From 4ba8c73a447f2f48f0c573ce5603b1b8f07725d3 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Tue, 7 Jul 2026 11:10:16 +0000 Subject: [PATCH] Patch curl for CVE-2026-9545 --- SPECS/curl/CVE-2026-9545.patch | 65 +++++++++++++++++++ SPECS/curl/curl.spec | 6 +- .../manifests/package/pkggen_core_aarch64.txt | 6 +- .../manifests/package/pkggen_core_x86_64.txt | 6 +- .../manifests/package/toolchain_aarch64.txt | 8 +-- .../manifests/package/toolchain_x86_64.txt | 8 +-- 6 files changed, 84 insertions(+), 15 deletions(-) create mode 100644 SPECS/curl/CVE-2026-9545.patch diff --git a/SPECS/curl/CVE-2026-9545.patch b/SPECS/curl/CVE-2026-9545.patch new file mode 100644 index 00000000000..724e3ff2bad --- /dev/null +++ b/SPECS/curl/CVE-2026-9545.patch @@ -0,0 +1,65 @@ +From ec79a18941b27c770edbde430c0157351f985a8b Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 7 Jul 2026 11:04:47 +0000 +Subject: [PATCH] ngtcp2: fail handshake directly + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of None +--- + lib/vquic/curl_ngtcp2.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c +index 37009ab..0ac46cf 100644 +--- a/lib/vquic/curl_ngtcp2.c ++++ b/lib/vquic/curl_ngtcp2.c +@@ -446,8 +446,25 @@ static CURLcode init_ngh3_conn(struct Curl_cfilter *cf); + + static int cb_handshake_completed(ngtcp2_conn *tconn, void *user_data) + { +- (void)user_data; ++ struct Curl_cfilter *cf = user_data; ++ struct cf_ngtcp2_ctx *ctx = cf->ctx; ++ struct Curl_easy *data; + (void)tconn; ++ ++ data = CF_DATA_CURRENT(cf); ++ DEBUGASSERT(data); ++ if(!ctx || !data) ++ return NGTCP2_ERR_CALLBACK_FAILURE; ++ ++ ctx->handshake_at = *Curl_pgrs_now(data); ++ ctx->tls_handshake_complete = TRUE; ++ CURL_TRC_CF(data, cf, "handshake complete"); ++ ++ ctx->tls_vrfy_result = Curl_vquic_tls_verify_peer(&ctx->tls, cf, ++ data, &ctx->peer); ++ if(ctx->tls_vrfy_result) ++ return NGTCP2_ERR_CALLBACK_FAILURE; ++ + return 0; + } + +@@ -1275,6 +1292,10 @@ out: + nread = -1; + } + } ++ if(ctx->tls_vrfy_result) { ++ *err = ctx->tls_vrfy_result; ++ nread = -1; ++ } + CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] cf_recv(blen=%zu) -> %zd, %d", + stream ? stream->id : -1, blen, nread, *err); + CF_DATA_RESTORE(cf, save); +@@ -2393,6 +2414,8 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf, + } + + out: ++ if(ctx->tls_vrfy_result) ++ result = ctx->tls_vrfy_result; + if(result == CURLE_RECV_ERROR && ctx->qconn && + ngtcp2_conn_in_draining_period(ctx->qconn)) { + /* When a QUIC server instance is shutting down, it may send us a +-- +2.45.4 + diff --git a/SPECS/curl/curl.spec b/SPECS/curl/curl.spec index 3d7b38581ee..dfdab8c8b1a 100644 --- a/SPECS/curl/curl.spec +++ b/SPECS/curl/curl.spec @@ -1,7 +1,7 @@ Summary: An URL retrieval utility and library Name: curl Version: 8.11.1 -Release: 8%{?dist} +Release: 9%{?dist} License: curl Vendor: Microsoft Corporation Distribution: Azure Linux @@ -22,6 +22,7 @@ Patch10: CVE-2026-7168.patch Patch11: CVE-2026-5545.patch Patch12: CVE-2026-6253.patch Patch13: CVE-2026-6429.patch +Patch14: CVE-2026-9545.patch BuildRequires: cmake BuildRequires: krb5-devel BuildRequires: libnghttp2-devel @@ -112,6 +113,9 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_libdir}/libcurl.so.