* [ptxdist] [PATCH 1/2] libcurl: Version bump. 8.18.0 -> 8.19.0
@ 2026-03-14 18:03 Christian Melki
2026-03-14 18:03 ` [ptxdist] [PATCH 2/2] host-libcurl: Follow target libcurl bump " Christian Melki
2026-03-29 5:46 ` [ptxdist] [APPLIED] libcurl: Version bump. " Michael Olbrich
0 siblings, 2 replies; 4+ messages in thread
From: Christian Melki @ 2026-03-14 18:03 UTC (permalink / raw)
To: ptxdist
Mostly bugfixes.
https://curl.se/changes.html#8_19_0
Plugs CVEs:
CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection
* License hash changed. Year updates.
* Fix new and removed build options.
Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
rules/libcurl.make | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/rules/libcurl.make b/rules/libcurl.make
index 62d9a8ccb..d15ea064f 100644
--- a/rules/libcurl.make
+++ b/rules/libcurl.make
@@ -15,15 +15,15 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl
#
# Paths and names
#
-LIBCURL_VERSION := 8.18.0
-LIBCURL_MD5 := dae6088bf7af69d3b0a87c762de92248
+LIBCURL_VERSION := 8.19.0
+LIBCURL_MD5 := d5d3581ba4b4df1140a26a6efcf13e61
LIBCURL := curl-$(LIBCURL_VERSION)
LIBCURL_SUFFIX := tar.xz
LIBCURL_URL := https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX)
LIBCURL_SOURCE := $(SRCDIR)/$(LIBCURL).$(LIBCURL_SUFFIX)
LIBCURL_DIR := $(BUILDDIR)/$(LIBCURL)
LIBCURL_LICENSE := curl
-LIBCURL_LICENSE_FILES := file://COPYING;md5=72f4e9890e99e68d77b7e40703d789b8
+LIBCURL_LICENSE_FILES := file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc
# ----------------------------------------------------------------------------
# Prepare
@@ -39,7 +39,6 @@ LIBCURL_CONF_OPT := \
--enable-optimize \
--disable-warnings \
--disable-werror \
- --disable-curldebug \
--enable-symbol-hiding \
--$(call ptx/endis, PTXCONF_LIBCURL_C_ARES)-ares \
--enable-rt \
@@ -110,6 +109,7 @@ LIBCURL_CONF_OPT := \
--without-mbedtls \
--without-wolfssl \
--without-rustls \
+ --without-apple-sectrust \
--with-zlib=$(SYSROOT) \
--without-brotli \
--without-zstd \
@@ -128,7 +128,6 @@ LIBCURL_CONF_OPT := \
--without-libidn2 \
--without-nghttp2 \
--without-ngtcp2 \
- --without-openssl-quic \
--without-nghttp3 \
--without-quiche \
--without-zsh-functions-dir \
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [ptxdist] [PATCH 2/2] host-libcurl: Follow target libcurl bump 8.18.0 -> 8.19.0
2026-03-14 18:03 [ptxdist] [PATCH 1/2] libcurl: Version bump. 8.18.0 -> 8.19.0 Christian Melki
@ 2026-03-14 18:03 ` Christian Melki
2026-03-29 5:46 ` [ptxdist] [APPLIED] " Michael Olbrich
2026-03-29 5:46 ` [ptxdist] [APPLIED] libcurl: Version bump. " Michael Olbrich
1 sibling, 1 reply; 4+ messages in thread
From: Christian Melki @ 2026-03-14 18:03 UTC (permalink / raw)
To: ptxdist
Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
rules/host-libcurl.make | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rules/host-libcurl.make b/rules/host-libcurl.make
index 132caadf2..82ea79077 100644
--- a/rules/host-libcurl.make
+++ b/rules/host-libcurl.make
@@ -25,7 +25,6 @@ HOST_LIBCURL_CONF_OPT := \
--enable-optimize \
--disable-warnings \
--disable-werror \
- --disable-curldebug \
--enable-symbol-hiding \
--disable-ares \
--enable-rt \
@@ -94,6 +93,7 @@ HOST_LIBCURL_CONF_OPT := \
--without-mbedtls \
--without-wolfssl \
--without-rustls \
+ --without-apple-sectrust \
--without-zlib \
--without-brotli \
--without-zstd \
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [ptxdist] [APPLIED] libcurl: Version bump. 8.18.0 -> 8.19.0
2026-03-14 18:03 [ptxdist] [PATCH 1/2] libcurl: Version bump. 8.18.0 -> 8.19.0 Christian Melki
2026-03-14 18:03 ` [ptxdist] [PATCH 2/2] host-libcurl: Follow target libcurl bump " Christian Melki
@ 2026-03-29 5:46 ` Michael Olbrich
1 sibling, 0 replies; 4+ messages in thread
From: Michael Olbrich @ 2026-03-29 5:46 UTC (permalink / raw)
To: ptxdist; +Cc: Christian Melki
Thanks, applied as 1e7abd2404d89022a173282f8efd12118fa5cd2e.
Michael
[sent from post-receive hook]
On Sun, 29 Mar 2026 07:46:53 +0200, Christian Melki <christian.melki@t2data.com> wrote:
> Mostly bugfixes.
> https://curl.se/changes.html#8_19_0
>
> Plugs CVEs:
> CVE-2026-3805: use after free in SMB connection reuse
> CVE-2026-3784: wrong proxy connection reuse with credentials
> CVE-2026-3783: token leak with redirect and netrc
> CVE-2026-1965: bad reuse of HTTP Negotiate connection
>
> * License hash changed. Year updates.
>
> * Fix new and removed build options.
>
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> Message-Id: <20260314180323.2055033-1-christian.melki@t2data.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
>
> diff --git a/rules/libcurl.make b/rules/libcurl.make
> index 62d9a8ccbc8d..d15ea064ff6e 100644
> --- a/rules/libcurl.make
> +++ b/rules/libcurl.make
> @@ -15,15 +15,15 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl
> #
> # Paths and names
> #
> -LIBCURL_VERSION := 8.18.0
> -LIBCURL_MD5 := dae6088bf7af69d3b0a87c762de92248
> +LIBCURL_VERSION := 8.19.0
> +LIBCURL_MD5 := d5d3581ba4b4df1140a26a6efcf13e61
> LIBCURL := curl-$(LIBCURL_VERSION)
> LIBCURL_SUFFIX := tar.xz
> LIBCURL_URL := https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX)
> LIBCURL_SOURCE := $(SRCDIR)/$(LIBCURL).$(LIBCURL_SUFFIX)
> LIBCURL_DIR := $(BUILDDIR)/$(LIBCURL)
> LIBCURL_LICENSE := curl
> -LIBCURL_LICENSE_FILES := file://COPYING;md5=72f4e9890e99e68d77b7e40703d789b8
> +LIBCURL_LICENSE_FILES := file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc
>
> # ----------------------------------------------------------------------------
> # Prepare
> @@ -39,7 +39,6 @@ LIBCURL_CONF_OPT := \
> --enable-optimize \
> --disable-warnings \
> --disable-werror \
> - --disable-curldebug \
> --enable-symbol-hiding \
> --$(call ptx/endis, PTXCONF_LIBCURL_C_ARES)-ares \
> --enable-rt \
> @@ -110,6 +109,7 @@ LIBCURL_CONF_OPT := \
> --without-mbedtls \
> --without-wolfssl \
> --without-rustls \
> + --without-apple-sectrust \
> --with-zlib=$(SYSROOT) \
> --without-brotli \
> --without-zstd \
> @@ -128,7 +128,6 @@ LIBCURL_CONF_OPT := \
> --without-libidn2 \
> --without-nghttp2 \
> --without-ngtcp2 \
> - --without-openssl-quic \
> --without-nghttp3 \
> --without-quiche \
> --without-zsh-functions-dir \
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [ptxdist] [APPLIED] host-libcurl: Follow target libcurl bump 8.18.0 -> 8.19.0
2026-03-14 18:03 ` [ptxdist] [PATCH 2/2] host-libcurl: Follow target libcurl bump " Christian Melki
@ 2026-03-29 5:46 ` Michael Olbrich
0 siblings, 0 replies; 4+ messages in thread
From: Michael Olbrich @ 2026-03-29 5:46 UTC (permalink / raw)
To: ptxdist; +Cc: Christian Melki
Thanks, applied as 45bc2b6cd655c846930a0ebb70c707a3680f1502.
Michael
[sent from post-receive hook]
On Sun, 29 Mar 2026 07:46:54 +0200, Christian Melki <christian.melki@t2data.com> wrote:
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> Message-Id: <20260314180323.2055033-2-christian.melki@t2data.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
>
> diff --git a/rules/host-libcurl.make b/rules/host-libcurl.make
> index 132caadf2661..82ea79077a1e 100644
> --- a/rules/host-libcurl.make
> +++ b/rules/host-libcurl.make
> @@ -25,7 +25,6 @@ HOST_LIBCURL_CONF_OPT := \
> --enable-optimize \
> --disable-warnings \
> --disable-werror \
> - --disable-curldebug \
> --enable-symbol-hiding \
> --disable-ares \
> --enable-rt \
> @@ -94,6 +93,7 @@ HOST_LIBCURL_CONF_OPT := \
> --without-mbedtls \
> --without-wolfssl \
> --without-rustls \
> + --without-apple-sectrust \
> --without-zlib \
> --without-brotli \
> --without-zstd \
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-29 5:47 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-14 18:03 [ptxdist] [PATCH 1/2] libcurl: Version bump. 8.18.0 -> 8.19.0 Christian Melki
2026-03-14 18:03 ` [ptxdist] [PATCH 2/2] host-libcurl: Follow target libcurl bump " Christian Melki
2026-03-29 5:46 ` [ptxdist] [APPLIED] " Michael Olbrich
2026-03-29 5:46 ` [ptxdist] [APPLIED] libcurl: Version bump. " Michael Olbrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox