - # `--proto-default` - --Use *protocol* for any provided URL missing a scheme. -+Use *protocol* for any provided URL missing a scheme. The case-insensitive -+name should be given without any `://` suffix. - - An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*. - -@@ -24,3 +25,6 @@ This option does not change the default proxy protocol (http). - - Without this option set, curl guesses protocol based on the hostname, see - --url for details. -+ -+The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to -+be used explicitly in the URL. -diff --git a/src/tool_operate.c b/src/tool_operate.c -index 2309495..aad4c01 100644 ---- a/src/tool_operate.c -+++ b/src/tool_operate.c -@@ -790,15 +790,31 @@ static CURLcode url_proto_and_rewrite(char **url, - DEBUGASSERT(url && *url); - if(uh) { - char *schemep = NULL; -- if(!curl_url_set(uh, CURLUPART_URL, *url, -- CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) && -- !curl_url_get(uh, CURLUPART_SCHEME, &schemep, -- CURLU_DEFAULT_SCHEME)) { --#ifdef CURL_DISABLE_IPFS -- (void)config; --#else -- if(curl_strequal(schemep, proto_ipfs) || -- curl_strequal(schemep, proto_ipns)) { -+ CURLUcode uc = -+ curl_url_set(uh, CURLUPART_URL, *url, -+ CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME); -+ if(!uc) { -+ if(config->proto_default) { -+ /* when a default proto is requested, do not guess */ -+ uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep, -+ CURLU_NO_GUESS_SCHEME); -+ if(uc == CURLUE_NO_SCHEME) { -+ /* use the default */ -+ proto = proto_token(config->proto_default); -+ if(proto) -+ uc = CURLUE_OK; -+ } -+ } -+ else { -+ uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep, -+ CURLU_DEFAULT_SCHEME); -+ } -+ if(schemep) -+ proto = proto_token(schemep); -+#ifndef CURL_DISABLE_IPFS -+ if(!uc && -+ (curl_strequal(schemep, proto_ipfs) || -+ curl_strequal(schemep, proto_ipns))) { - result = ipfs_url_rewrite(uh, schemep, url, config); - /* short-circuit proto_token, we know it is ipfs or ipns */ - if(curl_strequal(schemep, proto_ipfs)) -@@ -808,10 +824,9 @@ static CURLcode url_proto_and_rewrite(char **url, - if(result) - config->synthetic_error = TRUE; - } -- else - #endif /* !CURL_DISABLE_IPFS */ -- proto = proto_token(schemep); -- -+ if(uc == CURLUE_OUT_OF_MEMORY) -+ result = CURLE_OUT_OF_MEMORY; - curl_free(schemep); - } - curl_url_cleanup(uh); -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index e7a0b22..c11922d 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -228,1 +228,1 @@ --test1708 test1709 test1710 \ -+test1708 test1709 test1710 test1724 test1725 \ -@@ -245,1 +245,1 @@ --test2032 test2033 test2034 test2035 test2037 test2038 test2039 \ -+test2032 test2033 test2034 test2035 test2036 test2037 test2038 test2039 \ -diff --git a/tests/data/test1724 b/tests/data/test1724 -new file mode 100644 -index 0000000..3cd328e ---- /dev/null -+++ b/tests/data/test1724 -@@ -0,0 +1,53 @@ -+ -+ -+ -+ -+IPFS -+ -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 21 -+Connection: close -+Content-Type: text/plain -+Funny-head: yesyes -+ -+Hello curl from IPFS -+ -+ -+ -+# Client-side -+ -+ -+ipfs -+ -+ -+http -+ -+ -+IPFS with --proto-default HTTP -+ -+ -+--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1 -+Host: %HOSTIP:%HTTPPORT -+User-Agent: curl/%VERSION -+Accept: */* -+ -+ -+ -+ -diff --git a/tests/data/test1725 b/tests/data/test1725 -new file mode 100644 -index 0000000..2a882c7 ---- /dev/null -+++ b/tests/data/test1725 -@@ -0,0 +1,29 @@ -+ -+ -+ -+ -+SCP -+server key check -+ -+ -+ -+# Client-side -+ -+ -+scp -+ -+ -+SCP incorrect host key with --proto-default SCP -+ -+ -+--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+60 -+ -+ -+ -diff --git a/tests/data/test2036 b/tests/data/test2036 -new file mode 100644 -index 0000000..b017a71 ---- /dev/null -+++ b/tests/data/test2036 -@@ -0,0 +1,26 @@ -+ -+ -+ -+ -+--proto-default -+ -+ -+ -+# Client-side -+ -+ -+Attempt to set a default protocol with :// suffix -+ -+ -+--proto-default https:// -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+# CURLE_UNSUPPORTED_PROTOCOL is error code 1 -+ -+1 -+ -+ -+ --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-1965.patch b/SPECS/curl/CVE-2026-1965.patch deleted file mode 100644 index 80b794851ec..00000000000 --- a/SPECS/curl/CVE-2026-1965.patch +++ /dev/null @@ -1,139 +0,0 @@ -From 441e8ee4df3e576bf23c30eb31b9fef8c55f5663 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Thu, 12 Mar 2026 11:59:23 +0000 -Subject: [PATCH] url: fix reuse of connections using HTTP Negotiate; - Follow-up: fix copy+paste mistake in url_match_auth_nego - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/34fa034d9a390c4bd65e2d05262755ec8646ac12.patch https://github.com/curl/curl/commit/f1a39f221d57354990e3eeeddc3404aede2aff70.patch ---- - lib/url.c | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++---- - 1 file changed, 85 insertions(+), 5 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index 436edd8..d62eefa 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -853,6 +853,8 @@ struct url_conn_match { - BIT(may_multiplex); - BIT(want_ntlm_http); - BIT(want_proxy_ntlm_http); -+ BIT(want_nego_http); -+ BIT(want_proxy_nego_http); - - BIT(wait_pipe); - BIT(force_reuse); -@@ -861,6 +863,64 @@ struct url_conn_match { - BIT(seen_multiplex_conn); - }; - -+#if defined(USE_SPNEGO) -+static bool url_match_auth_nego(struct connectdata *conn, -+ struct url_conn_match *m) -+{ -+ /* If we are looking for an HTTP+Negotiate connection, check if this is -+ already authenticating with the right credentials. If not, keep looking -+ so that we can reuse Negotiate connections if possible. */ -+ if(m->want_nego_http) { -+ if(Curl_timestrcmp(m->needle->user, conn->user) || -+ Curl_timestrcmp(m->needle->passwd, conn->passwd)) -+ return FALSE; -+ } -+ else if(conn->http_negotiate_state != GSS_AUTHNONE) { -+ /* Connection is using Negotiate auth but we do not want Negotiate */ -+ return FALSE; -+ } -+ -+#ifndef CURL_DISABLE_PROXY -+ /* Same for Proxy Negotiate authentication */ -+ if(m->want_proxy_nego_http) { -+ /* Both conn->http_proxy.user and conn->http_proxy.passwd can be -+ * NULL */ -+ if(!conn->http_proxy.user || !conn->http_proxy.passwd) -+ return FALSE; -+ -+ if(Curl_timestrcmp(m->needle->http_proxy.user, -+ conn->http_proxy.user) || -+ Curl_timestrcmp(m->needle->http_proxy.passwd, -+ conn->http_proxy.passwd)) -+ return FALSE; -+ } -+ else if(conn->proxy_negotiate_state != GSS_AUTHNONE) { -+ /* Proxy connection is using Negotiate auth but we do not want Negotiate */ -+ return FALSE; -+ } -+#endif -+ if(m->want_nego_http || m->want_proxy_nego_http) { -+ /* Credentials are already checked, we may use this connection. We MUST -+ * use a connection where it has already been fully negotiated. If it has -+ * not, we keep on looking for a better one. */ -+ m->found = conn; -+ if((m->want_nego_http && -+ (conn->http_negotiate_state != GSS_AUTHNONE)) || -+ (m->want_proxy_nego_http && -+ (conn->proxy_negotiate_state != GSS_AUTHNONE))) { -+ /* We must use this connection, no other */ -+ m->force_reuse = TRUE; -+ return TRUE; -+ } -+ return FALSE; /* get another */ -+ } -+ return TRUE; -+} -+#else -+#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE) -+#endif -+ -+ - static bool url_match_conn(struct connectdata *conn, void *userdata) - { - struct url_conn_match *match = userdata; -@@ -1156,6 +1216,13 @@ static bool url_match_conn(struct connectdata *conn, void *userdata) - * If it has not, we keep on looking for a better one. */ - match->found = conn; - -+ -+ if(!url_match_auth_nego(conn, match)) -+ return FALSE; -+ else if(match->force_reuse) -+ return TRUE; -+ -+ - if((match->want_ntlm_http && - (conn->http_ntlm_state != NTLMSTATE_NONE)) || - (match->want_proxy_ntlm_http && -@@ -1251,13 +1318,26 @@ ConnectionExists(struct Curl_easy *data, - match.may_multiplex = xfer_may_multiplex(data, needle); - - #ifdef USE_NTLM -- match.want_ntlm_http = ((data->state.authhost.want & CURLAUTH_NTLM) && -- (needle->handler->protocol & PROTO_FAMILY_HTTP)); -+ match.want_ntlm_http = -+ (data->state.authhost.want & CURLAUTH_NTLM) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); - #ifndef CURL_DISABLE_PROXY - match.want_proxy_ntlm_http = -- (needle->bits.proxy_user_passwd && -- (data->state.authproxy.want & CURLAUTH_NTLM) && -- (needle->handler->protocol & PROTO_FAMILY_HTTP)); -+ needle->bits.proxy_user_passwd && -+ (data->state.authproxy.want & CURLAUTH_NTLM) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); -+#endif -+#endif -+ -+#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO) -+ match.want_nego_http = -+ (data->state.authhost.want & CURLAUTH_NEGOTIATE) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); -+#ifndef CURL_DISABLE_PROXY -+ match.want_proxy_nego_http = -+ needle->bits.proxy_user_passwd && -+ (data->state.authproxy.want & CURLAUTH_NEGOTIATE) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); - #endif - #endif - --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-3783.patch b/SPECS/curl/CVE-2026-3783.patch deleted file mode 100644 index 2b532a1c318..00000000000 --- a/SPECS/curl/CVE-2026-3783.patch +++ /dev/null @@ -1,149 +0,0 @@ -From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Fri, 6 Mar 2026 23:13:07 +0100 -Subject: [PATCH] http: only send bearer if auth is allowed - -Verify with test 2006 - -Closes #20843 - -Upstream Patch reference: https://github.com/curl/curl/commit/e3d7401a32a46516c9e5ee877e613e62ed35bddc.patch ---- - lib/http.c | 1 + - tests/data/Makefile.am | 2 +- - tests/data/test2006 | 98 ++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 100 insertions(+), 1 deletion(-) - create mode 100644 tests/data/test2006 - -diff --git a/lib/http.c b/lib/http.c -index 35e7085..4de1667 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -650,6 +650,7 @@ output_auth_headers(struct Curl_easy *data, - if(authstatus->picked == CURLAUTH_BEARER) { - /* Bearer */ - if((!proxy && data->set.str[STRING_BEARER] && -+ Curl_auth_allowed_to_host(data) && - !Curl_checkheaders(data, STRCONST("Authorization")))) { - auth = "Bearer"; - result = http_output_bearer(data); -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 776b593..26e015f 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -238,7 +238,7 @@ test1941 test1942 test1943 test1944 test1945 test1946 test1947 test1948 \ - test1955 test1956 test1957 test1958 test1959 test1960 test1964 \ - test1970 test1971 test1972 test1973 test1974 test1975 test1976 \ - \ --test2000 test2001 test2002 test2003 test2004 \ -+test2000 test2001 test2002 test2003 test2004 test2006 \ - \ - test2023 \ - test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \ -diff --git a/tests/data/test2006 b/tests/data/test2006 -new file mode 100644 -index 0000000..4b8b269 ---- /dev/null -+++ b/tests/data/test2006 -@@ -0,0 +1,98 @@ -+ -+ -+ -+ -+netrc -+HTTP -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 301 Follow this you fool -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 6 -+Connection: close -+Location: http://b.com/%TESTNUMBER0002 -+ -+-foo- -+ -+ -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 7 -+Connection: close -+ -+target -+ -+ -+ -+HTTP/1.1 301 Follow this you fool -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 6 -+Connection: close -+Location: http://b.com/%TESTNUMBER0002 -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 7 -+Connection: close -+ -+target -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+ -+proxy -+ -+ -+.netrc default with redirect plus oauth2-bearer -+ -+ -+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/ -+ -+ -+default login testuser password testpass -+ -+ -+ -+ -+ -+GET http://a.com/ HTTP/1.1 -+Host: a.com -+Authorization: Bearer SECRET_TOKEN -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://b.com/%TESTNUMBER0002 HTTP/1.1 -+Host: b.com -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ --- -2.43.0 - diff --git a/SPECS/curl/CVE-2026-3784.patch b/SPECS/curl/CVE-2026-3784.patch deleted file mode 100644 index 1beb78b5fc7..00000000000 --- a/SPECS/curl/CVE-2026-3784.patch +++ /dev/null @@ -1,166 +0,0 @@ -From 184dadb0109bf038832b9f5d4d49aa757e52d41a Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Thu, 12 Mar 2026 12:18:02 +0000 -Subject: [PATCH] proxy-auth: additional tests - -Also eliminate the special handling for socks proxy match. - -Closes #20837 - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/5f13a7645e565c5c1a06f3ef86e97afb856fb364.patch ---- - lib/url.c | 30 ++++++++---------------------- - tests/http/test_13_proxy_auth.py | 20 ++++++++++++++++++++ - tests/http/testenv/curl.py | 18 +++++++++++++++--- - 3 files changed, 43 insertions(+), 25 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index d62eefa..88f559a 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -678,30 +678,16 @@ proxy_info_matches(const struct proxy_info *data, - { - if((data->proxytype == needle->proxytype) && - (data->port == needle->port) && -- strcasecompare(data->host.name, needle->host.name)) -- return TRUE; -+ strcasecompare(data->host.name, needle->host.name)) { - -+ if(Curl_timestrcmp(data->user, needle->user) || -+ Curl_timestrcmp(data->passwd, needle->passwd)) -+ return FALSE; -+ return TRUE; -+ } - return FALSE; - } - --static bool --socks_proxy_info_matches(const struct proxy_info *data, -- const struct proxy_info *needle) --{ -- if(!proxy_info_matches(data, needle)) -- return FALSE; -- -- /* the user information is case-sensitive -- or at least it is not defined as case-insensitive -- see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */ -- -- /* curl_strequal does a case insensitive comparison, -- so do not use it here! */ -- if(Curl_timestrcmp(data->user, needle->user) || -- Curl_timestrcmp(data->passwd, needle->passwd)) -- return FALSE; -- return TRUE; --} - #else - /* disabled, will not get called */ - #define proxy_info_matches(x,y) FALSE -@@ -1032,8 +1018,8 @@ static bool url_match_conn(struct connectdata *conn, void *userdata) - return FALSE; - - if(needle->bits.socksproxy && -- !socks_proxy_info_matches(&needle->socks_proxy, -- &conn->socks_proxy)) -+ !proxy_info_matches(&needle->socks_proxy, -+ &conn->socks_proxy)) - return FALSE; - - if(needle->bits.httpproxy) { -diff --git a/tests/http/test_13_proxy_auth.py b/tests/http/test_13_proxy_auth.py -index 0979fbb..f2cda54 100644 ---- a/tests/http/test_13_proxy_auth.py -+++ b/tests/http/test_13_proxy_auth.py -@@ -152,3 +152,23 @@ class TestProxyAuth: - protocol='HTTP/2' if proto == 'h2' else 'HTTP/1.1') - assert self.get_tunnel_proto_used(r) == 'HTTP/2' \ - if tunnel == 'h2' else 'HTTP/1.1' -+ -+ def test_13_10_tunnels_mixed_auth(self, env: Env, httpd, configures_httpd): -+ self.httpd_configure(env, httpd) -+ curl = CurlClient(env=env) -+ url1 = f'http://localhost:{env.http_port}/data.json?1' -+ url2 = f'http://localhost:{env.http_port}/data.json?2' -+ url3 = f'http://localhost:{env.http_port}/data.json?3' -+ xargs1 = curl.get_proxy_args(proxys=False, tunnel=True) -+ xargs1.extend(['--proxy-user', 'proxy:proxy']) # good auth -+ xargs2 = curl.get_proxy_args(proxys=False, tunnel=True) -+ xargs2.extend(['--proxy-user', 'ungood:ungood']) # bad auth -+ xargs3 = curl.get_proxy_args(proxys=False, tunnel=True) -+ # no auth -+ r = curl.http_download(urls=[url1, url2, url3], alpn_proto='http/1.1', with_stats=True, -+ url_options={url1: xargs1, url2: xargs2, url3: xargs3}) -+ # only url1 succeeds, others fail, no connection reuse -+ assert r.stats[0]['http_code'] == 200, f'{r.dump_logs()}' -+ assert r.stats[1]['http_code'] == 0, f'{r.dump_logs()}' -+ assert r.stats[2]['http_code'] == 0, f'{r.dump_logs()}' -+ assert r.total_connects == 3, f'{r.dump_logs()}' -diff --git a/tests/http/testenv/curl.py b/tests/http/testenv/curl.py -index ee224d9..d4c3874 100644 ---- a/tests/http/testenv/curl.py -+++ b/tests/http/testenv/curl.py -@@ -539,7 +539,8 @@ class CurlClient: - with_profile: bool = False, - with_tcpdump: bool = False, - no_save: bool = False, -- extra_args: Optional[List[str]] = None): -+ extra_args: Optional[List[str]] = None, -+ url_options: Optional[Dict[str,List[str]]] = None): - if extra_args is None: - extra_args = [] - if no_save: -@@ -559,6 +560,7 @@ class CurlClient: - ]) - return self._raw(urls, alpn_proto=alpn_proto, options=extra_args, - with_stats=with_stats, -+ url_options=url_options, - with_headers=with_headers, - with_profile=with_profile, - with_tcpdump=with_tcpdump) -@@ -820,6 +822,7 @@ class CurlClient: - - def _raw(self, urls, intext='', timeout=None, options=None, insecure=False, - alpn_proto: Optional[str] = None, -+ url_options=None, - force_resolve=True, - with_stats=False, - with_headers=True, -@@ -829,7 +832,8 @@ class CurlClient: - args = self._complete_args( - urls=urls, timeout=timeout, options=options, insecure=insecure, - alpn_proto=alpn_proto, force_resolve=force_resolve, -- with_headers=with_headers, def_tracing=def_tracing) -+ with_headers=with_headers, def_tracing=def_tracing, -+ url_options=url_options) - r = self._run(args, intext=intext, with_stats=with_stats, - with_profile=with_profile, with_tcpdump=with_tcpdump) - if r.exit_code == 0 and with_headers: -@@ -839,8 +843,10 @@ class CurlClient: - def _complete_args(self, urls, timeout=None, options=None, - insecure=False, force_resolve=True, - alpn_proto: Optional[str] = None, -+ url_options=None, - with_headers: bool = True, - def_tracing: bool = True): -+ url_sep = [] - if not isinstance(urls, list): - urls = [urls] - -@@ -860,7 +866,13 @@ class CurlClient: - active_options = options[options.index('--next') + 1:] - - for url in urls: -- u = urlparse(urls[0]) -+ args.extend(url_sep) -+ if url_options is not None: -+ url_sep = ['--next'] -+ -+ u = urlparse(url) -+ if url_options is not None and url in url_options: -+ args.extend(url_options[url]) - if options: - args.extend(options) - if alpn_proto is not None: --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-4873.patch b/SPECS/curl/CVE-2026-4873.patch deleted file mode 100644 index bf741552be8..00000000000 --- a/SPECS/curl/CVE-2026-4873.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 27418ff376aa27a2b57aa2c1cd2bdd0397836116 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Tue, 24 Mar 2026 08:35:08 +0100 -Subject: [PATCH] url: do not reuse a non-tls starttls connection if new - requires TLS - -Reported-by: Arkadi Vainbrand - -Closes #21082 - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865.patch ---- - lib/url.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/lib/url.c b/lib/url.c -index 88f559a..2ba5311 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -841,7 +841,7 @@ struct url_conn_match { - BIT(want_proxy_ntlm_http); - BIT(want_nego_http); - BIT(want_proxy_nego_http); -- -+ BIT(req_tls); /* require TLS use from a clear-text start */ - BIT(wait_pipe); - BIT(force_reuse); - BIT(seen_pending_conn); -@@ -900,6 +900,9 @@ static bool url_match_auth_nego(struct connectdata *conn, - } - return FALSE; /* get another */ - } -+ else if(m->req_tls) -+ /* a clear-text STARTTLS protocol with required TLS */ -+ return FALSE; - return TRUE; - } - #else -@@ -1326,6 +1329,7 @@ ConnectionExists(struct Curl_easy *data, - (needle->handler->protocol & PROTO_FAMILY_HTTP); - #endif - #endif -+ match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; - - /* Find a connection in the pool that matches what "data + needle" - * requires. If a suitable candidate is found, it is attached to "data". */ --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-5545.patch b/SPECS/curl/CVE-2026-5545.patch deleted file mode 100644 index 5a4541f5b6b..00000000000 --- a/SPECS/curl/CVE-2026-5545.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 33e43985b8f3b9e66691d06e70be0395849856cd Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Thu, 2 Apr 2026 11:33:39 +0200 -Subject: [PATCH] url: improve connection reuse on negotiate - -Check state of negotiate to allow proper connection reuse. - -Closes #21203 -Upstream Patch Reference: https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd.patch -https://launchpadlibrarian.net/859770351/curl_8.14.1-2ubuntu1.2_8.14.1-2ubuntu1.3.diff.gz ---- - lib/url.c | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index 6ea7b30..984b8db 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -1166,11 +1166,17 @@ static bool url_match_conn(struct connectdata *conn, void *userdata) - if(match->want_ntlm_http) { - if(Curl_timestrcmp(needle->user, conn->user) || - Curl_timestrcmp(needle->passwd, conn->passwd)) { -- - /* we prefer a credential match, but this is at least a connection -- that can be reused and "upgraded" to NTLM */ -- if(conn->http_ntlm_state == NTLMSTATE_NONE) -+ that can be reused and "upgraded" to NTLM if it does -+ not have any auth ongoing. */ -+#ifdef USE_SPNEGO -+ if((conn->http_ntlm_state == NTLMSTATE_NONE) -+ && (conn->http_negotiate_state == GSS_AUTHNONE)) { -+#else -+ if(conn->http_ntlm_state == NTLMSTATE_NONE) { -+#endif - match->found = conn; -+ } - return FALSE; - } - } --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-6253.patch b/SPECS/curl/CVE-2026-6253.patch deleted file mode 100644 index 71d514f4543..00000000000 --- a/SPECS/curl/CVE-2026-6253.patch +++ /dev/null @@ -1,384 +0,0 @@ -From 188c2f166a20fa97c2325b2da7d0e5cecc13725f Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 13 Apr 2026 17:17:23 +0200 -Subject: [PATCH] http: clear the proxy credentials as well on port or scheme - change - -Add tests 2009-2011 to verify switching between proxies with credentials -when the switch is driven by a redirect - -Reported-by: Dwij Mehta - -Upstream Patch Reference: https://launchpadlibrarian.net/859770351/curl_8.14.1-2ubuntu1.2_8.14.1-2ubuntu1.3.diff.gz -https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f.patch ---- - lib/multi.c | 13 ++++++++ - lib/transfer.c | 51 +++++++++++++++++++++--------- - lib/transfer.h | 2 ++ - tests/data/Makefile.am | 2 +- - tests/data/test2009 | 70 +++++++++++++++++++++++++++++++++++++++++ - tests/data/test2010 | 71 ++++++++++++++++++++++++++++++++++++++++++ - tests/data/test2011 | 70 +++++++++++++++++++++++++++++++++++++++++ - 7 files changed, 263 insertions(+), 16 deletions(-) - create mode 100644 tests/data/test2009 - create mode 100644 tests/data/test2010 - create mode 100644 tests/data/test2011 - -diff --git a/lib/multi.c b/lib/multi.c -index 1851dc7..53ab80e 100644 ---- a/lib/multi.c -+++ b/lib/multi.c -@@ -1979,11 +1979,24 @@ static CURLcode multi_follow(struct Curl_easy *data, - free(scheme); - } - if(clear) { -+ CURLcode result = Curl_reset_userpwd(data); -+ if(result) { -+ free(newurl); -+ return result; -+ } - Curl_safefree(data->state.aptr.user); - Curl_safefree(data->state.aptr.passwd); - } - } - } -+ DEBUGASSERT(newurl); -+ { -+ CURLcode result = Curl_reset_proxypwd(data); -+ if(result) { -+ free(newurl); -+ return result; -+ } -+ } - - if(type == FOLLOW_FAKE) { - /* we are only figuring out the new URL if we would have followed locations -diff --git a/lib/transfer.c b/lib/transfer.c -index d7d3d16..0b688a7 100644 ---- a/lib/transfer.c -+++ b/lib/transfer.c -@@ -531,6 +531,40 @@ void Curl_init_CONNECT(struct Curl_easy *data) - data->state.upload = (data->state.httpreq == HTTPREQ_PUT); - } - -+/* -+ * Restore the user credentials to those set in options. -+ */ -+CURLcode Curl_reset_userpwd(struct Curl_easy *data) -+{ -+ CURLcode result; -+ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD]) -+ data->state.creds_from = CREDS_OPTION; -+ result = Curl_setstropt(&data->state.aptr.user, -+ data->set.str[STRING_USERNAME]); -+ if(!result) -+ result = Curl_setstropt(&data->state.aptr.passwd, -+ data->set.str[STRING_PASSWORD]); -+ return result; -+} -+ -+/* -+ * Restore the proxy credentials to those set in options. -+ */ -+CURLcode Curl_reset_proxypwd(struct Curl_easy *data) -+{ -+#ifndef CURL_DISABLE_PROXY -+ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser, -+ data->set.str[STRING_PROXYUSERNAME]); -+ if(!result) -+ result = Curl_setstropt(&data->state.aptr.proxypasswd, -+ data->set.str[STRING_PROXYPASSWORD]); -+ return result; -+#else -+ (void)data; -+ return CURLE_OK; -+#endif -+} -+ - /* - * Curl_pretransfer() is called immediately before a transfer starts, and only - * once for one transfer no matter if it has redirects or do multi-pass -@@ -678,23 +712,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data) - return CURLE_OUT_OF_MEMORY; - } - -- if(data->set.str[STRING_USERNAME] || -- data->set.str[STRING_PASSWORD]) -- data->state.creds_from = CREDS_OPTION; - if(!result) -- result = Curl_setstropt(&data->state.aptr.user, -- data->set.str[STRING_USERNAME]); -+ result = Curl_reset_userpwd(data); - if(!result) -- result = Curl_setstropt(&data->state.aptr.passwd, -- data->set.str[STRING_PASSWORD]); --#ifndef CURL_DISABLE_PROXY -- if(!result) -- result = Curl_setstropt(&data->state.aptr.proxyuser, -- data->set.str[STRING_PROXYUSERNAME]); -- if(!result) -- result = Curl_setstropt(&data->state.aptr.proxypasswd, -- data->set.str[STRING_PROXYPASSWORD]); --#endif -+ result = Curl_reset_proxypwd(data); - - data->req.headerbytecount = 0; - Curl_headers_cleanup(data); -diff --git a/lib/transfer.h b/lib/transfer.h -index 8c9b88c..8e28c01 100644 ---- a/lib/transfer.h -+++ b/lib/transfer.h -@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data, - - void Curl_init_CONNECT(struct Curl_easy *data); - -+CURLcode Curl_reset_userpwd(struct Curl_easy *data); -+CURLcode Curl_reset_proxypwd(struct Curl_easy *data); - CURLcode Curl_pretransfer(struct Curl_easy *data); - - typedef enum { -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 66dbfb7..2516681 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -239,7 +239,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \ - test1970 test1971 test1972 test1973 test1974 test1975 test1976 \ - \ - test2000 test2001 test2002 test2003 test2004 test2006 \ --\ -+test2009 test2010 test2011 \ - test2023 \ - test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \ - test2032 test2033 test2034 test2035 test2037 test2038 test2039 \ -diff --git a/tests/data/test2009 b/tests/data/test2009 -new file mode 100644 -index 0000000..d2fd79e ---- /dev/null -+++ b/tests/data/test2009 -@@ -0,0 +1,70 @@ -+ -+ -+ -+ -+HTTP -+HTTP proxy -+http_proxy -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 407 Denied -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Content-Length: 4 -+Content-Type: text/html -+Location: https://another.example/%TESTNUMBER0002 -+ -+boo -+ -+ -+ -+# Client-side -+ -+ -+proxy -+ -+ -+http -+https -+ -+ -+proxy credentials via env variables, redirect from http to https -+ -+ -+ -+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPORT/ -+ -+ -+http://somewhere.example/ --follow --proxy-insecure -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://somewhere.example/ HTTP/1.1 -+Host: somewhere.example -+Proxy-Authorization: Basic %b64[user:secret]b64% -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+CONNECT another.example:443 HTTP/1.1 -+Host: another.example:443 -+User-Agent: curl/%VERSION -+Proxy-Connection: Keep-Alive -+ -+ -+ -+7 -+ -+ -+ -diff --git a/tests/data/test2010 b/tests/data/test2010 -new file mode 100644 -index 0000000..443ae9d ---- /dev/null -+++ b/tests/data/test2010 -@@ -0,0 +1,71 @@ -+ -+ -+ -+ -+HTTP -+HTTP proxy -+http_proxy -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 407 Denied -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Content-Length: 4 -+Content-Type: text/html -+Location: https://another.example/%TESTNUMBER0002 -+ -+boo -+ -+ -+ -+# Client-side -+ -+ -+proxy -+ -+ -+http -+https -+ -+ -+proxy credentials via options for two proxies, redirect from http to https -+ -+ -+ -+http_proxy=http://%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPORT/ -+ -+ -+--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://somewhere.example/ HTTP/1.1 -+Host: somewhere.example -+Proxy-Authorization: Basic %b64[batman:robin]b64% -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+CONNECT another.example:443 HTTP/1.1 -+Host: another.example:443 -+Proxy-Authorization: Basic %b64[batman:robin]b64% -+User-Agent: curl/%VERSION -+Proxy-Connection: Keep-Alive -+ -+ -+ -+7 -+ -+ -+ -diff --git a/tests/data/test2011 b/tests/data/test2011 -new file mode 100644 -index 0000000..dd4e534 ---- /dev/null -+++ b/tests/data/test2011 -@@ -0,0 +1,70 @@ -+ -+ -+ -+ -+HTTP -+HTTP proxy -+http_proxy -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 407 Denied -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Content-Length: 4 -+Content-Type: text/html -+Location: https://another.example/%TESTNUMBER0002 -+ -+boo -+ -+ -+ -+# Client-side -+ -+ -+proxy -+ -+ -+http -+https -+ -+ -+proxy creds via env, cross-scheme redirect, --location-trusted -+ -+ -+ -+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPORT/ -+ -+ -+http://somewhere.example/ --location-trusted --proxy-insecure -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://somewhere.example/ HTTP/1.1 -+Host: somewhere.example -+Proxy-Authorization: Basic %b64[user:secret]b64% -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+CONNECT another.example:443 HTTP/1.1 -+Host: another.example:443 -+User-Agent: curl/%VERSION -+Proxy-Connection: Keep-Alive -+ -+ -+ -+7 -+ -+ -+ --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-6276.patch b/SPECS/curl/CVE-2026-6276.patch deleted file mode 100644 index 5076b53caa3..00000000000 --- a/SPECS/curl/CVE-2026-6276.patch +++ /dev/null @@ -1,325 +0,0 @@ -From 3a19987a87f393d9394fe5acc7643f6c263c92db Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Tue, 14 Apr 2026 08:51:44 +0200 -Subject: [PATCH] urldata: move cookiehost to struct SingleRequest - -To make it scoped for the single request appropriately. - -Reported-by: Muhamad Arga Reksapati - -Verify with libtest 2504: a custom Host *disabled* on reused handle - -Closes #21312 - -Upstream Patch Reference: https://github.com/curl/curl/commit/3a19987a87f393d9394fe5acc7643f6c263c92db ---- - lib/http.c | 14 +++--- - lib/request.c | 3 ++ - lib/request.h | 3 ++ - lib/url.c | 2 +- - lib/urldata.h | 3 -- - tests/data/Makefile.am | 2 +- - tests/data/test2504 | 52 +++++++++++++++++++++ - tests/libtest/Makefile.inc | 5 +- - tests/libtest/lib2504.c | 93 ++++++++++++++++++++++++++++++++++++++ - 9 files changed, 165 insertions(+), 12 deletions(-) - create mode 100644 tests/data/test2504 - create mode 100644 tests/libtest/lib2504.c - -diff --git a/lib/http.c b/lib/http.c -index 4de1667..7d328e0 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -1543,6 +1543,9 @@ CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn) - data->state.first_remote_protocol = conn->handler->protocol; - } - Curl_safefree(aptr->host); -+#ifndef CURL_DISABLE_COOKIES -+ Curl_safefree(data->req.cookiehost); -+#endif - - ptr = Curl_checkheaders(data, STRCONST("Host")); - if(ptr && (!data->state.this_is_a_follow || -@@ -1577,8 +1580,7 @@ CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn) - if(colon) - *colon = 0; /* The host must not include an embedded port number */ - } -- Curl_safefree(aptr->cookiehost); -- aptr->cookiehost = cookiehost; -+ data->req.cookiehost = cookiehost; - } - #endif - -@@ -2097,8 +2099,8 @@ CURLcode Curl_http_cookies(struct Curl_easy *data, - int rc = 1; - - if(data->cookies && data->state.cookie_engine) { -- const char *host = data->state.aptr.cookiehost ? -- data->state.aptr.cookiehost : conn->host.name; -+ const char *host = data->req.cookiehost ? -+ data->req.cookiehost : conn->host.name; - const bool secure_context = - conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) || - strcasecompare("localhost", host) || -@@ -2920,8 +2922,8 @@ CURLcode Curl_http_header(struct Curl_easy *data, - if(v) { - /* If there is a custom-set Host: name, use it here, or else use - * real peer hostname. */ -- const char *host = data->state.aptr.cookiehost ? -- data->state.aptr.cookiehost : conn->host.name; -+ const char *host = data->req.cookiehost ? -+ data->req.cookiehost : conn->host.name; - const bool secure_context = - conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) || - strcasecompare("localhost", host) || -diff --git a/lib/request.c b/lib/request.c -index 310e4ea..088425d 100644 ---- a/lib/request.c -+++ b/lib/request.c -@@ -124,6 +124,9 @@ void Curl_req_hard_reset(struct SingleRequest *req, struct Curl_easy *data) - - #ifndef CURL_DISABLE_DOH - Curl_doh_close(data); -+#endif -+#ifndef CURL_DISABLE_COOKIES -+ Curl_safefree(req->cookiehost); - #endif - /* Can no longer memset() this struct as we need to keep some state */ - req->size = -1; -diff --git a/lib/request.h b/lib/request.h -index bb72247..90cb0ae 100644 ---- a/lib/request.h -+++ b/lib/request.h -@@ -119,6 +119,9 @@ struct SingleRequest { - #ifndef CURL_DISABLE_DOH - struct doh_probes *doh; /* DoH specific data for this request */ - #endif -+#ifndef CURL_DISABLE_COOKIES -+ char *cookiehost; -+#endif - #ifndef CURL_DISABLE_COOKIES - unsigned char setcookies; - #endif -diff --git a/lib/url.c b/lib/url.c -index 2ba5311..6ea7b30 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -317,7 +317,7 @@ CURLcode Curl_close(struct Curl_easy **datap) - Curl_safefree(data->state.aptr.ref); - Curl_safefree(data->state.aptr.host); - #ifndef CURL_DISABLE_COOKIES -- Curl_safefree(data->state.aptr.cookiehost); -+ Curl_safefree(data->req.cookiehost); - #endif - #ifndef CURL_DISABLE_RTSP - Curl_safefree(data->state.aptr.rtsp_transport); -diff --git a/lib/urldata.h b/lib/urldata.h -index 704fb7a..026fa2a 100644 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -1331,9 +1331,6 @@ struct UrlState { - char *rangeline; - char *ref; - char *host; --#ifndef CURL_DISABLE_COOKIES -- char *cookiehost; --#endif - #ifndef CURL_DISABLE_RTSP - char *rtsp_transport; - #endif -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 26e015f..b0d1b0a 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -259,7 +259,7 @@ test2308 test2309 \ - \ - test2400 test2401 test2402 test2403 test2404 test2405 test2406 \ - \ --test2500 test2501 test2502 test2503 \ -+test2500 test2501 test2502 test2503 test2504 \ - \ - test2600 test2601 test2602 test2603 test2604 \ - \ -diff --git a/tests/data/test2504 b/tests/data/test2504 -new file mode 100644 -index 0000000..8cec1c8 ---- /dev/null -+++ b/tests/data/test2504 -@@ -0,0 +1,52 @@ -+ -+ -+ -+ -+HTTP -+cookies -+ -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: server.example.com -+Content-Length: 47 -+Set-Cookie: sid=SECRET123; Path=/ -+ -+file contents should appear once for each file -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+ -+lib%TESTNUMBER -+ -+ -+custom Host with cookie, handle reuse, no custom Host: -+ -+ -+http://%HOSTIP:%HTTPPORT -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET / HTTP/1.1 -+Host: victim.internal -+Accept: */* -+ -+GET / HTTP/1.1 -+Host: %HOSTIP:%HTTPPORT -+Accept: */* -+ -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index 8f58fd6..b393665 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -79,7 +79,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ - lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \ - lib2301 lib2302 lib2304 lib2305 lib2306 lib2308 lib2309 \ - lib2402 lib2404 lib2405 \ -- lib2502 \ -+ lib2502 lib2504 \ - lib3010 lib3025 lib3026 lib3027 \ - lib3100 lib3101 lib3102 lib3103 lib3207 - -@@ -698,6 +698,9 @@ lib2405_LDADD = $(TESTUTIL_LIBS) - lib2502_SOURCES = lib2502.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) $(WARNLESS) - lib2502_LDADD = $(TESTUTIL_LIBS) - -+lib2504_SOURCES = lib2504.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) -+lib2504_LDADD = $(TESTUTIL_LIBS) -+ - lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib3010_LDADD = $(TESTUTIL_LIBS) - -diff --git a/tests/libtest/lib2504.c b/tests/libtest/lib2504.c -new file mode 100644 -index 0000000..72b965d ---- /dev/null -+++ b/tests/libtest/lib2504.c -@@ -0,0 +1,93 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Linus Nielsen Feltzing -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+#include "first.h" -+ -+#include "testtrace.h" -+ -+static size_t sink2504(char *ptr, size_t size, size_t nmemb, void *ud) -+{ -+ (void)ptr; -+ (void)ud; -+ return size * nmemb; -+} -+ -+static void dump_cookies2504(CURL *h, const char *tag) -+{ -+ struct curl_slist *cookies = NULL; -+ struct curl_slist *nc; -+ CURLcode rc = curl_easy_getinfo(h, CURLINFO_COOKIELIST, &cookies); -+ -+ curl_mprintf("== %s ==\n", tag); -+ if(rc) { -+ curl_mprintf("getinfo error: %d\n", (int)rc); -+ return; -+ } -+ for(nc = cookies; nc; nc = nc->next) -+ puts(nc->data); -+ curl_slist_free_all(cookies); -+} -+ -+static CURLcode test_lib2504(const char *URL) -+{ -+ CURL *curl; -+ CURLcode result = CURLE_OUT_OF_MEMORY; -+ struct curl_slist *hdrs = NULL; -+ -+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { -+ curl_mfprintf(stderr, "curl_global_init() failed\n"); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ curl = curl_easy_init(); -+ if(!curl) { -+ curl_mfprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ hdrs = curl_slist_append(hdrs, "Host: victim.internal"); -+ if(hdrs) { -+ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2504); -+ test_setopt(curl, CURLOPT_COOKIEFILE, ""); -+ test_setopt(curl, CURLOPT_HTTPHEADER, hdrs); -+ test_setopt(curl, CURLOPT_URL, URL); -+ -+ result = curl_easy_perform(curl); -+ curl_mprintf("req1=%d\n", (int)result); -+ dump_cookies2504(curl, "after request 1"); -+ -+ test_setopt(curl, CURLOPT_HTTPHEADER, NULL); -+ test_setopt(curl, CURLOPT_URL, URL); -+ -+ result = curl_easy_perform(curl); -+ curl_mprintf("req2=%d\n", (int)result); -+ dump_cookies2504(curl, "after request 2"); -+ } -+test_cleanup: -+ curl_slist_free_all(hdrs); -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ -+ return result; -+} --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-6429.patch b/SPECS/curl/CVE-2026-6429.patch deleted file mode 100644 index 16365a7672f..00000000000 --- a/SPECS/curl/CVE-2026-6429.patch +++ /dev/null @@ -1,453 +0,0 @@ -From 2e8c922a89153083227a8f6b737f15bbe9fe1446 Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Fri, 27 Mar 2026 09:19:34 +0100 -Subject: [PATCH 1/2] http2: prevent secure schemes pushed over insecure & - urlapi: same origin tests - -When assembling the URL of a pushed resource over a not-secured -connection, require the scheme to be known and not secure. - -Add new internal `curl_url_same_origin()` to check if a href has the -same origin as a base URL. Add test cases in test1675 and use this in -http2 push handling. - -Upstream Patch Reference: https://launchpadlibrarian.net/859770351/curl_8.14.1-2ubuntu1.2_8.14.1-2ubuntu1.3.diff.gz -https://github.com/curl/curl/commit/b4024bf808bd558026fdc6.patch ---- - lib/http2.c | 22 +++++++++++++++------- - lib/urlapi-int.h | 2 ++ - lib/urlapi.c | 33 +++++++++++++++++++++++++++++++++ - 3 files changed, 50 insertions(+), 7 deletions(-) - -diff --git a/lib/http2.c b/lib/http2.c -index dbe6f1a..ef29686 100644 ---- a/lib/http2.c -+++ b/lib/http2.c -@@ -883,8 +883,9 @@ static struct Curl_easy *h2_duphandle(struct Curl_cfilter *cf, - return second; - } - --static int set_transfer_url(struct Curl_easy *data, -- struct curl_pushheaders *hp) -+static int set_transfer_url(struct Curl_easy *newhandle, -+ struct curl_pushheaders *hp, -+ struct Curl_easy *data) - { - const char *v; - CURLUcode uc; -@@ -922,6 +923,13 @@ static int set_transfer_url(struct Curl_easy *data, - } - } - -+ /* We can only allow PUSH of resource from the same origin, e.g. -+ * scheme + hostname + port */ -+ if(!Curl_url_same_origin(data->state.uh, u)) { -+ rc = 1; -+ goto fail; -+ } -+ - uc = curl_url_get(u, CURLUPART_URL, &url, 0); - if(uc) - rc = 4; -@@ -930,10 +938,10 @@ fail: - if(rc) - return rc; - -- if(data->state.url_alloc) -- free(data->state.url); -- data->state.url_alloc = TRUE; -- data->state.url = url; -+ if(newhandle->state.url_alloc) -+ free(newhandle->state.url); -+ newhandle->state.url_alloc = TRUE; -+ newhandle->state.url = url; - return 0; - } - -@@ -982,7 +990,7 @@ static int push_promise(struct Curl_cfilter *cf, - heads.stream = stream; - heads.frame = frame; - -- rv = set_transfer_url(newhandle, &heads); -+ rv = set_transfer_url(newhandle, &heads, data); - if(rv) { - discard_newhandle(cf, newhandle); - rv = CURL_PUSH_DENY; -diff --git a/lib/urlapi-int.h b/lib/urlapi-int.h -index fcffab2..467f405 100644 ---- a/lib/urlapi-int.h -+++ b/lib/urlapi-int.h -@@ -35,4 +35,6 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host, - bool has_scheme); - #endif - -+bool Curl_url_same_origin(CURLU *base, CURLU *href); -+ - #endif /* HEADER_CURL_URLAPI_INT_H */ -diff --git a/lib/urlapi.c b/lib/urlapi.c -index 98c8f6f..6533e8a 100644 ---- a/lib/urlapi.c -+++ b/lib/urlapi.c -@@ -2013,3 +2013,36 @@ nomem: - } - return CURLUE_OK; - } -+ -+bool Curl_url_same_origin(CURLU *base, CURLU *href) -+{ -+ const struct Curl_handler *s = NULL; -+ -+ /* base must be an absolute URL */ -+ if(!base->scheme || !base->host) -+ return FALSE; -+ if(href->scheme && !curl_strequal(base->scheme, href->scheme)) -+ return FALSE; -+ if(href->host) { -+ if(!curl_strequal(base->host, href->host)) -+ return FALSE; -+ if(!curl_strequal(base->port, href->port)) { -+ /* This may still match if only one has an explicit port -+ * and it is the default for the scheme. */ -+ if(base->port && href->port) -+ return FALSE; -+ -+ s = Curl_get_scheme_handler(base->scheme); -+ if(!s) /* Cannot match default port for unknown scheme */ -+ return FALSE; -+ -+ /* The port which is set must be the default one */ -+ if((base->port && (base->portnum != s->defport)) || -+ (href->port && (href->portnum != s->defport))) -+ return FALSE; -+ } -+ } -+ else if(href->port) /* no host in href, then there must be no port */ -+ return FALSE; -+ return TRUE; -+} --- -2.45.4 - -From b4024bf808bd558026fdc6096e8457f199ace306 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Thu, 16 Apr 2026 14:26:20 +0200 -Subject: [PATCH 2/2] http: clear credentials better on redirect - -Verify with test 2506: netrc with redirect using proxy - -Updated test 998 which was wrong. - -Reported-by: Muhamad Arga Reksapati - -Closes #21345 - ---- - lib/multi.c | 80 ++++++++++++-------------------------- - tests/data/Makefile.am | 2 +- - tests/data/test2506 | 64 ++++++++++++++++++++++++++++++ - tests/data/test998 | 1 - - tests/libtest/Makefile.inc | 5 ++- - tests/libtest/lib2506.c | 71 +++++++++++++++++++++++++++++++++ - 6 files changed, 165 insertions(+), 58 deletions(-) - create mode 100644 tests/data/test2506 - create mode 100644 tests/libtest/lib2506.c - -diff --git a/lib/multi.c b/lib/multi.c -index 53ab80e..57f7649 100644 ---- a/lib/multi.c -+++ b/lib/multi.c -@@ -1932,71 +1932,41 @@ static CURLcode multi_follow(struct Curl_easy *data, - return CURLE_OUT_OF_MEMORY; - } - else { -- uc = curl_url_get(data->state.uh, CURLUPART_URL, &newurl, 0); -- if(uc) -+ bool same_origin; -+ CURLcode result; -+ CURLU *u = curl_url(); -+ if(!u) -+ return CURLE_OUT_OF_MEMORY; -+ uc = curl_url_set(u, CURLUPART_URL, -+ data->state.url, -+ CURLU_URLENCODE | CURLU_ALLOW_SPACE); -+ if(!uc) -+ uc = curl_url_get(data->state.uh, CURLUPART_URL, &newurl, 0); -+ if(uc) { -+ curl_url_cleanup(u); - return Curl_uc_to_curlcode(uc); -+ } - -- /* Clear auth if this redirects to a different port number or protocol, -- unless permitted */ -- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) { -- char *portnum; -- int port; -- bool clear = FALSE; -- -- if(data->set.use_port && data->state.allow_port) -- /* a custom port is used */ -- port = (int)data->set.use_port; -- else { -- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum, -- CURLU_DEFAULT_PORT); -- if(uc) { -- free(newurl); -- return Curl_uc_to_curlcode(uc); -- } -- port = atoi(portnum); -- free(portnum); -- } -- if(port != data->info.conn_remote_port) { -- infof(data, "Clear auth, redirects to port from %u to %u", -- data->info.conn_remote_port, port); -- clear = TRUE; -- } -- else { -- char *scheme; -- const struct Curl_handler *p; -- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0); -- if(uc) { -- free(newurl); -- return Curl_uc_to_curlcode(uc); -- } -+ same_origin = Curl_url_same_origin(u, data->state.uh); -+ curl_url_cleanup(u); - -- p = Curl_get_scheme_handler(scheme); -- if(p && (p->protocol != data->info.conn_protocol)) { -- infof(data, "Clear auth, redirects scheme from %s to %s", -- data->info.conn_scheme, scheme); -- clear = TRUE; -- } -- free(scheme); -- } -- if(clear) { -- CURLcode result = Curl_reset_userpwd(data); -- if(result) { -- free(newurl); -- return result; -- } -- Curl_safefree(data->state.aptr.user); -- Curl_safefree(data->state.aptr.passwd); -+ if((!same_origin && !data->set.allow_auth_to_other_hosts) || -+ !data->set.str[STRING_USERNAME]) { -+ result = Curl_reset_userpwd(data); -+ if(result) { -+ free(newurl); -+ return result; - } -+ Curl_safefree(data->state.aptr.user); -+ Curl_safefree(data->state.aptr.passwd); - } -- } -- DEBUGASSERT(newurl); -- { -- CURLcode result = Curl_reset_proxypwd(data); -+ result = Curl_reset_proxypwd(data); - if(result) { - free(newurl); - return result; - } - } -+ DEBUGASSERT(newurl); - - if(type == FOLLOW_FAKE) { - /* we are only figuring out the new URL if we would have followed locations -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 2516681..fd69983 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -259,7 +259,7 @@ test2308 test2309 \ - \ - test2400 test2401 test2402 test2403 test2404 test2405 test2406 \ - \ --test2500 test2501 test2502 test2503 test2504 \ -+test2500 test2501 test2502 test2503 test2504 test2506 \ - \ - test2600 test2601 test2602 test2603 test2604 \ - \ -diff --git a/tests/data/test2506 b/tests/data/test2506 -new file mode 100644 -index 0000000..9c65002 ---- /dev/null -+++ b/tests/data/test2506 -@@ -0,0 +1,64 @@ -+ -+ -+ -+ -+HTTP -+cookies -+ -+ -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Content-Length: 3 -+Location: http://numbertwo.example/%TESTNUMBER0002 -+ -+ok -+ -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Content-Length: 4 -+ -+yes -+ -+ -+ -+ -+ -+http -+ -+ -+proxy -+ -+ -+lib%TESTNUMBER -+ -+ -+netrc with redirect using proxy -+ -+ -+machine site.example login batman password robin -+ -+ -+http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506 -+ -+ -+ -+ -+ -+GET http://site.example/ HTTP/1.1 -+Host: site.example -+Authorization: Basic %b64[batman:robin]b64% -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://numbertwo.example/25060002 HTTP/1.1 -+Host: numbertwo.example -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ -diff --git a/tests/data/test998 b/tests/data/test998 -index c3a8f51..091c235 100644 ---- a/tests/data/test998 -+++ b/tests/data/test998 -@@ -82,7 +82,6 @@ Proxy-Connection: Keep-Alive - - GET http://somewhere.else.example/a/path/9980002 HTTP/1.1 - Host: somewhere.else.example --Authorization: Basic YWxiZXJ0bzplaW5zdGVpbg== - User-Agent: curl/%VERSION - Accept: */* - Proxy-Connection: Keep-Alive -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index 99cbc18..49e568e 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -79,7 +79,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ - lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \ - lib2301 lib2302 lib2304 lib2305 lib2306 lib2308 lib2309 \ - lib2402 lib2404 lib2405 \ -- lib2502 lib2504 \ -+ lib2502 lib2504 lib2506 \ - lib3010 lib3025 lib3026 lib3027 \ - lib3100 lib3101 lib3102 lib3103 lib3207 - -@@ -704,6 +704,9 @@ lib2502_LDADD = $(TESTUTIL_LIBS) - lib2504_SOURCES = lib2504.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) - lib2504_LDADD = $(TESTUTIL_LIBS) - -+lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(TSTTRACE) -+lib2506_LDADD = $(TESTUTIL_LIBS) -+ - lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib3010_LDADD = $(TESTUTIL_LIBS) - -diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c -new file mode 100644 -index 0000000..a09e16a ---- /dev/null -+++ b/tests/libtest/lib2506.c -@@ -0,0 +1,71 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Linus Nielsen Feltzing -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+#include "test.h" -+ -+#include "testtrace.h" -+ -+static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud) -+{ -+ (void)ptr; -+ (void)ud; -+ return size * nmemb; -+} -+ -+CURLcode test(char *URL) -+{ -+ CURL *curl; -+ CURLcode res = CURLE_OUT_OF_MEMORY; -+ -+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { -+ curl_mfprintf(stderr, "curl_global_init() failed\n"); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ curl = curl_easy_init(); -+ if(!curl) { -+ curl_mfprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506); -+ test_setopt(curl, CURLOPT_PROXY, URL); -+ test_setopt(curl, CURLOPT_URL, libtest_arg2); -+ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL); -+ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3); -+ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); -+ test_setopt(curl, CURLOPT_VERBOSE, 1L); -+ -+ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the -+ credentials come from netrc */ -+ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L); -+ -+ res = curl_easy_perform(curl); -+ -+test_cleanup: -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ -+ return res; -+} --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-7168.patch b/SPECS/curl/CVE-2026-7168.patch deleted file mode 100644 index a62a4a82ca4..00000000000 --- a/SPECS/curl/CVE-2026-7168.patch +++ /dev/null @@ -1,385 +0,0 @@ -From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 27 Apr 2026 09:14:51 +0200 -Subject: [PATCH] setopt: clear proxy auth properties when switching - -Verify with test 1588 - -Closes #21453 - -Upstream Patch Reference: https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507.patch ---- - lib/setopt.c | 17 ++++- - lib/vauth/vauth.h | 2 + - tests/data/Makefile.am | 2 +- - tests/data/test1588 | 106 ++++++++++++++++++++++++++ - tests/libtest/Makefile.inc | 5 +- - tests/libtest/lib1588.c | 152 +++++++++++++++++++++++++++++++++++++ - 6 files changed, 281 insertions(+), 3 deletions(-) - create mode 100644 tests/data/test1588 - create mode 100644 tests/libtest/lib1588.c - -diff --git a/lib/setopt.c b/lib/setopt.c -index 0bae6ba..1ab0d1e 100644 ---- a/lib/setopt.c -+++ b/lib/setopt.c -@@ -53,6 +53,7 @@ - #include "tftp.h" - #include "strdup.h" - #include "escape.h" -+#include "vauth/vauth.h" - - /* The last 3 #include files should be in this order */ - #include "curl_printf.h" -@@ -1666,6 +1667,20 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option, - return result; - } - -+#ifndef CURL_DISABLE_PROXY -+static CURLcode setproxy(struct Curl_easy *data, const char *proxy) -+{ -+ if((data->set.str[STRING_PROXY] && proxy) && -+ /* there was one set, is this a new one? */ -+ !strcmp(data->set.str[STRING_PROXY], proxy)) -+ return CURLE_OK; /* same one as before */ -+ -+ Curl_auth_digest_cleanup(&data->state.proxydigest); -+ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy)); -+ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy); -+} -+#endif -+ - static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option, - char *ptr) - { -@@ -1956,7 +1971,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option, - * Setting it to NULL, means no proxy but allows the environment variables - * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL). - */ -- return Curl_setstropt(&data->set.str[STRING_PROXY], ptr); -+ return setproxy(data, ptr); - break; - - case CURLOPT_PRE_PROXY: -diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h -index 7e82348..d514b98 100644 ---- a/lib/vauth/vauth.h -+++ b/lib/vauth/vauth.h -@@ -117,6 +117,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data, - - /* This is used to clean up the digest specific data */ - void Curl_auth_digest_cleanup(struct digestdata *digest); -+#else -+#define Curl_auth_digest_cleanup(x) - #endif /* !CURL_DISABLE_DIGEST_AUTH */ - - #ifdef USE_GSASL -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index b0d1b0a..66dbfb7 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -206,7 +206,7 @@ test1540 test1541 test1542 test1543 test1544 test1545 test1546 \ - \ - test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \ - test1558 test1559 test1560 test1561 test1562 test1563 test1564 test1565 \ --test1566 test1567 test1568 test1569 test1570 \ -+test1566 test1567 test1568 test1569 test1570 test1588\ - \ - test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \ - test1598 \ -diff --git a/tests/data/test1588 b/tests/data/test1588 -new file mode 100644 -index 0000000..4db29f2 ---- /dev/null -+++ b/tests/data/test1588 -@@ -0,0 +1,106 @@ -+ -+ -+ -+ -+HTTP -+HTTP GET -+HTTP proxy -+HTTP proxy Digest auth -+multi -+ -+ -+ -+# Server-side -+ -+ -+# this is returned first since we get no proxy-auth -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+And you should ignore this data. -+ -+ -+# then this is returned when we get proxy-auth -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+ -+ -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+# tool is what to use instead of 'curl' -+ -+lib%TESTNUMBER -+ -+ -+!SSPI -+crypto -+proxy -+digest-auth -+ -+ -+HTTP proxy auth Digest, then change proxy and do it again -+ -+ -+http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index b393665..99cbc18 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -65,7 +65,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ - lib1534 lib1535 lib1536 lib1537 lib1538 lib1539 \ - lib1540 lib1541 lib1542 lib1543 lib1545 \ - lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \ -- lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \ -+ lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 lib1588 \ - lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ - \ - lib1662 \ -@@ -521,6 +521,9 @@ lib1568_SOURCES = lib1568.c $(SUPPORTFILES) - - lib1569_SOURCES = lib1569.c $(SUPPORTFILES) - -+lib1588_SOURCES = lib1588.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) -+lib1588_LDADD = $(TESTUTIL_LIBS) -+ - lib1591_SOURCES = lib1591.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib1591_LDADD = $(TESTUTIL_LIBS) - -diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c -new file mode 100644 -index 0000000..2affb87 ---- /dev/null -+++ b/tests/libtest/lib1588.c -@@ -0,0 +1,152 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+/* -+ * argv1 = URL -+ * argv2 = proxy host -+ * argv3 = proxy port -+ * argv4 = proxyuser:password -+ */ -+ -+#include "test.h" -+ -+#include "testutil.h" -+ -+static CURLcode init1588(CURL *curl, const char *url, -+ const char *userpwd, const char *proxy) -+{ -+ CURLcode res = CURLE_OK; -+ -+ res_easy_setopt(curl, CURLOPT_URL, url); -+ if(res) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXY, proxy); -+ if(res) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); -+ if(res) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); -+ if(res) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); -+ if(res) -+ goto init_failed; -+#if 0 -+ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L); -+ if(res) -+ goto init_failed; -+#endif -+ -+ res_easy_setopt(curl, CURLOPT_HEADER, 1L); -+ if(res) -+ goto init_failed; -+ -+ return CURLE_OK; /* success */ -+ -+init_failed: -+ return res; /* failure */ -+} -+ -+static CURLcode run1588(CURL *curl, const char *url, const char *userpwd, -+ const char *proxy) -+{ -+ CURLcode res = CURLE_OK; -+ -+ res = init1588(curl, url, userpwd, proxy); -+ if(res) -+ return res; -+ -+ return curl_easy_perform(curl); -+} -+ -+CURLcode test(char *URL) -+{ -+ CURLcode res = CURLE_OK; -+ CURL *curl = NULL; -+ const char *proxyuserpws = libtest_arg4; -+ struct curl_slist *host = NULL; -+ struct curl_slist *host2 = NULL; -+ char proxy1_resolve[128]; -+ char proxy2_resolve[128]; -+ char proxy1_connect[128]; -+ char proxy2_connect[128]; -+ -+ if(test_argc < 3) -+ return TEST_ERR_MAJOR_BAD; -+ -+ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve), -+ "firstproxy:%s:%s", libtest_arg3, libtest_arg2); -+ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve), -+ "secondproxy:%s:%s", libtest_arg3, libtest_arg2); -+ -+ /* we connect to the fake host name but the right port number */ -+ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect), -+ "firstproxy:%s", libtest_arg3); -+ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect), -+ "secondproxy:%s", libtest_arg3); -+ -+ res_global_init(CURL_GLOBAL_ALL); -+ if(res) -+ return res; -+ -+ curl = curl_easy_init(); -+ if(!curl) { -+ curl_mfprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ host = curl_slist_append(NULL, proxy1_resolve); -+ if(!host) -+ goto test_cleanup; -+ host2 = curl_slist_append(host, proxy2_resolve); -+ if(!host2) -+ goto test_cleanup; -+ host = host2; -+ -+ start_test_timing(); -+ -+ easy_setopt(curl, CURLOPT_RESOLVE, host); -+ -+ res = run1588(curl, URL, proxyuserpws, proxy1_connect); -+ if(res) -+ goto test_cleanup; -+ -+ curl_mfprintf(stderr, "lib1588: now we do the request again\n"); -+ -+ res = run1588(curl, URL, proxyuserpws, proxy2_connect); -+ -+test_cleanup: -+ -+ /* proper cleanup sequence - type PB */ -+ -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ curl_slist_free_all(host); -+ return res; -+} --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-8286.patch b/SPECS/curl/CVE-2026-8286.patch deleted file mode 100644 index f3aacbbe190..00000000000 --- a/SPECS/curl/CVE-2026-8286.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 206e10498e6d0eb9b60e2cc431689f49a7f839f8 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Wed, 8 Jul 2026 11:01:25 +0000 -Subject: [PATCH] url: fix connection reuse for starttls protocols - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/a86efdd7ca5433de9231e6.patch ---- - lib/url.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index f04b230..cd8dbcc 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -846,7 +846,11 @@ struct url_conn_match { - BIT(want_proxy_ntlm_http); - BIT(want_nego_http); - BIT(want_proxy_nego_http); -- BIT(req_tls); /* require TLS use from a clear-text start */ -+ BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse -+ * connections that have matching TLS configuration. -+ * Always TRUE if `req_tls` is TRUE. */ -+ BIT(require_tls); /* Requires TLS use from a clear-text start, can only -+ * reuse connections that have TLS. */ - BIT(wait_pipe); - BIT(force_reuse); - BIT(seen_pending_conn); -@@ -905,7 +909,7 @@ static bool url_match_auth_nego(struct connectdata *conn, - } - return FALSE; /* get another */ - } -- else if(m->req_tls) -+ else if(m->require_tls) - /* a clear-text STARTTLS protocol with required TLS */ - return FALSE; - return TRUE; -@@ -1152,8 +1156,8 @@ static bool url_match_conn(struct connectdata *conn, void *userdata) - needle->remote_port != conn->remote_port) - return FALSE; - -- /* If talking TLS, conn needs to use the same SSL options. */ -- if((needle->handler->flags & PROTOPT_SSL) && -+ /* If talking/upgrading to TLS, conn needs to use the same SSL options. */ -+ if(((needle->handler->flags & PROTOPT_SSL) || match->may_tls) && - !Curl_ssl_conn_config_match(data, conn, FALSE)) { - DEBUGF(infof(data, - "Connection #%" FMT_OFF_T -@@ -1341,7 +1345,8 @@ ConnectionExists(struct Curl_easy *data, - (needle->handler->protocol & PROTO_FAMILY_HTTP); - #endif - #endif -- match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; -+ match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; -+ match.may_tls = data->set.use_ssl > CURLUSESSL_NONE; - - /* Find a connection in the pool that matches what "data + needle" - * requires. If a suitable candidate is found, it is attached to "data". */ --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-8458.patch b/SPECS/curl/CVE-2026-8458.patch deleted file mode 100644 index d0c3664dc26..00000000000 --- a/SPECS/curl/CVE-2026-8458.patch +++ /dev/null @@ -1,138 +0,0 @@ -From 40c6cc9842e1bc4749bc5425c2edc0f1272a80bb Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Tue, 7 Jul 2026 13:31:08 +0000 -Subject: [PATCH] creds: add sasl service name - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: Backport of https://git.launchpad.net/ubuntu/+source/curl/patch/?id=e40d2534b1bddf219ed826bdc1f71a97bbf5e3c5 ---- - lib/curl_sasl.c | 15 +++++---------- - lib/http_negotiate.c | 6 +----- - lib/http_ntlm.c | 9 ++------- - 3 files changed, 7 insertions(+), 23 deletions(-) - -diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c ---- a/lib/curl_sasl.c -+++ b/lib/curl_sasl.c -@@ -352,11 +352,6 @@ - saslstate state2 = SASL_FINAL; - const char *hostname, *disp_hostname; - int port; --#if defined(USE_KERBEROS5) || defined(USE_NTLM) -- const char *service = data->set.str[STRING_SERVICE_NAME] ? -- data->set.str[STRING_SERVICE_NAME] : -- sasl->params->service; --#endif - const char *oauth_bearer = data->set.str[STRING_BEARER]; - struct bufref nullmsg; - -@@ -391,7 +386,7 @@ - if(force_ir || data->set.sasl_ir) - result = Curl_auth_create_gssapi_user_message(data, conn->user, - conn->passwd, -- service, -+ sasl->params->service, - conn->host.name, - sasl->mutual_auth, - NULL, &conn->krb5, -@@ -452,8 +447,7 @@ - if(force_ir || data->set.sasl_ir) - result = Curl_auth_create_ntlm_type1_message(data, - conn->user, conn->passwd, -- service, -- hostname, -+ sasl->params->service, hostname, - &conn->ntlm, &resp); - } - else -@@ -606,7 +600,7 @@ - if(!result) - result = Curl_auth_create_digest_md5_message(data, &serverdata, - conn->user, conn->passwd, -- service, &resp); -+ sasl->params->service, &resp); - if(!result && (sasl->params->flags & SASL_FLAG_BASE64)) - newstate = SASL_DIGESTMD5_RESP; - break; -@@ -641,8 +635,7 @@ - case SASL_GSSAPI: - result = Curl_auth_create_gssapi_user_message(data, conn->user, - conn->passwd, -- service, -- conn->host.name, -+ sasl->params->service, conn->host.name, - sasl->mutual_auth, NULL, - &conn->krb5, - &resp); -diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c ---- a/lib/http_negotiate.c -+++ b/lib/http_negotiate.c -@@ -57,8 +57,6 @@ - #ifndef CURL_DISABLE_PROXY - userp = conn->http_proxy.user; - passwdp = conn->http_proxy.passwd; -- service = data->set.str[STRING_PROXY_SERVICE_NAME] ? -- data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP"; - host = conn->http_proxy.host.name; - neg_ctx = &conn->proxyneg; - state = conn->proxy_negotiate_state; -@@ -69,8 +67,6 @@ - else { - userp = conn->user; - passwdp = conn->passwd; -- service = data->set.str[STRING_SERVICE_NAME] ? -- data->set.str[STRING_SERVICE_NAME] : "HTTP"; - host = conn->host.name; - neg_ctx = &conn->negotiate; - state = conn->http_negotiate_state; -@@ -121,7 +117,7 @@ - #endif - - /* Initialize the security context and decode our challenge */ -- result = Curl_auth_decode_spnego_message(data, userp, passwdp, service, -+ result = Curl_auth_decode_spnego_message(data, userp, passwdp, "HTTP", - host, header, neg_ctx); - - #if defined(USE_SSL) && defined(HAVE_GSSAPI) -diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c ---- a/lib/http_ntlm.c -+++ b/lib/http_ntlm.c -@@ -136,10 +136,9 @@ - server, which is for a plain host or for an HTTP proxy */ - char **allocuserpwd; - -- /* point to the username, password, service and host */ -+ /* point to the username, password, and host */ - const char *userp; - const char *passwdp; -- const char *service = NULL; - const char *hostname = NULL; - - /* point to the correct struct with this */ -@@ -156,8 +155,6 @@ - allocuserpwd = &data->state.aptr.proxyuserpwd; - userp = data->state.aptr.proxyuser; - passwdp = data->state.aptr.proxypasswd; -- service = data->set.str[STRING_PROXY_SERVICE_NAME] ? -- data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP"; - hostname = conn->http_proxy.host.name; - ntlm = &conn->proxyntlm; - state = &conn->proxy_ntlm_state; -@@ -170,8 +167,6 @@ - allocuserpwd = &data->state.aptr.userpwd; - userp = data->state.aptr.user; - passwdp = data->state.aptr.passwd; -- service = data->set.str[STRING_SERVICE_NAME] ? -- data->set.str[STRING_SERVICE_NAME] : "HTTP"; - hostname = conn->host.name; - ntlm = &conn->ntlm; - state = &conn->http_ntlm_state; -@@ -210,7 +205,7 @@ - default: /* for the weird cases we (re)start here */ - /* Create a type-1 message */ - result = Curl_auth_create_ntlm_type1_message(data, userp, passwdp, -- service, hostname, -+ "HTTP", hostname, - ntlm, &ntlmmsg); - if(!result) { - DEBUGASSERT(Curl_bufref_len(&ntlmmsg) != 0); diff --git a/SPECS/curl/CVE-2026-8926.patch b/SPECS/curl/CVE-2026-8926.patch deleted file mode 100755 index cb352935265..00000000000 --- a/SPECS/curl/CVE-2026-8926.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 4ae1d7cc2643e4773a136395f12bc02fc6867854 Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Fri, 15 May 2026 11:45:49 +0200 -Subject: [PATCH] netrc: scanner refactor - -Refactor the netrc scanner. Add test case for checking that the last -matched machine with unmatched login does not return the password as -success (unit1304). -Upstream Patch Reference: https://git.launchpad.net/ubuntu/+source/curl/patch/?id=e40d2534b1bddf219ed826bdc1f71a97bbf5e3c5 - ---- - lib/netrc.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/lib/netrc.c b/lib/netrc.c -index b5002fb..f17a153 100644 ---- a/lib/netrc.c -+++ b/lib/netrc.c -@@ -310,7 +310,15 @@ static int parsenetrc(struct store_netrc *store, - out: - Curl_dyn_free(&token); - if(!retcode) { -- if(!password && our_login) { -+ if(specific_login && !our_login && (found & FOUND_LOGIN) && password) { -+ /* host matched and had a login keyword that did not match the -+ requested user, but we still collected a password from that -+ entry. Do not leak it to the caller. */ -+ free(password); -+ password = NULL; -+ retcode = NETRC_FILE_MISSING; -+ } -+ else if(!password && our_login) { - /* success without a password, set a blank one */ - password = strdup(""); - if(!password) --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-8927.patch b/SPECS/curl/CVE-2026-8927.patch deleted file mode 100644 index b03062c25a8..00000000000 --- a/SPECS/curl/CVE-2026-8927.patch +++ /dev/null @@ -1,337 +0,0 @@ -From 5ab969ec6938a2bbf576e24012f77fed14743e15 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Tue, 7 Jul 2026 07:09:38 +0000 -Subject: [PATCH] url: detect proxy changes read from environment - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567.patch ---- - lib/url.c | 11 +++++ - lib/urldata.h | 1 + - tests/data/Makefile.am | 1 + - tests/data/test1647 | 103 ++++++++++++++++++++++++++++++++++++++ - tests/libtest/Makefile.inc | 4 ++ - tests/libtest/lib1647.c | 120 +++++++++++++++++++++++++++++++++++++++++++++ - 6 files changed, 240 insertions(+) - create mode 100644 tests/data/test1647 - create mode 100644 tests/libtest/lib1647.c - -diff --git a/lib/url.c b/lib/url.c -index 984b8db..6f451f6 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -80,6 +80,7 @@ - #include "content_encoding.h" - #include "http_digest.h" - #include "http_negotiate.h" -+#include "vauth/vauth.h" - #include "select.h" - #include "multiif.h" - #include "easyif.h" -@@ -339,6 +340,9 @@ CURLcode Curl_close(struct Curl_easy **datap) - Curl_freeset(data); - Curl_headers_cleanup(data); - Curl_netrc_cleanup(&data->state.netrc); -+#ifndef CURL_DISABLE_DIGEST_AUTH -+ free(data->state.envproxy); -+#endif - free(data); - return CURLE_OK; - } -@@ -2529,6 +2533,13 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data, - curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype; - if(proxy) { - result = parse_proxy(data, conn, proxy, ptype); -+#ifndef CURL_DISABLE_DIGEST_AUTH -+ if(!result && !Curl_safecmp(data->state.envproxy, proxy)) { -+ Curl_auth_digest_cleanup(&data->state.proxydigest); -+ Curl_safefree(data->state.envproxy); -+ data->state.envproxy = strdup(proxy); -+ } -+#endif - Curl_safefree(proxy); /* parse_proxy copies the proxy string */ - if(result) - goto out; -diff --git a/lib/urldata.h b/lib/urldata.h -index 026fa2a..fd9857b 100644 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -1242,6 +1242,7 @@ struct UrlState { - void (*prev_signal)(int sig); - #endif - #ifndef CURL_DISABLE_DIGEST_AUTH -+ char *envproxy; /* last proxy string used for proxy-related state */ - struct digestdata digest; /* state data for host Digest auth */ - struct digestdata proxydigest; /* state data for proxy Digest auth */ - #endif -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 1aee6f4..7ce6abb 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -216,6 +216,7 @@ test1616 \ - test1620 test1621 \ - \ - test1630 test1631 test1632 test1633 test1634 test1635 \ -+test1647 \ - \ - test1650 test1651 test1652 test1653 test1654 test1655 test1656 \ - test1660 test1661 test1662 test1663 \ -diff --git a/tests/data/test1647 b/tests/data/test1647 -new file mode 100644 -index 0000000..7be29dc ---- /dev/null -+++ b/tests/data/test1647 -@@ -0,0 +1,103 @@ -+ -+ -+ -+ -+HTTP -+HTTP GET -+HTTP proxy -+HTTP proxy Digest auth -+multi -+ -+ -+ -+# Server-side -+ -+ -+# this is returned first since we get no proxy-auth -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+And you should ignore this data. -+ -+ -+# then this is returned when we get proxy-auth -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+ -+ -+ -+HTTP/1.1 401 OK -+Content-Length: 21 -+Server: no -+ -+Denied access. Leave -+ -+ -+ -+ -+# Client-side -+ -+ -+http -+https-proxy -+https -+ -+# tool is what to use instead of 'curl' -+ -+lib%TESTNUMBER -+ -+ -+!SSPI -+crypto -+proxy -+digest -+Debug -+ -+ -+http_proxy=%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPROXYPORT -+CURL_ENTROPY=99376 -+ -+ -+HTTP proxy auth Digest, then change proxy with env var and do it again -+ -+ -+http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456 -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 -+Host: test.remote.example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 -+Host: test.remote.example.com -+Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096" -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ -+CONNECT another.example.com:%HTTPSPORT HTTP/1.1 -+Host: another.example.com:%HTTPSPORT -+Proxy-Connection: Keep-Alive -+ -+ -+ -+#error CONNECT fails -+ -+7 -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index 49e568e..ce0d6bb 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -67,6 +67,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ - lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \ - lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 lib1588 \ - lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ -+ lib1647 \ - \ - lib1662 \ - \ -@@ -546,6 +547,9 @@ lib1597_LDADD = $(TESTUTIL_LIBS) - lib1598_SOURCES = lib1598.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib1598_LDADD = $(TESTUTIL_LIBS) - -+lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) -+lib1647_LDADD = $(TESTUTIL_LIBS) -+ - lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib1662_LDADD = $(TESTUTIL_LIBS) - -diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c -new file mode 100644 -index 0000000..51fc125 ---- /dev/null -+++ b/tests/libtest/lib1647.c -@@ -0,0 +1,120 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+/* -+ * argv1 = the first URL -+ * argv2 = URL2 -+ * argv3 = credentials 1 -+ * argv4 = credentials 2 -+ */ -+ -+#include "test.h" -+#include "testutil.h" -+#include "warnless.h" -+#include "memdebug.h" -+ -+/* this is meant to pick up the proxy from the environment variable */ -+static CURLcode init1647(CURL *curl, const char *url, const char *userpwd) -+{ -+ CURLcode result = CURLE_OK; -+ -+ easy_setopt(curl, CURLOPT_URL, url); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_VERBOSE, 1L); -+ if(result) -+ goto init_failed; -+ -+ return CURLE_OK; /* success */ -+ -+init_failed: -+ return result; /* failure */ -+} -+ -+static CURLcode run1647(CURL *curl, const char *url, const char *userpwd) -+{ -+ CURLcode result = CURLE_OK; -+ -+ result = init1647(curl, url, userpwd); -+ if(result) -+ return result; -+ -+ return curl_easy_perform(curl); -+} -+ -+CURLcode test(char *URL) -+{ -+ CURLcode result = CURLE_OK; -+ CURL *curl = NULL; -+ -+ global_init(CURL_GLOBAL_ALL); -+ if(result) -+ return result; -+ -+ easy_init(curl); -+ if(!curl) { -+ fprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ start_test_timing(); -+ -+ fprintf(stderr, "--- First get '%s'\n", URL); -+ result = run1647(curl, URL, libtest_arg3); -+ if(result) -+ goto test_cleanup; -+ -+ fprintf(stderr, "--- Then get '%s'\n", libtest_arg2); -+ result = run1647(curl, libtest_arg2, libtest_arg4); -+ -+test_cleanup: -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ return result; -+} --- -2.45.4 diff --git a/SPECS/curl/CVE-2026-8932.patch b/SPECS/curl/CVE-2026-8932.patch deleted file mode 100644 index 7da0c25ef19..00000000000 --- a/SPECS/curl/CVE-2026-8932.patch +++ /dev/null @@ -1,624 +0,0 @@ -From bc8619f242f91912017f3ba015ec71da4500862a Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Tue, 7 Jul 2026 07:09:22 +0000 -Subject: [PATCH] tls: fix incomplete mTLS config in conn reuse and session - cache - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e.patch ---- - lib/ldap.c | 8 ++++---- - lib/urldata.h | 10 +++++----- - lib/vssh/libssh.c | 6 +++--- - lib/vssh/libssh2.c | 2 +- - lib/vtls/gtls.c | 16 ++++++++-------- - lib/vtls/mbedtls.c | 22 +++++++++++----------- - lib/vtls/openssl.c | 6 +++--- - lib/vtls/schannel.c | 10 +++++----- - lib/vtls/vtls.c | 37 ++++++++++++++++++++++++++----------- - lib/vtls/wolfssl.c | 14 +++++++------- - tests/data/Makefile.am | 2 +- - tests/data/test3303 | 20 ++++++++++++++++++++ - tests/unit/Makefile.inc | 2 +- - tests/unit/unit3303.c | 127 ++++++++++++++++++++++++++++++++++++++++++++++ - 14 files changed, 225 insertions(+), 59 deletions(-) - -diff --git a/lib/ldap.c b/lib/ldap.c -index a1e60b0..cb44809 100644 ---- a/lib/ldap.c -+++ b/lib/ldap.c -@@ -404,8 +404,8 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - if(conn->ssl_config.verifypeer) { - /* Novell SDK supports DER or BASE64 files. */ - int cert_type = LDAPSSL_CERT_FILETYPE_B64; -- if((data->set.ssl.cert_type) && -- (strcasecompare(data->set.ssl.cert_type, "DER"))) -+ if((data->set.ssl.primary.cert_type) && -+ (strcasecompare(data->set.ssl.primary.cert_type, "DER"))) - cert_type = LDAPSSL_CERT_FILETYPE_DER; - if(!ldap_ca) { - failf(data, "LDAP local: ERROR %s CA cert not set", -@@ -445,8 +445,8 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done) - #elif defined(LDAP_OPT_X_TLS) - if(conn->ssl_config.verifypeer) { - /* OpenLDAP SDK supports BASE64 files. */ -- if((data->set.ssl.cert_type) && -- (!strcasecompare(data->set.ssl.cert_type, "PEM"))) { -+ if((data->set.ssl.primary.cert_type) && -+ (!strcasecompare(data->set.ssl.primary.cert_type, "PEM"))) { - failf(data, "LDAP local: ERROR OpenLDAP only supports PEM cert-type"); - result = CURLE_SSL_CERTPROBLEM; - goto quit; -diff --git a/lib/urldata.h b/lib/urldata.h -index 026fa2a..b4d95fd 100644 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -296,9 +296,14 @@ struct ssl_primary_config { - char *cipher_list13; /* list of TLS 1.3 cipher suites to use */ - char *pinned_key; - char *CRLfile; /* CRL to check certificate revocation */ -+ char *cert_type; /* format for certificate (default: PEM)*/ -+ char *key; /* private key filename */ -+ char *key_type; /* format for private key (default: PEM) */ -+ char *key_passwd; /* plain text private key password */ - struct curl_blob *cert_blob; - struct curl_blob *ca_info_blob; - struct curl_blob *issuercert_blob; -+ struct curl_blob *key_blob; - #ifdef USE_TLS_SRP - char *username; /* TLS username (for, e.g., SRP) */ - char *password; /* TLS password (for, e.g., SRP) */ -@@ -318,11 +323,6 @@ struct ssl_config_data { - long certverifyresult; /* result from the certificate verification */ - curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */ - void *fsslctxp; /* parameter for call back */ -- char *cert_type; /* format for certificate (default: PEM)*/ -- char *key; /* private key filename */ -- struct curl_blob *key_blob; -- char *key_type; /* format for private key (default: PEM) */ -- char *key_passwd; /* plain text private key password */ - BIT(certinfo); /* gather lots of certificate info */ - BIT(falsestart); - BIT(earlydata); /* use tls1.3 early data */ -diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c -index 6bae061..c6cf1b5 100644 ---- a/lib/vssh/libssh.c -+++ b/lib/vssh/libssh.c -@@ -781,7 +781,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block) - /* Two choices, (1) private key was given on CMD, - * (2) use the "default" keys. */ - if(data->set.str[STRING_SSH_PRIVATE_KEY]) { -- if(sshc->pubkey && !data->set.ssl.key_passwd) { -+ if(sshc->pubkey && !data->set.ssl.primary.key_passwd) { - rc = ssh_userauth_try_publickey(sshc->ssh_session, NULL, - sshc->pubkey); - if(rc == SSH_AUTH_AGAIN) { -@@ -797,7 +797,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block) - - rc = ssh_pki_import_privkey_file(data-> - set.str[STRING_SSH_PRIVATE_KEY], -- data->set.ssl.key_passwd, NULL, -+ data->set.ssl.primary.key_passwd, NULL, - NULL, &sshc->privkey); - if(rc != SSH_OK) { - failf(data, "Could not load private key file %s", -@@ -812,7 +812,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block) - } - else { - rc = ssh_userauth_publickey_auto(sshc->ssh_session, NULL, -- data->set.ssl.key_passwd); -+ data->set.ssl.primary.key_passwd); - if(rc == SSH_AUTH_AGAIN) { - rc = SSH_AGAIN; - break; -diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c -index e19ffef..10c1923 100644 ---- a/lib/vssh/libssh2.c -+++ b/lib/vssh/libssh2.c -@@ -1370,7 +1370,7 @@ sftp_pkey_init(struct Curl_easy *data, - return CURLE_OUT_OF_MEMORY; - } - -- sshc->passphrase = data->set.ssl.key_passwd; -+ sshc->passphrase = data->set.ssl.primary.key_passwd; - if(!sshc->passphrase) - sshc->passphrase = ""; - -diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c -index af4f0c3..dd7e2e0 100644 ---- a/lib/vtls/gtls.c -+++ b/lib/vtls/gtls.c -@@ -953,10 +953,10 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf, - if(result) - return result; - } -- if(ssl_config->cert_type && strcasecompare(ssl_config->cert_type, "P12")) { -+ if(ssl_config->primary.cert_type && strcasecompare(ssl_config->primary.cert_type, "P12")) { - rc = gnutls_certificate_set_x509_simple_pkcs12_file( - gtls->shared_creds->creds, config->clientcert, GNUTLS_X509_FMT_DER, -- ssl_config->key_passwd ? ssl_config->key_passwd : ""); -+ ssl_config->primary.key_passwd ? ssl_config->primary.key_passwd : ""); - if(rc != GNUTLS_E_SUCCESS) { - failf(data, - "error reading X.509 potentially-encrypted key or certificate " -@@ -965,7 +965,7 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf, - return CURLE_SSL_CONNECT_ERROR; - } - } -- else if(ssl_config->key_passwd) { -+ else if(ssl_config->primary.key_passwd) { - const unsigned int supported_key_encryption_algorithms = - GNUTLS_PKCS_USE_PKCS12_3DES | GNUTLS_PKCS_USE_PKCS12_ARCFOUR | - GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES | -@@ -974,9 +974,9 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf, - rc = gnutls_certificate_set_x509_key_file2( - gtls->shared_creds->creds, - config->clientcert, -- ssl_config->key ? ssl_config->key : config->clientcert, -- gnutls_do_file_type(ssl_config->cert_type), -- ssl_config->key_passwd, -+ ssl_config->primary.key ? ssl_config->primary.key : config->clientcert, -+ gnutls_do_file_type(ssl_config->primary.cert_type), -+ ssl_config->primary.key_passwd, - supported_key_encryption_algorithms); - if(rc != GNUTLS_E_SUCCESS) { - failf(data, -@@ -989,8 +989,8 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf, - if(gnutls_certificate_set_x509_key_file( - gtls->shared_creds->creds, - config->clientcert, -- ssl_config->key ? ssl_config->key : config->clientcert, -- gnutls_do_file_type(ssl_config->cert_type) ) != -+ ssl_config->primary.key ? ssl_config->primary.key : config->clientcert, -+ gnutls_do_file_type(ssl_config->primary.cert_type) ) != - GNUTLS_E_SUCCESS) { - failf(data, "error reading X.509 key or certificate file"); - return CURLE_SSL_CONNECT_ERROR; -diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c -index e071ded..8672439 100644 ---- a/lib/vtls/mbedtls.c -+++ b/lib/vtls/mbedtls.c -@@ -701,7 +701,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - if(ret) { - mbedtls_strerror(ret, errorbuf, sizeof(errorbuf)); - failf(data, "Error reading client cert data %s - mbedTLS: (-0x%04X) %s", -- ssl_config->key, -ret, errorbuf); -+ ssl_config->primary.key, -ret, errorbuf); - return CURLE_SSL_CERTPROBLEM; - } - } -@@ -709,23 +709,23 