* %changelog +* Tue Jul 07 2026 Azure Linux Security Servicing Account - 8.11.1-9 +- Patch for CVE-2026-9545 + * Tue May 26 2026 Jyoti Kanase - 8.11.1-8 - Patch for CVE-2026-6253, CVE-2026-6429, CVE-2026-5545 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 8e856b4b833..7f5665f2333 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -199,9 +199,9 @@ krb5-1.21.3-5.azl3.aarch64.rpm krb5-devel-1.21.3-5.azl3.aarch64.rpm nghttp2-1.61.0-3.azl3.aarch64.rpm nghttp2-devel-1.61.0-3.azl3.aarch64.rpm -curl-8.11.1-8.azl3.aarch64.rpm -curl-devel-8.11.1-8.azl3.aarch64.rpm -curl-libs-8.11.1-8.azl3.aarch64.rpm +curl-8.11.1-9.azl3.aarch64.rpm +curl-devel-8.11.1-9.azl3.aarch64.rpm +curl-libs-8.11.1-9.azl3.aarch64.rpm createrepo_c-1.0.3-1.azl3.aarch64.rpm libxml2-2.11.5-9.azl3.aarch64.rpm libxml2-devel-2.11.5-9.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 2cd0f63a42d..2c28195db64 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -199,9 +199,9 @@ krb5-1.21.3-5.azl3.x86_64.rpm krb5-devel-1.21.3-5.azl3.x86_64.rpm nghttp2-1.61.0-3.azl3.x86_64.rpm nghttp2-devel-1.61.0-3.azl3.x86_64.rpm -curl-8.11.1-8.azl3.x86_64.rpm -curl-devel-8.11.1-8.azl3.x86_64.rpm -curl-libs-8.11.1-8.azl3.x86_64.rpm +curl-8.11.1-9.azl3.x86_64.rpm +curl-devel-8.11.1-9.azl3.x86_64.rpm +curl-libs-8.11.1-9.azl3.x86_64.rpm createrepo_c-1.0.3-1.azl3.x86_64.rpm libxml2-2.11.5-9.azl3.x86_64.rpm libxml2-devel-2.11.5-9.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index e9255a98388..304ed1a8575 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -67,10 +67,10 @@ cracklib-lang-2.9.11-1.azl3.aarch64.rpm createrepo_c-1.0.3-1.azl3.aarch64.rpm createrepo_c-debuginfo-1.0.3-1.azl3.aarch64.rpm createrepo_c-devel-1.0.3-1.azl3.aarch64.rpm -curl-8.11.1-8.azl3.aarch64.rpm -curl-debuginfo-8.11.1-8.azl3.aarch64.rpm -curl-devel-8.11.1-8.azl3.aarch64.rpm -curl-libs-8.11.1-8.azl3.aarch64.rpm +curl-8.11.1-9.azl3.aarch64.rpm +curl-debuginfo-8.11.1-9.azl3.aarch64.rpm +curl-devel-8.11.1-9.azl3.aarch64.rpm +curl-libs-8.11.1-9.azl3.aarch64.rpm Cython-debuginfo-3.0.5-3.azl3.aarch64.rpm debugedit-5.0-2.azl3.aarch64.rpm debugedit-debuginfo-5.0-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index bdea095631d..0f204071653 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -72,10 +72,10 @@ createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm cross-binutils-common-2.41-13.azl3.noarch.rpm cross-gcc-common-13.2.0-7.azl3.noarch.rpm -curl-8.11.1-8.azl3.x86_64.rpm -curl-debuginfo-8.11.1-8.azl3.x86_64.rpm -curl-devel-8.11.1-8.azl3.x86_64.rpm -curl-libs-8.11.1-8.azl3.x86_64.rpm +curl-8.11.1-9.azl3.x86_64.rpm +curl-debuginfo-8.11.1-9.azl3.x86_64.rpm +curl-devel-8.11.1-9.azl3.x86_64.rpm +curl-libs-8.11.1-9.azl3.x86_64.rpm Cython-debuginfo-3.0.5-3.azl3.x86_64.rpm debugedit-5.0-2.azl3.x86_64.rpm debugedit-debuginfo-5.0-2.azl3.x86_64.rpm