import UBI curl-7.76.1-40.el9_8.5

SOURCES/0007-curl-7.76.1-CVE-2026-1965.patch

@@ -0,0 +1,87 @@
+--- a/lib/url.c	2026-07-16 11:32:28.612100711 +0000
++++ b/lib/url.c	2026-07-16 11:33:03.420950793 +0000
+@@ -1119,6 +1119,20 @@ ConnectionExists(struct Curl_easy *data,
+ #endif
+ #endif
+ 
++#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
++  bool wantNegoHTTP = ((data->state.authhost.want & CURLAUTH_NEGOTIATE) &&
++                       (needle->handler->protocol & PROTO_FAMILY_HTTP));
++#ifndef CURL_DISABLE_PROXY
++  bool wantProxyNegoHTTP = (needle->bits.proxy_user_passwd &&
++                            ((data->state.authproxy.want &
++                              CURLAUTH_NEGOTIATE) &&
++                             (needle->handler->protocol &
++                              PROTO_FAMILY_HTTP)));
++#else
++  bool wantProxyNegoHTTP = FALSE;
++#endif
++#endif
++
+   *force_reuse = FALSE;
+   *waitpipe = FALSE;
+ 
+@@ -1457,6 +1471,63 @@ ConnectionExists(struct Curl_easy *data,
+             /* We must use this connection, no other */
+             *force_reuse = TRUE;
+             break;
++          }
++
++          /* Continue look up for a better connection */
++          continue;
++        }
++#endif
++
++#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
++        /* If we are looking for an HTTP+Negotiate connection, check if this
++           is already authenticating with the right credentials. If not, keep
++           looking so that we can reuse Negotiate connections if possible. */
++        if(wantNegoHTTP) {
++          if(check->http_negotiate_state == GSS_AUTHNONE) {
++            /* Auth not started - safe to reuse and upgrade credentials */
++          }
++          else if(Curl_timestrcmp(needle->user, check->user) ||
++                  Curl_timestrcmp(needle->passwd, check->passwd))
++            continue;
++        }
++        else if(check->http_negotiate_state != GSS_AUTHNONE) {
++          /* Connection is using Negotiate auth but we don't want Negotiate */
++          continue;
++        }
++
++#ifndef CURL_DISABLE_PROXY
++        /* Same for Proxy Negotiate authentication */
++        if(wantProxyNegoHTTP) {
++          if(check->proxy_negotiate_state == GSS_AUTHNONE) {
++            /* Proxy auth not started - safe to reuse and upgrade creds */
++          }
++          else {
++            if(!check->http_proxy.user || !check->http_proxy.passwd)
++              continue;
++
++            if(Curl_timestrcmp(needle->http_proxy.user,
++                               check->http_proxy.user) ||
++               Curl_timestrcmp(needle->http_proxy.passwd,
++                               check->http_proxy.passwd))
++              continue;
++          }
++        }
++        else if(check->proxy_negotiate_state != GSS_AUTHNONE) {
++          /* Proxy connection is using Negotiate auth but we don't want it */
++          continue;
++        }
++#endif
++        if(wantNegoHTTP || wantProxyNegoHTTP) {
++          /* Credentials are already checked, we can use this connection */
++          chosen = check;
++
++          if((wantNegoHTTP &&
++             (check->http_negotiate_state != GSS_AUTHNONE)) ||
++              (wantProxyNegoHTTP &&
++               (check->proxy_negotiate_state != GSS_AUTHNONE))) {
++            /* We must use this connection, no other */
++            *force_reuse = TRUE;
++            break;
+           }
+ 
+           /* Continue look up for a better connection */

SOURCES/0008-curl-7.76.1-CVE-2026-3783.patch

@@ -0,0 +1,14 @@
+--- a/lib/http.c	2026-07-16 11:32:28.622100955 +0000
++++ b/lib/http.c	2026-07-16 11:33:39.575833748 +0000
+@@ -741,8 +741,9 @@ output_auth_headers(struct Curl_easy *da
+   }
+   if(authstatus->picked == CURLAUTH_BEARER) {
+     /* Bearer */
+-    if((!proxy && data->set.str[STRING_BEARER] &&
+-        !Curl_checkheaders(data, "Authorization:"))) {
++    if(!proxy && data->set.str[STRING_BEARER] &&
++       Curl_allow_auth_to_host(data) &&
++       !Curl_checkheaders(data, "Authorization:")) {
+       auth = "Bearer";
+       result = http_output_bearer(data);
+       if(result)

SOURCES/0044-curl-7.76.1-CVE-2026-9547.patch

@@ -0,0 +1,28 @@
+From 0b8dbbc63c98777e4584cb9fbd71df3464008ad1 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Fri, 22 May 2026 09:48:15 +0200
+Subject: [PATCH] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
+
+Host key type mismatch from libssh was incorrectly reported as missing,
+causing key callbacks to accept instead of reject.
+
+Upstream-commit: 0b8dbbc63c98777e4584cb9fbd71df3464008ad1
+Resolves: CVE-2026-9547
+
+---
+ lib/vssh/libssh.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -432,7 +432,8 @@
+       keymatch = CURLKHMATCH_OK;
+       break;
+     case SSH_KNOWN_HOSTS_OTHER:
+-      /* fallthrough */
++      keymatch = CURLKHMATCH_MISMATCH;
++      break;
+     case SSH_KNOWN_HOSTS_NOT_FOUND:
+       /* fallthrough */
+     case SSH_KNOWN_HOSTS_UNKNOWN:

SOURCES/0045-curl-7.76.1-CVE-2026-8286.patch

@@ -0,0 +1,53 @@
+From a86efdd7ca5433de9231e650f18247de8319ad16 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Also reject non-TLS connections when the transfer requires TLS via
+STARTTLS (use_ssl >= CURLUSESSL_CONTROL).
+
+Adapted from upstream commit a86efdd7ca5433de9231e650f18247de8319ad16
+for the ConnectionExists() function in curl 7.76.1.
+
+Upstream-commit: a86efdd7ca5433de9231e650f18247de8319ad16
+Resolves: CVE-2026-8286
+
+---
+ lib/url.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1232,6 +1232,13 @@
+           /* except protocols that have been upgraded via TLS */
+           continue;
+
++      /* For STARTTLS protocols that require TLS, reject non-TLS connections */
++      if(data->set.use_ssl >= CURLUSESSL_CONTROL &&
++         !(needle->handler->flags & PROTOPT_SSL) &&
++         check->ssl[FIRSTSOCKET].state != ssl_connection_complete &&
++         !check->bits.tls_upgraded)
++        continue;
++
+ #ifndef CURL_DISABLE_PROXY
+       if(needle->bits.httpproxy != check->bits.httpproxy ||
+          needle->bits.socksproxy != check->bits.socksproxy)
+@@ -1369,9 +1376,10 @@
+           /* The schemes match or the protocol family is the same and the
+              previous connection was TLS upgraded, and the hostname and host
+              port match */
+-          if(needle->handler->flags & PROTOPT_SSL) {
+-            /* This is a SSL connection so verify that we're using the same
+-               SSL options as well */
++          if((needle->handler->flags & PROTOPT_SSL) ||
++             data->set.use_ssl > CURLUSESSL_NONE) {
++            /* This is a SSL or STARTTLS connection so verify that we're
++               using the same SSL options as well */
+             if(!Curl_ssl_config_matches(&needle->ssl_config,
+                                         &check->ssl_config)) {
+               DEBUGF(infof(data,

SPECS/curl.spec

@@ -1,7 +1,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 7.76.1
-Release: 40%{?dist}
+Release: 40%{?dist}.5
 License: MIT
 Source: https://curl.se/download/%{name}-%{version}.tar.xz
 
@@ -131,6 +131,18 @@ Patch042: 0042-curl-7.76.1-respect-system-crypto-policy.patch
 # http: fix crash in rate-limited upload
 Patch043: 0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch
 
+# vssh: fix SSH host key mismatch on type difference (CVE-2026-9547)
+Patch044: 0044-curl-7.76.1-CVE-2026-9547.patch
+
+# url: reject TLS-to-cleartext STARTTLS connection reuse (CVE-2026-8286)
+Patch045: 0045-curl-7.76.1-CVE-2026-8286.patch
+
+# url: fix reuse of connections using HTTP Negotiate (CVE-2026-1965)
+Patch046: 0007-curl-7.76.1-CVE-2026-1965.patch
+
+# http: only send bearer if auth is allowed (CVE-2026-3783)
+Patch047: 0008-curl-7.76.1-CVE-2026-3783.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -348,6 +360,10 @@ be installed.
 %patch -P 41 -p1
 %patch -P 42 -p1
 %patch -P 43 -p1
+%patch -P 44 -p1
+%patch -P 45 -p1
+%patch -P 46 -p1
+%patch -P 47 -p1
 
 # Fedora patches
 %patch -P 101 -p1
@@ -379,6 +395,16 @@ printf "702\n703\n716\n" >> tests/data/DISABLED
 printf "2034\n2037\n2041\n" >> tests/data/DISABLED
 %endif
 
+# temporarily disable tests 3000 and 3001 on i686 (flaky stunnel startup)
+%ifarch i686
+printf "3000\n3001\n" >> tests/data/DISABLED
+%endif
+
+# temporarily disable test 1206 on x86_64 (flaky FTP PORT timeout under valgrind)
+%ifarch x86_64
+echo "1206" >> tests/data/DISABLED
+%endif
+
 # adapt test 323 for updated OpenSSL
 sed -e 's|^35$|35,52|' -i tests/data/test323
 
@@ -573,6 +599,21 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
+* Thu Jul 23 2026 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-40.el9_8.5
+- fix missing %%patch macros for Patch46 and Patch47
+
+* Wed Jul 22 2026 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-40.el9_8.4
+- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
+- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
+- tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)
+
+* Tue Jul 14 2026 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-40.3
+- tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)
+
+* Mon Jul 13 2026 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-40.1
+- fix SSH host key mismatch on type difference (CVE-2026-9547)
+- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)
+
 * Wed Jan 21 2026 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-40
 - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721)