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - /* Load the client private key */ - mbedtls_pk_init(&backend->pk); - -- if(ssl_config->key || ssl_config->key_blob) { -- if(ssl_config->key) { -+ if(ssl_config->primary.key || ssl_config->primary.key_blob) { -+ if(ssl_config->primary.key) { - #ifdef MBEDTLS_FS_IO - #if MBEDTLS_VERSION_NUMBER >= 0x03000000 -- ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key, -- ssl_config->key_passwd, -+ ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->primary.key, -+ ssl_config->primary.key_passwd, - mbedtls_ctr_drbg_random, - &backend->ctr_drbg); - #else -- ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key, -- ssl_config->key_passwd); -+ ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->primary.key, -+ ssl_config->primary.key_passwd); - #endif - - if(ret) { - mbedtls_strerror(ret, errorbuf, sizeof(errorbuf)); - failf(data, "Error reading private key %s - mbedTLS: (-0x%04X) %s", -- ssl_config->key, -ret, errorbuf); -+ ssl_config->primary.key, -ret, errorbuf); - return CURLE_SSL_CERTPROBLEM; - } - #else -@@ -734,10 +734,10 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - #endif - } - else { -- const struct curl_blob *ssl_key_blob = ssl_config->key_blob; -+ const struct curl_blob *ssl_key_blob = ssl_config->primary.key_blob; - const unsigned char *key_data = - (const unsigned char *)ssl_key_blob->data; -- const char *passwd = ssl_config->key_passwd; -+ const char *passwd = ssl_config->primary.key_passwd; - #if MBEDTLS_VERSION_NUMBER >= 0x03000000 - ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len, - (const unsigned char *)passwd, -@@ -908,7 +908,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - NULL); - #endif - -- if(ssl_config->key || ssl_config->key_blob) { -+ if(ssl_config->primary.key || ssl_config->primary.key_blob) { - mbedtls_ssl_conf_own_cert(&backend->config, - &backend->clicert, &backend->pk); - } -diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c -index 1b0e8dd..ba15df8 100644 ---- a/lib/vtls/openssl.c -+++ b/lib/vtls/openssl.c -@@ -3487,7 +3487,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx, - const long int ssl_version_min = conn_config->version; - char * const ssl_cert = ssl_config->primary.clientcert; - const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob; -- const char * const ssl_cert_type = ssl_config->cert_type; -+ const char * const ssl_cert_type = ssl_config->primary.cert_type; - const bool verifypeer = conn_config->verifypeer; - char error_buffer[256]; - -@@ -3679,8 +3679,8 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx, - if(!result && - !cert_stuff(data, octx->ssl_ctx, - ssl_cert, ssl_cert_blob, ssl_cert_type, -- ssl_config->key, ssl_config->key_blob, -- ssl_config->key_type, ssl_config->key_passwd)) -+ ssl_config->primary.key, ssl_config->primary.key_blob, -+ ssl_config->primary.key_type, ssl_config->primary.key_passwd)) - result = CURLE_SSL_CERTPROBLEM; - if(result) - /* failf() is already done in cert_stuff() */ -diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c -index f4bbe4e..a97ff39 100644 ---- a/lib/vtls/schannel.c -+++ b/lib/vtls/schannel.c -@@ -587,8 +587,8 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf, - } - } - -- if((fInCert || blob) && (data->set.ssl.cert_type) && -- (!strcasecompare(data->set.ssl.cert_type, "P12"))) { -+ if((fInCert || blob) && (data->set.ssl.primary.cert_type) && -+ (!strcasecompare(data->set.ssl.primary.cert_type, "P12"))) { - failf(data, "schannel: certificate format compatibility error " - " for %s", - blob ? "(memory blob)" : data->set.ssl.primary.clientcert); -@@ -637,14 +637,14 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf, - datablob.pbData = (BYTE*)certdata; - datablob.cbData = (DWORD)certsize; - -- if(data->set.ssl.key_passwd) -- pwd_len = strlen(data->set.ssl.key_passwd); -+ if(data->set.ssl.primary.key_passwd) -+ pwd_len = strlen(data->set.ssl.primary.key_passwd); - pszPassword = (WCHAR*)malloc(sizeof(WCHAR)*(pwd_len + 1)); - if(pszPassword) { - if(pwd_len > 0) - str_w_len = MultiByteToWideChar(CP_UTF8, - MB_ERR_INVALID_CHARS, -- data->set.ssl.key_passwd, -+ data->set.ssl.primary.key_passwd, - (int)pwd_len, - pszPassword, (int)(pwd_len + 1)); - -diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c -index 61b407a..5ed2a56 100644 ---- a/lib/vtls/vtls.c -+++ b/lib/vtls/vtls.c -@@ -205,6 +205,7 @@ match_ssl_primary_config(struct Curl_easy *data, - blobcmp(c1->cert_blob, c2->cert_blob) && - blobcmp(c1->ca_info_blob, c2->ca_info_blob) && - blobcmp(c1->issuercert_blob, c2->issuercert_blob) && -+ blobcmp(c1->key_blob, c2->key_blob) && - Curl_safecmp(c1->CApath, c2->CApath) && - Curl_safecmp(c1->CAfile, c2->CAfile) && - Curl_safecmp(c1->issuercert, c2->issuercert) && -@@ -217,7 +218,11 @@ match_ssl_primary_config(struct Curl_easy *data, - strcasecompare(c1->cipher_list13, c2->cipher_list13) && - strcasecompare(c1->curves, c2->curves) && - strcasecompare(c1->CRLfile, c2->CRLfile) && -- strcasecompare(c1->pinned_key, c2->pinned_key)) -+ strcasecompare(c1->pinned_key, c2->pinned_key) && -+ strcasecompare(c1->cert_type, c2->cert_type) && -+ Curl_safecmp(c1->key, c2->key) && -+ strcasecompare(c1->key_type, c2->key_type) && -+ !Curl_timestrcmp(c1->key_passwd, c2->key_passwd)) - return TRUE; - - return FALSE; -@@ -252,6 +257,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source, - CLONE_BLOB(cert_blob); - CLONE_BLOB(ca_info_blob); - CLONE_BLOB(issuercert_blob); -+ CLONE_BLOB(key_blob); - CLONE_STRING(CApath); - CLONE_STRING(CAfile); - CLONE_STRING(issuercert); -@@ -261,6 +267,10 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source, - CLONE_STRING(pinned_key); - CLONE_STRING(curves); - CLONE_STRING(CRLfile); -+ CLONE_STRING(cert_type); -+ CLONE_STRING(key); -+ CLONE_STRING(key_type); -+ CLONE_STRING(key_passwd); - #ifdef USE_TLS_SRP - CLONE_STRING(username); - CLONE_STRING(password); -@@ -281,8 +291,13 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc) - Curl_safefree(sslc->cert_blob); - Curl_safefree(sslc->ca_info_blob); - Curl_safefree(sslc->issuercert_blob); -+ Curl_safefree(sslc->key_blob); - Curl_safefree(sslc->curves); - Curl_safefree(sslc->CRLfile); -+ Curl_safefree(sslc->cert_type); -+ Curl_safefree(sslc->key); -+ Curl_safefree(sslc->key_type); -+ Curl_safefree(sslc->key_passwd); - #ifdef USE_TLS_SRP - Curl_safefree(sslc->username); - Curl_safefree(sslc->password); -@@ -309,12 +324,12 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) - data->set.ssl.primary.username = data->set.str[STRING_TLSAUTH_USERNAME]; - data->set.ssl.primary.password = data->set.str[STRING_TLSAUTH_PASSWORD]; - #endif -- data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE]; -- data->set.ssl.key = data->set.str[STRING_KEY]; -- data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE]; -- data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD]; -+ data->set.ssl.primary.cert_type = data->set.str[STRING_CERT_TYPE]; -+ data->set.ssl.primary.key = data->set.str[STRING_KEY]; -+ data->set.ssl.primary.key_type = data->set.str[STRING_KEY_TYPE]; -+ data->set.ssl.primary.key_passwd = data->set.str[STRING_KEY_PASSWD]; - data->set.ssl.primary.clientcert = data->set.str[STRING_CERT]; -- data->set.ssl.key_blob = data->set.blobs[BLOB_KEY]; -+ data->set.ssl.primary.key_blob = data->set.blobs[BLOB_KEY]; - - #ifndef CURL_DISABLE_PROXY - data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY]; -@@ -334,12 +349,12 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data) - data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY]; - data->set.proxy_ssl.primary.CRLfile = - data->set.str[STRING_SSL_CRLFILE_PROXY]; -- data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY]; -- data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY]; -- data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY]; -- data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY]; -+ data->set.proxy_ssl.primary.cert_type = data->set.str[STRING_CERT_TYPE_PROXY]; -+ data->set.proxy_ssl.primary.key = data->set.str[STRING_KEY_PROXY]; -+ data->set.proxy_ssl.primary.key_type = data->set.str[STRING_KEY_TYPE_PROXY]; -+ data->set.proxy_ssl.primary.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY]; - data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY]; -- data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY]; -+ data->set.proxy_ssl.primary.key_blob = data->set.blobs[BLOB_KEY_PROXY]; - #ifdef USE_TLS_SRP - data->set.proxy_ssl.primary.username = - data->set.str[STRING_TLSAUTH_USERNAME_PROXY]; -diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c -index 3394cb2..9942eba 100644 ---- a/lib/vtls/wolfssl.c -+++ b/lib/vtls/wolfssl.c -@@ -1005,10 +1005,10 @@ wolfssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - #ifndef NO_FILESYSTEM - if(ssl_config->primary.cert_blob || ssl_config->primary.clientcert) { - const char *cert_file = ssl_config->primary.clientcert; -- const char *key_file = ssl_config->key; -+ const char *key_file = ssl_config->primary.key; - const struct curl_blob *cert_blob = ssl_config->primary.cert_blob; -- const struct curl_blob *key_blob = ssl_config->key_blob; -- int file_type = wolfssl_do_file_type(ssl_config->cert_type); -+ const struct curl_blob *key_blob = ssl_config->primary.key_blob; -+ int file_type = wolfssl_do_file_type(ssl_config->primary.cert_type); - int rc; - - switch(file_type) { -@@ -1039,7 +1039,7 @@ wolfssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - key_file = cert_file; - } - else -- file_type = wolfssl_do_file_type(ssl_config->key_type); -+ file_type = wolfssl_do_file_type(ssl_config->primary.key_type); - - rc = key_blob ? - wolfSSL_CTX_use_PrivateKey_buffer(backend->ctx, key_blob->data, -@@ -1053,8 +1053,8 @@ wolfssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - #else /* NO_FILESYSTEM */ - if(ssl_config->primary.cert_blob) { - const struct curl_blob *cert_blob = ssl_config->primary.cert_blob; -- const struct curl_blob *key_blob = ssl_config->key_blob; -- int file_type = wolfssl_do_file_type(ssl_config->cert_type); -+ const struct curl_blob *key_blob = ssl_config->primary.key_blob; -+ int file_type = wolfssl_do_file_type(ssl_config->primary.cert_type); - int rc; - - switch(file_type) { -@@ -1079,7 +1079,7 @@ wolfssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data) - if(!key_blob) - key_blob = cert_blob; - else -- file_type = wolfssl_do_file_type(ssl_config->key_type); -+ file_type = wolfssl_do_file_type(ssl_config->primary.key_type); - - if(wolfSSL_CTX_use_PrivateKey_buffer(backend->ctx, key_blob->data, - (long)key_blob->len, -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index a3778bda..cde5c287 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -272,1 +272,1 @@ --test3201 test3202 test3203 test3204 test3205 test3207 -+test3201 test3202 test3203 test3204 test3205 test3207 test3303 - - EXTRA_DIST = $(TESTCASES) DISABLED - -diff --git a/tests/data/test3303 b/tests/data/test3303 -new file mode 100644 -index 000000000000..8a7cf1b12345 ---- /dev/null -+++ b/tests/data/test3303 -@@ -0,0 +1,20 @@ -+ -+ -+ -+ -+unittest -+TLS -+mTLS -+ -+ -+ -+# -+Client-side -+ -+ -+unittest -+ -+ -+conn-reuse match distinguishes mTLS key, cert_type, key_type and key_passwd fields -+ -+ -+ -diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc -index 1234567..abcdefg 100644 ---- a/tests/unit/Makefile.inc -+++ b/tests/unit/Makefile.inc -@@ -145,3 +145,5 @@ - unit3200_SOURCES = unit3200.c $(UNITFILES) - - unit3205_SOURCES = unit3205.c $(UNITFILES) -+ -+unit3303_SOURCES = unit3303.c $(UNITFILES) - -diff --git a/tests/unit/unit3303.c b/tests/unit/unit3303.c -new file mode 100644 -index 000000000000..41bced542d62 ---- /dev/null -+++ b/tests/unit/unit3303.c -@@ -0,0 +1,127 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+#include "unitcheck.h" -+#include "urldata.h" -+ -+#ifdef USE_SSL -+#include "vtls/vtls.h" -+#endif -+ -+static CURLcode test_unit3303(const char *arg) -+{ -+ UNITTEST_BEGIN_SIMPLE -+ -+#ifdef USE_SSL -+ { -+ CURL *curl; -+ struct connectdata *conn; -+ struct ssl_primary_config *primary; -+ char *saved; -+ static char alt_passwd[] = "wrong"; -+ static char alt_key[] = "other.key"; -+ static char alt_ktype[] = "DER"; -+ static char alt_ctype[] = "P12"; -+ -+ curl_global_init(CURL_GLOBAL_ALL); -+ curl = curl_easy_init(); -+ if(!curl) { -+ curl_global_cleanup(); -+ goto unit_test_abort; -+ } -+ -+ curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem"); -+ curl_easy_setopt(curl, CURLOPT_SSLKEY, "client.key"); -+ curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "secret"); -+ curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM"); -+ curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM"); -+ -+ if(Curl_ssl_easy_config_complete((struct Curl_easy *)curl)) { -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ goto unit_test_abort; -+ } -+ -+ conn = curlx_calloc(1, sizeof(*conn)); -+ if(!conn || Curl_ssl_conn_config_init((struct Curl_easy *)curl, conn)) { -+ if(conn) -+ Curl_ssl_conn_config_cleanup(conn); -+ curlx_free(conn); -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ goto unit_test_abort; -+ } -+ -+ /* Baseline: identical config must match. */ -+ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, -+ FALSE), -+ "identical mTLS config should match"); -+ -+ primary = &((struct Curl_easy *)curl)->set.ssl.primary; -+ -+ /* Different key_passwd must not match. */ -+ saved = primary->key_passwd; -+ primary->key_passwd = alt_passwd; -+ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, -+ FALSE), -+ "different key_passwd must not reuse conn"); -+ primary->key_passwd = saved; -+ -+ /* Different key path must not match. */ -+ saved = primary->key; -+ primary->key = alt_key; -+ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, -+ FALSE), -+ "different key must not reuse conn"); -+ primary->key = saved; -+ -+ /* Different key type must not match. */ -+ saved = primary->key_type; -+ primary->key_type = alt_ktype; -+ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, -+ FALSE), -+ "different key_type must not reuse conn"); -+ primary->key_type = saved; -+ -+ /* Different cert type must not match. */ -+ saved = primary->cert_type; -+ primary->cert_type = alt_ctype; -+ fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, -+ FALSE), -+ "different cert_type must not reuse conn"); -+ primary->cert_type = saved; -+ -+ /* All fields restored: must match again. */ -+ fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn, -+ FALSE), -+ "restored mTLS config should match"); -+ -+ Curl_ssl_conn_config_cleanup(conn); -+ curlx_free(conn); -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ } -+#endif /* USE_SSL */ -+ -+ UNITTEST_END_SIMPLE -+} --- -2.45.4 - diff --git a/SPECS/curl/CVE-2026-9079.patch b/SPECS/curl/CVE-2026-9079.patch deleted file mode 100644 index 8d8abe5d3fb..00000000000 --- a/SPECS/curl/CVE-2026-9079.patch +++ /dev/null @@ -1,294 +0,0 @@ -From 30e02394c6e21f41f90f2470dcaee671e42c654a Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Wed, 8 Jul 2026 11:02:17 +0000 -Subject: [PATCH] setopt: clear proxy auth properly on NULL - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/curl/curl/commit/88c7e16cceec816a2df45c89.patch ---- - lib/setopt.c | 10 ++- - tests/data/Makefile.am | 2 +- - tests/data/test1648 | 63 ++++++++++++++++ - tests/libtest/Makefile.inc | 5 ++++- - tests/libtest/lib1648.c | 144 +++++++++++++++++++++++++++++++++++++ - 5 files changed, 219 insertions(+), 5 deletions(-) - create mode 100644 tests/data/test1648 - create mode 100644 tests/libtest/lib1648.c - -diff --git a/lib/setopt.c b/lib/setopt.c -index 6b8cbb3..338de55 100644 ---- a/lib/setopt.c -+++ b/lib/setopt.c -@@ -2172,9 +2172,13 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option, - result = setstropt_userpwd(ptr, &u, &p); - - /* URL decode the components */ -- if(!result && u) -- result = Curl_urldecode(u, 0, &data->set.str[STRING_PROXYUSERNAME], NULL, -- REJECT_ZERO); -+ if(!result) { -+ Curl_safefree(data->set.str[STRING_PROXYUSERNAME]); -+ Curl_safefree(data->set.str[STRING_PROXYPASSWORD]); -+ if(u) -+ result = Curl_urldecode(u, 0, &data->set.str[STRING_PROXYUSERNAME], NULL, -+ REJECT_ZERO); -+ } - if(!result && p) - result = Curl_urldecode(p, 0, &data->set.str[STRING_PROXYPASSWORD], NULL, - REJECT_ZERO); -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 3aea27d..c934aa4 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -216,7 +216,7 @@ test1616 \ - test1620 test1621 \ - \ - test1630 test1631 test1632 test1633 test1634 test1635 \ --test1647 \ -+test1647 test1648 \ - \ - test1650 test1651 test1652 test1653 test1654 test1655 test1656 \ - test1660 test1661 test1662 test1663 \ -diff --git a/tests/data/test1648 b/tests/data/test1648 -new file mode 100644 -index 0000000..623f3c9 ---- /dev/null -+++ b/tests/data/test1648 -@@ -0,0 +1,63 @@ -+ -+ -+ -+ -+HTTP -+HTTP GET -+HTTP proxy -+HTTP proxy auth -+ -+ -+ -+# Server-side -+ -+ -+# this is returned first since we get no proxy-auth -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+And you should ignore this data. -+ -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+# tool is what to use instead of 'curl' -+ -+lib%TESTNUMBER -+ -+ -+proxy -+ -+ -+HTTP proxy with auth, change proxy, clear auth -+ -+ -+%HOSTIP %HTTPPORT -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://example.com/ HTTP/1.1 -+Host: example.com -+Proxy-Authorization: Basic %b64[victim:secret]b64% -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://example.com/ HTTP/1.1 -+Host: example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index ce0d6bb..a7e5e05 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -67,7 +67,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ - lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \ - lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 lib1588 \ - lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ -- lib1647 \ -+ lib1647 lib1648 \ - \ - lib1662 \ - \ -@@ -550,4 +550,7 @@ - lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib1647_LDADD = $(TESTUTIL_LIBS) -+ -+lib1648_SOURCES = lib1648.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) -+lib1648_LDADD = $(TESTUTIL_LIBS) - - lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) -diff --git a/tests/libtest/lib1648.c b/tests/libtest/lib1648.c -new file mode 100644 -index 0000000..5b5186a ---- /dev/null -+++ b/tests/libtest/lib1648.c -@@ -0,0 +1,144 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+/* -+ * URL = host -+ * arg2 = port -+ */ -+ -+#include "test.h" -+#include "testutil.h" -+#include "warnless.h" -+#include "memdebug.h" -+ -+/* this is meant to pick up the proxy from the environment variable */ -+static CURLcode init1648(CURL *curl, const char *url, const char *proxy) -+{ -+ CURLcode result = CURLE_OK; -+ -+ easy_setopt(curl, CURLOPT_URL, url); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_PROXY, proxy); -+ if(result) -+ goto init_failed; -+ -+ easy_setopt(curl, CURLOPT_VERBOSE, 1L); -+ if(result) -+ goto init_failed; -+ -+ return CURLE_OK; /* success */ -+ -+init_failed: -+ return result; /* failure */ -+} -+ -+static CURLcode run1648(CURL *curl, const char *url, const char *userpwd) -+{ -+ CURLcode result = CURLE_OK; -+ -+ result = init1648(curl, url, userpwd); -+ if(result) -+ return result; -+ -+ return curl_easy_perform(curl); -+} -+ -+#define GET_THIS "http://example.com/" -+ -+/* -+ * First get the URL over 'firstproxy' with auth. -+ * Then clear the auth and get the URL again over 'secondproxy'. -+ */ -+static CURLcode test_lib1648(const char *hostip) -+{ -+ CURLcode result = CURLE_OK; -+ CURL *curl = NULL; -+ struct curl_slist *host = NULL; -+ struct curl_slist *host2 = NULL; -+ char proxy1_resolve[128]; -+ char proxy2_resolve[128]; -+ char proxy1_connect[128]; -+ char proxy2_connect[128]; -+ -+ msnprintf(proxy1_resolve, sizeof(proxy1_resolve), -+ "firstproxy:%s:%s", libtest_arg2, hostip); -+ msnprintf(proxy2_resolve, sizeof(proxy2_resolve), -+ "secondproxy:%s:%s", libtest_arg2, hostip); -+ -+ /* we connect to the fake host name but the right port number */ -+ msnprintf(proxy1_connect, sizeof(proxy1_connect), -+ "firstproxy:%s", libtest_arg2); -+ msnprintf(proxy2_connect, sizeof(proxy2_connect), -+ "secondproxy:%s", libtest_arg2); -+ -+ global_init(CURL_GLOBAL_ALL); -+ if(result) -+ return result; -+ -+ easy_init(curl); -+ if(!curl) { -+ fprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ host = curl_slist_append(NULL, proxy1_resolve); -+ if(!host) -+ goto test_cleanup; -+ host2 = curl_slist_append(host, proxy2_resolve); -+ if(!host2) -+ goto test_cleanup; -+ host = host2; -+ -+ start_test_timing(); -+ -+ easy_setopt(curl, CURLOPT_RESOLVE, host); -+ easy_setopt(curl, CURLOPT_PROXYUSERPWD, "victim:secret"); -+ -+ fprintf(stderr, "--- First get over %s\n", proxy1_connect); -+ result = run1648(curl, GET_THIS, proxy1_connect); -+ if(result) -+ goto test_cleanup; -+ -+ easy_setopt(curl, CURLOPT_PROXYUSERPWD, NULL); -+ -+ fprintf(stderr, "--- Then over '%s'\n", proxy2_connect); -+ result = run1648(curl, GET_THIS, proxy2_connect); -+ -+test_cleanup: -+ -+ /* proper cleanup sequence - type PB */ -+ -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ curl_slist_free_all(host); -+ return result; -+} -+ -+CURLcode test(char *URL) -+{ -+ (void)URL; -+ return test_lib1648(libtest_arg1); -+} --- -2.45.4 - diff --git a/SPECS/curl/curl.signatures.json b/SPECS/curl/curl.signatures.json index 91181302c3b..56d1009abd8 100644 --- a/SPECS/curl/curl.signatures.json +++ b/SPECS/curl/curl.signatures.json @@ -1,5 +1,5 @@ { "Signatures": { - "curl-8.11.1.tar.gz": "a889ac9dbba3644271bd9d1302b5c22a088893719b72be3487bc3d401e5c4e80" + "curl-8.21.0.tar.gz": "d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb" } -} \ No newline at end of file +} diff --git a/SPECS/curl/curl.spec b/SPECS/curl/curl.spec index 13edc912f64..9154a3a3140 100644 --- a/SPECS/curl/curl.spec +++ b/SPECS/curl/curl.spec @@ -1,35 +1,13 @@ Summary: An URL retrieval utility and library Name: curl -Version: 8.11.1 -Release: 10%{?dist} +Version: 8.21.0 +Release: 1%{?dist} License: curl Vendor: Microsoft Corporation Distribution: Azure Linux Group: System Environment/NetworkingLibraries URL: https://curl.haxx.se Source0: https://curl.haxx.se/download/%{name}-%{version}.tar.gz -Patch0: CVE-2025-0665.patch -Patch1: CVE-2025-0167.patch -Patch2: CVE-2025-0725.patch -Patch3: CVE-2025-10148.patch -Patch4: CVE-2025-14017.patch -Patch5: CVE-2026-1965.patch -Patch6: CVE-2026-3783.patch -Patch7: CVE-2026-3784.patch -Patch8: CVE-2026-4873.patch -Patch9: CVE-2026-6276.patch -Patch10: CVE-2026-7168.patch -Patch11: CVE-2026-5545.patch -Patch12: CVE-2026-6253.patch -Patch13: CVE-2026-6429.patch -Patch14: CVE-2026-12064.patch -Patch15: CVE-2026-8926.patch -Patch16: CVE-2026-8927.patch -Patch17: CVE-2026-8932.patch -Patch18: CVE-2026-8458.patch -Patch19: CVE-2026-10536.patch -Patch20: CVE-2026-8286.patch -Patch21: CVE-2026-9079.patch BuildRequires: krb5-devel BuildRequires: libnghttp2-devel BuildRequires: libssh2-devel @@ -119,6 +97,10 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_libdir}/libcurl.so.* %changelog +* Tue Jul 14 2026 Vijayender Putta - 8.21.0-1 +- Upgrade to 8.21.0 +- Dropped CVE-2025-0167, CVE-2025-0665, CVE-2025-0725 CVE-2025-10148, CVE-2025-14017, CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, CVE-2026-4873, CVE-2026-5545, CVE-2026-6253, CVE-2026-6276, CVE-2026-6429, CVE-2026-7168, CVE-2026-12064, CVE-2026-8926, CVE-2026-8927, CVE-2026-8932, CVE-2026-8458, CVE-2026-10536, CVE-2026-8286, CVE-2026-9079 patches, dropped patches are covered in this version. + * Tue Jul 07 2026 Azure Linux Security Servicing Account - 8.11.1-10 - Patch for CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-12064, CVE-2026-8458, CVE-2026-9079, CVE-2026-8286, CVE-2026-10536 diff --git a/cgmanifest.json b/cgmanifest.json index 583b7ddd2d0..1b5e903d755 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -2447,8 +2447,8 @@ "type": "other", "other": { "name": "curl", - "version": "8.11.1", - "downloadUrl": "https://curl.haxx.se/download/curl-8.11.1.tar.gz" + "version": "8.21.0", + "downloadUrl": "https://curl.haxx.se/download/curl-8.21.0.tar.gz" } } }, diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 91f472d3e12..cafcaafbe4f 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -199,9 +199,9 @@ krb5-1.21.3-5.azl3.aarch64.rpm krb5-devel-1.21.3-5.azl3.aarch64.rpm nghttp2-1.61.0-3.azl3.aarch64.rpm nghttp2-devel-1.61.0-3.azl3.aarch64.rpm -curl-8.11.1-10.azl3.aarch64.rpm -curl-devel-8.11.1-10.azl3.aarch64.rpm -curl-libs-8.11.1-10.azl3.aarch64.rpm +curl-8.21.0-1.azl3.aarch64.rpm +curl-devel-8.21.0-1.azl3.aarch64.rpm +curl-libs-8.21.0-1.azl3.aarch64.rpm createrepo_c-1.0.3-1.azl3.aarch64.rpm libxml2-2.11.5-10.azl3.aarch64.rpm libxml2-devel-2.11.5-10.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index b766df23305..2f60e382081 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -199,9 +199,9 @@ krb5-1.21.3-5.azl3.x86_64.rpm krb5-devel-1.21.3-5.azl3.x86_64.rpm nghttp2-1.61.0-3.azl3.x86_64.rpm nghttp2-devel-1.61.0-3.azl3.x86_64.rpm -curl-8.11.1-10.azl3.x86_64.rpm -curl-devel-8.11.1-10.azl3.x86_64.rpm -curl-libs-8.11.1-10.azl3.x86_64.rpm +curl-8.21.0-1.azl3.x86_64.rpm +curl-devel-8.21.0-1.azl3.x86_64.rpm +curl-libs-8.21.0-1.azl3.x86_64.rpm createrepo_c-1.0.3-1.azl3.x86_64.rpm libxml2-2.11.5-10.azl3.x86_64.rpm libxml2-devel-2.11.5-10.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 899ed1aa0e4..8133df15ba3 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -67,10 +67,10 @@ cracklib-lang-2.9.11-1.azl3.aarch64.rpm createrepo_c-1.0.3-1.azl3.aarch64.rpm createrepo_c-debuginfo-1.0.3-1.azl3.aarch64.rpm createrepo_c-devel-1.0.3-1.azl3.aarch64.rpm -curl-8.11.1-10.azl3.aarch64.rpm -curl-debuginfo-8.11.1-10.azl3.aarch64.rpm -curl-devel-8.11.1-10.azl3.aarch64.rpm -curl-libs-8.11.1-10.azl3.aarch64.rpm +curl-8.21.0-1.azl3.aarch64.rpm +curl-debuginfo-8.21.0-1.azl3.aarch64.rpm +curl-devel-8.21.0-1.azl3.aarch64.rpm +curl-libs-8.21.0-1.azl3.aarch64.rpm Cython-debuginfo-3.0.5-3.azl3.aarch64.rpm debugedit-5.0-2.azl3.aarch64.rpm debugedit-debuginfo-5.0-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 0748ab677d8..ab4f38e4619 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -72,10 +72,10 @@ createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm cross-binutils-common-2.41-13.azl3.noarch.rpm cross-gcc-common-13.2.0-7.azl3.noarch.rpm -curl-8.11.1-10.azl3.x86_64.rpm -curl-debuginfo-8.11.1-10.azl3.x86_64.rpm -curl-devel-8.11.1-10.azl3.x86_64.rpm -curl-libs-8.11.1-10.azl3.x86_64.rpm +curl-8.21.0-1.azl3.x86_64.rpm +curl-debuginfo-8.21.0-1.azl3.x86_64.rpm +curl-devel-8.21.0-1.azl3.x86_64.rpm +curl-libs-8.21.0-1.azl3.x86_64.rpm Cython-debuginfo-3.0.5-3.azl3.x86_64.rpm debugedit-5.0-2.azl3.x86_64.rpm debugedit-debuginfo-5.0-2.azl3.x86_64.rpm