linux/poky.git/meta/recipes-support/curl, branch scarthgap

curl: patch CVE-2026-3784

2026-05-04T12:57:30+00:00

pick patch from ubuntu per [1] [1] http://archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.5.0-2ubuntu10.8.debian.tar.xz [2] https://ubuntu.com/security/CVE-2026-3784 [3] https://curl.se/docs/CVE-2026-3784.html (From OE-Core rev: 1142953d395cd8de187fbd0dc8c143b953c42612) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

curl: patch CVE-2026-3783

2026-05-04T12:57:30+00:00

pick patches from ubuntu per [1] [1] http://archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.5.0-2ubuntu10.8.debian.tar.xz [2] https://ubuntu.com/security/CVE-2026-3783 [3] https://curl.se/docs/CVE-2026-3783.html (From OE-Core rev: f09125ca033126260c3d66daaa04fffb0d1480f3) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

curl: patch CVE-2026-1965

2026-05-04T12:57:30+00:00

pick patches from ubuntu per [1] [1] http://archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.5.0-2ubuntu10.8.debian.tar.xz [2] https://ubuntu.com/security/CVE-2026-1965 [3] https://curl.se/docs/CVE-2026-1965.html (From OE-Core rev: 0fc5d35a56900701b5ec8b53646448dd5fac537a) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

curl: patch CVE-2025-14524

2026-02-16T09:52:34+00:00

(From OE-Core rev: 951113a6e8185969444b5e28292f23434dba1f6c) Signed-off-by: Amaury Couderc Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

curl: fix CVE-2025-10148

2026-02-16T09:52:34+00:00

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-10148 Upstream patch: https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa (From OE-Core rev: 3793ee12d8da4f8f90a0ffcad180ef8122251491) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

curl: patch CVE-2025-15224

2026-01-26T09:45:39+00:00

Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-15224.html (From OE-Core rev: 83c7d4acc5da661b44055db95355c3c420f7afac) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

curl: patch CVE-2025-15079

2026-01-26T09:45:39+00:00

Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-15079.html (From OE-Core rev: 48a162d90daada0f992e665696f7f2e738780af1) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

curl: patch CVE-2025-14819

2026-01-26T09:45:39+00:00

Pick patch per [1]. Additionally pick commit with definition of CURL_UNCONST to make the cherry-pick possible without build errors. It will be probably needed also by further CVE patches. [1] https://curl.se/docs/CVE-2025-14819.html (From OE-Core rev: 3a8e5ae08380ca201df950546dd5f02f9bbe1237) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

curl: patch CVE-2025-14017

2026-01-26T09:45:39+00:00

Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-14017.html (From OE-Core rev: 2284de47317ada818f916be65abf13969294541c) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

curl: Use host CA bundle by default for native(sdk) builds

2025-12-31T15:49:31+00:00

Fixes YOCTO #16077 Commit 0f98fecd (a backport of 4909a46e) broke HTTPS downloads in opkg in the SDK, they now fail with: > SSL certificate problem: self-signed certificate in certificate chain The root cause is a difference in the handling of related env vars between curl-cli and libcurl. The CLI will honour CURL_CA_BUNDLE and SSL_CERT_DIR|FILE (see [0]). Those are set in the SDK via env setup scripts like [1], so curl continued to work. The library however does not handle those env vars. Thus, unless the program utilizing libcurl has implemented a similar mechanism itself and configures libcurl accordingly via the API (like for example Git in [2] and [3]), there will be no default CA bundle configured to verify certificates against. Opkg only supports setting the CA bundle path via config options 'ssl_ca_file' and 'ssl_ca_path'. Upstreaming and then backporting a patch to add env var support is not a feasible short-time fix for the issue at hand. Instead it's better to ship libcurl in the SDK with a sensible built-in default - which also helps any other libcurl users. This patch is based on a proposal by Peter.Marko@siemens.com in the related mailing list discussion at [4]. (cherry picked from commit 3f819f57aa1960af36ac0448106d1dce7f38c050) [0]: https://github.com/curl/curl/blob/400fffa90f30c7a2dc762fa33009d24851bd2016/src/tool_operate.c#L2056-L2084 [1]: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl/environment.d-curl.sh?id=3a15ca2a784539098e95a3a06dec7c39f23db985 [2]: https://github.com/git/git/blob/6ab38b7e9cc7adafc304f3204616a4debd49c6e9/http.c#L1389 [3]: https://github.com/git/git/blob/6ab38b7e9cc7adafc304f3204616a4debd49c6e9/http.c#L1108-L1109 [4]: https://lists.openembedded.org/g/openembedded-core/topic/115993530#msg226751 (From OE-Core rev: 0e553b685c0a987a7be1eee16b7b5e3e48a036e2) Signed-off-by: Moritz Haase CC: matthias.schiffer@ew.tq-group.com CC: Peter.Marko@siemens.com Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman