diff --git a/SOURCES/0007-curl-7.76.1-CVE-2026-1965.patch b/SOURCES/0007-curl-7.76.1-CVE-2026-1965.patch new file mode 100644 index 0000000..e0b0970 --- /dev/null +++ b/SOURCES/0007-curl-7.76.1-CVE-2026-1965.patch @@ -0,0 +1,87 @@ +--- a/lib/url.c 2026-07-16 11:32:28.612100711 +0000 ++++ b/lib/url.c 2026-07-16 11:33:03.420950793 +0000 +@@ -1119,6 +1119,20 @@ ConnectionExists(struct Curl_easy *data, + #endif + #endif + ++#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO) ++ bool wantNegoHTTP = ((data->state.authhost.want & CURLAUTH_NEGOTIATE) && ++ (needle->handler->protocol & PROTO_FAMILY_HTTP)); ++#ifndef CURL_DISABLE_PROXY ++ bool wantProxyNegoHTTP = (needle->bits.proxy_user_passwd && ++ ((data->state.authproxy.want & ++ CURLAUTH_NEGOTIATE) && ++ (needle->handler->protocol & ++ PROTO_FAMILY_HTTP))); ++#else ++ bool wantProxyNegoHTTP = FALSE; ++#endif ++#endif ++ + *force_reuse = FALSE; + *waitpipe = FALSE; + +@@ -1457,6 +1471,63 @@ ConnectionExists(struct Curl_easy *data, + /* We must use this connection, no other */ + *force_reuse = TRUE; + break; ++ } ++ ++ /* Continue look up for a better connection */ ++ continue; ++ } ++#endif ++ ++#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO) ++ /* If we are looking for an HTTP+Negotiate connection, check if this ++ is already authenticating with the right credentials. If not, keep ++ looking so that we can reuse Negotiate connections if possible. */ ++ if(wantNegoHTTP) { ++ if(check->http_negotiate_state == GSS_AUTHNONE) { ++ /* Auth not started - safe to reuse and upgrade credentials */ ++ } ++ else if(Curl_timestrcmp(needle->user, check->user) || ++ Curl_timestrcmp(needle->passwd, check->passwd)) ++ continue; ++ } ++ else if(check->http_negotiate_state != GSS_AUTHNONE) { ++ /* Connection is using Negotiate auth but we don't want Negotiate */ ++ continue; ++ } ++ ++#ifndef CURL_DISABLE_PROXY ++ /* Same for Proxy Negotiate authentication */ ++ if(wantProxyNegoHTTP) { ++ if(check->proxy_negotiate_state == GSS_AUTHNONE) { ++ /* Proxy auth not started - safe to reuse and upgrade creds */ ++ } ++ else { ++ if(!check->http_proxy.user || !check->http_proxy.passwd) ++ continue; ++ ++ if(Curl_timestrcmp(needle->http_proxy.user, ++ check->http_proxy.user) || ++ Curl_timestrcmp(needle->http_proxy.passwd, ++ check->http_proxy.passwd)) ++ continue; ++ } ++ } ++ else if(check->proxy_negotiate_state != GSS_AUTHNONE) { ++ /* Proxy connection is using Negotiate auth but we don't want it */ ++ continue; ++ } ++#endif ++ if(wantNegoHTTP || wantProxyNegoHTTP) { ++ /* Credentials are already checked, we can use this connection */ ++ chosen = check; ++ ++ if((wantNegoHTTP && ++ (check->http_negotiate_state != GSS_AUTHNONE)) || ++ (wantProxyNegoHTTP && ++ (check->proxy_negotiate_state != GSS_AUTHNONE))) { ++ /* We must use this connection, no other */ ++ *force_reuse = TRUE; ++ break; + } + + /* Continue look up for a better connection */ diff --git a/SOURCES/0008-curl-7.76.1-CVE-2026-3783.patch b/SOURCES/0008-curl-7.76.1-CVE-2026-3783.patch new file mode 100644 index 0000000..613faae --- /dev/null +++ b/SOURCES/0008-curl-7.76.1-CVE-2026-3783.patch @@ -0,0 +1,14 @@ +--- a/lib/http.c 2026-07-16 11:32:28.622100955 +0000 ++++ b/lib/http.c 2026-07-16 11:33:39.575833748 +0000 +@@ -741,8 +741,9 @@ output_auth_headers(struct Curl_easy *da + } + if(authstatus->picked == CURLAUTH_BEARER) { + /* Bearer */ +- if((!proxy && data->set.str[STRING_BEARER] && +- !Curl_checkheaders(data, "Authorization:"))) { ++ if(!proxy && data->set.str[STRING_BEARER] && ++ Curl_allow_auth_to_host(data) && ++ !Curl_checkheaders(data, "Authorization:")) { + auth = "Bearer"; + result = http_output_bearer(data); + if(result) diff --git a/SOURCES/0044-curl-7.76.1-CVE-2026-9547.patch b/SOURCES/0044-curl-7.76.1-CVE-2026-9547.patch new file mode 100644 index 0000000..41f6860 --- /dev/null +++ b/SOURCES/0044-curl-7.76.1-CVE-2026-9547.patch @@ -0,0 +1,28 @@ +From 0b8dbbc63c98777e4584cb9fbd71df3464008ad1 Mon Sep 17 00:00:00 2001 +From: Joshua Rogers +Date: Fri, 22 May 2026 09:48:15 +0200 +Subject: [PATCH] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH + +Host key type mismatch from libssh was incorrectly reported as missing, +causing key callbacks to accept instead of reject. + +Upstream-commit: 0b8dbbc63c98777e4584cb9fbd71df3464008ad1 +Resolves: CVE-2026-9547 + +--- + lib/vssh/libssh.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c +--- a/lib/vssh/libssh.c ++++ b/lib/vssh/libssh.c +@@ -432,7 +432,8 @@ + keymatch = CURLKHMATCH_OK; + break; + case SSH_KNOWN_HOSTS_OTHER: +- /* fallthrough */ ++ keymatch = CURLKHMATCH_MISMATCH; ++ break; + case SSH_KNOWN_HOSTS_NOT_FOUND: + /* fallthrough */ + case SSH_KNOWN_HOSTS_UNKNOWN: diff --git a/SOURCES/0045-curl-7.76.1-CVE-2026-8286.patch b/SOURCES/0045-curl-7.76.1-CVE-2026-8286.patch new file mode 100644 index 0000000..aaa903d --- /dev/null +++ b/SOURCES/0045-curl-7.76.1-CVE-2026-8286.patch @@ -0,0 +1,53 @@ +From a86efdd7ca5433de9231e650f18247de8319ad16 Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 7 May 2026 10:30:07 +0200 +Subject: [PATCH] url: fix connection reuse for starttls protocols + +When a connection is tested for reuse in a transfer that *may* upgrade +to TLS (commonly via STARTTLS), the SSL configuration must match the +existing connection. + +Also reject non-TLS connections when the transfer requires TLS via +STARTTLS (use_ssl >= CURLUSESSL_CONTROL). + +Adapted from upstream commit a86efdd7ca5433de9231e650f18247de8319ad16 +for the ConnectionExists() function in curl 7.76.1. + +Upstream-commit: a86efdd7ca5433de9231e650f18247de8319ad16 +Resolves: CVE-2026-8286 + +--- + lib/url.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +--- a/lib/url.c ++++ b/lib/url.c +@@ -1232,6 +1232,13 @@ + /* except protocols that have been upgraded via TLS */ + continue; + ++ /* For STARTTLS protocols that require TLS, reject non-TLS connections */ ++ if(data->set.use_ssl >= CURLUSESSL_CONTROL && ++ !(needle->handler->flags & PROTOPT_SSL) && ++ check->ssl[FIRSTSOCKET].state != ssl_connection_complete && ++ !check->bits.tls_upgraded) ++ continue; ++ + #ifndef CURL_DISABLE_PROXY + if(needle->bits.httpproxy != check->bits.httpproxy || + needle->bits.socksproxy != check->bits.socksproxy) +@@ -1369,9 +1376,10 @@ + /* The schemes match or the protocol family is the same and the + previous connection was TLS upgraded, and the hostname and host + port match */ +- if(needle->handler->flags & PROTOPT_SSL) { +- /* This is a SSL connection so verify that we're using the same +- SSL options as well */ ++ if((needle->handler->flags & PROTOPT_SSL) || ++ data->set.use_ssl > CURLUSESSL_NONE) { ++ /* This is a SSL or STARTTLS connection so verify that we're ++ using the same SSL options as well */ + if(!Curl_ssl_config_matches(&needle->ssl_config, + &check->ssl_config)) { + DEBUGF(infof(data, diff --git a/SPECS/curl.spec b/SPECS/curl.spec index 4e49085..d650865 100644 --- a/SPECS/curl.spec +++ b/SPECS/curl.spec @@ -1,7 +1,7 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.76.1 -Release: 40%{?dist} +Release: 40%{?dist}.5 License: MIT Source: https://curl.se/download/%{name}-%{version}.tar.xz @@ -131,6 +131,18 @@ Patch042: 0042-curl-7.76.1-respect-system-crypto-policy.patch # http: fix crash in rate-limited upload Patch043: 0043-curl-7.76.1-http-fix-crash-in-rate-limited-upload.patch +# vssh: fix SSH host key mismatch on type difference (CVE-2026-9547) +Patch044: 0044-curl-7.76.1-CVE-2026-9547.patch + +# url: reject TLS-to-cleartext STARTTLS connection reuse (CVE-2026-8286) +Patch045: 0045-curl-7.76.1-CVE-2026-8286.patch + +# url: fix reuse of connections using HTTP Negotiate (CVE-2026-1965) +Patch046: 0007-curl-7.76.1-CVE-2026-1965.patch + +# http: only send bearer if auth is allowed (CVE-2026-3783) +Patch047: 0008-curl-7.76.1-CVE-2026-3783.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -348,6 +360,10 @@ be installed. %patch -P 41 -p1 %patch -P 42 -p1 %patch -P 43 -p1 +%patch -P 44 -p1 +%patch -P 45 -p1 +%patch -P 46 -p1 +%patch -P 47 -p1 # Fedora patches %patch -P 101 -p1 @@ -379,6 +395,16 @@ printf "702\n703\n716\n" >> tests/data/DISABLED printf "2034\n2037\n2041\n" >> tests/data/DISABLED %endif +# temporarily disable tests 3000 and 3001 on i686 (flaky stunnel startup) +%ifarch i686 +printf "3000\n3001\n" >> tests/data/DISABLED +%endif + +# temporarily disable test 1206 on x86_64 (flaky FTP PORT timeout under valgrind) +%ifarch x86_64 +echo "1206" >> tests/data/DISABLED +%endif + # adapt test 323 for updated OpenSSL sed -e 's|^35$|35,52|' -i tests/data/test323 @@ -573,6 +599,21 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog +* Thu Jul 23 2026 Jacek Migacz - 7.76.1-40.el9_8.5 +- fix missing %%patch macros for Patch46 and Patch47 + +* Wed Jul 22 2026 Jacek Migacz - 7.76.1-40.el9_8.4 +- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) +- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) +- tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) + +* Tue Jul 14 2026 Jacek Migacz - 7.76.1-40.3 +- tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) + +* Mon Jul 13 2026 Jacek Migacz - 7.76.1-40.1 +- fix SSH host key mismatch on type difference (CVE-2026-9547) +- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) + * Wed Jan 21 2026 Jacek Migacz - 7.76.1-40 - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721)