From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Mon, 07 Sep 2026 18:50:30 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x3cYA-001BlS-0s for lore@lore.pengutronix.de; Mon, 07 Sep 2026 18:50:30 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x3cY9-0007BO-L3; Mon, 07 Sep 2026 18:50:29 +0200 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x3cXt-0007BH-8R for ptxdist@pengutronix.de; Mon, 07 Sep 2026 18:50:13 +0200 Authentication-Results: mx1.white.stw.pengutronix.de; dkim=pass header.d=t2datacom.onmicrosoft.com header.s=selector1-t2datacom-onmicrosoft-com header.b=TKzjn9q3; spf=pass (mx1.white.stw.pengutronix.de: domain of christian.melki@t2data.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=christian.melki@t2data.com; dmarc=pass (policy=none) header.from=t2data.com; arc=pass ("microsoft.com:s=arcselector10001:i=1") Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazlp170130007.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20f::7]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id E824D200A43 for ; Mon, 07 Sep 2026 18:50:08 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wZd8WJCbFbmg3/J2xIN2nLfiNfjsi4bnGOHANeT97lDCXH664n3Nn2z9G5fL+biGBJWLz/hnrWz9i9hl96E3W+Cwf6KeKdVnTOkNZeeEWpTExDOEOZwZABPne0IohQOHFd3T9kwKwoHCWl+jlw37voI3lr59UzOQ1JBvdsHQqo96Kfcr79X+YD8Py9ZI+JtcVIORntyGk9v8EKagtPZa5ed2hWExFPyBhfD3HCn5AFlzrnYdJgNlCdZwjgLMdJY3le3/IJ/nCPvZhfeAeezY0EwFLoRMSCYqm7c2n+wzSJnept/UbAN0x7fn2XRBE3XEhHRNXtB06CZ12jHTDkFAZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2OJUBj+4RGbBAJENJUNYLafNNp5QIMHkhGZQkbb2sXg=; b=AQVS8Du/CQliDZgPzcKyX+VkdQxMpaMtIWLPavwJxzjvkNi+FEwmmtVP4DbAZHwvlVV4oyuoC8w0IEg9oae9PDiwAeZNJ0P9gbNUCq8UZqF9spNJTWnMVFHGIZG5PKPuMxWP1elVDFADEAM1YWts4xf0UIbYd1vp1QUROfDb1iQkrPgr2nYQBJA2CdnGjYa03EILwCg3YDKNoJxpI9GLgIVn+VFd6er9MCXejaUxP0fLE7+ereCaRjII1/vUu0h9/3L4Mg+BjEaC8dau/D0kWDvZ4l+YIUh/gAagV3vbZIP1VJJ4Ccmjd7XYTSg0ZdMJ1mskGBkdcj4eVqpV0HALUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=t2data.com; dmarc=pass action=none header.from=t2data.com; dkim=pass header.d=t2data.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=t2datacom.onmicrosoft.com; s=selector1-t2datacom-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2OJUBj+4RGbBAJENJUNYLafNNp5QIMHkhGZQkbb2sXg=; b=TKzjn9q3uASGw/jTmvF1e5wc+gTmJGUH1b52cY0Fusi2OfCx06VgO0Vt5uZw91gKEsrjo9+z71+i2ivPF3d/5MuT9fHXC8sp0apDcZmD2FhCNZpTIhuC/4URBWmGdoxwPQfwq2TMA0Hjxnvy8vrWjUUkMdssij/QkD4dU3ftej0= Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) by AS8P251MB0312.EURP251.PROD.OUTLOOK.COM (2603:10a6:20b:403::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 16:50:06 +0000 Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19]) by DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 16:50:06 +0000 From: Christian Melki To: ptxdist@pengutronix.de Date: Mon, 7 Sep 2026 18:49:24 +0200 Message-ID: <20260907164925.2663594-1-christian.melki@t2data.com> X-Mailer: git-send-email 2.43.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: GV3PEPF0001DC22.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:400::119) To DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB9P251MB0618:EE_|AS8P251MB0312:EE_ X-MS-Office365-Filtering-Correlation-Id: 7aeeeb26-a7e1-4caf-3afb-08df0d0011d2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|366016|376014|52116014|23010399003|38350700014|3023799007|10067099003|56012099006|18002099003; X-Microsoft-Antispam-Message-Info: i2WqBuD7xawPtVISNgiMx7HAm7rHKR5gKBhvh+TQTEfxW4A5WPFt/k4MJ4HNM7ErHyVu4ewPzpgyLAjTPbZLuAJFVMsSHWGQn0ZQ09pB51m6nSyu2qNtQyFHL8WaDM/qFuetL3MIBbFVnlLjtvhtXHBfD2/p8I5QbwTVJJjMIVdX/wG2fGOgd8UZsWuL7TiYgEm92h+EifkTeW0tB7xUSFD22DRchXAtuBdo79+K5qAlB9HhHOxCz2vjcosfPjMmylsjNGQh1jvlYGwBXuGhuSNZc8UOPA5XOGjEGhuOAvn5qnLSf7CQKSDKUwsX7w/oEErUxpvhaQDEbCc8nmtlnzWQBDiGFJ3b9IpdrNWA2+ws3bq6/brypiE9B0cZzAwnUWpVC80E4AFHADBnRuzVH9JCEHSIa+EY6x8AiWAA91ue5GDp/aI+Z0+UyPTAMiqc7USqVZGaW5jUmjVxuLJGsIQ9vuGMVOVZjBx2ukkfQihsff3YPILmv3H8f7TS/j3h13Nsdm+5OwR1rU38BRtPJePYro+C+JSCZZPogLb40bk1VRDiH1eaR9nlzUT6t88seSWqfwi0DVF0NSS4CtKaPwOn0dil1F/lZFzU7uLK6/VgfaAkHf4NZPegbp39hq+kVdAt0yfP5G4saSD12Nmb6DNItEz2Ut2bqv7Rao1zGrU= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9P251MB0618.EURP251.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(1800799024)(366016)(376014)(52116014)(23010399003)(38350700014)(3023799007)(10067099003)(56012099006)(18002099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Y6eNsD3MuOYYFU/v3e42DovpU3c8YN19x3eG6EJdZhKYAINJG12Rt/8uhrIH?= =?us-ascii?Q?rDQhs3GCY2eckz5gIcVA/LmZv4Cv7lkHR79hnylgSGjH/1/dXocHQ3guPfE3?= =?us-ascii?Q?GlL5Qy9xGlwF62zfc8eBMpUyVR2f16U/UwYThkjQFoANqDyys6u0NIMSiC+n?= =?us-ascii?Q?6vFdWcTnqkJ9HFofFvsnDRb5INcyZ/r0AW2+yXi9MgKpNzNPM3KAvu1XBVKB?= =?us-ascii?Q?Nf7F6GI62u39dsKEpmAkk8NLznlXG5y0d+pf0kCtfp0Qd4gw+tYgf4Fg9JLG?= =?us-ascii?Q?PMFJ+ps5aec3T4rzOHFHLS25LBACm9QrzuC9BecbCmeDBx4301Cn2FIw6s4s?= =?us-ascii?Q?VirFTG3B/PSp4Sq/2qOd0LZxrart2kK7ApeIJ0vAYzr3FsX8PZGM52XgDYCi?= =?us-ascii?Q?WAvSxRQsturwPdKF1w9SVEooqDJ0alaY7iKEkreHFAxbQf+GMW19sPTo3eLY?= =?us-ascii?Q?rQEZ2nwNZyhoE/mioewDNQz3s4FM5frMLVMdHKFe7uhAFhHX6IjxMjEKPxEM?= =?us-ascii?Q?H5XjmBxr46Zod1iNiZiJZjlgBkSGYybm+LRSG2GMMRZ1mXU74RlQVjCBi8aZ?= =?us-ascii?Q?9SNtqmBwiplyiT1S9RNgiHtZRzQsqydLBMvFngYMR22as6ovB1WuzxCCCHAk?= =?us-ascii?Q?0XBZ7ExOIhx2Vp04uOL8vRnbNP+lXW+IlAauB+NGZPFPxVK3TH2cWzGDdd1b?= =?us-ascii?Q?GKBnuN/YT+ySYbWVUPkQnxxmKQbCyPYShTaujjsjGArHmj4+ToAehcpd5iyY?= =?us-ascii?Q?C87/du8pM19omoUC7mWD03zFB5iJFeSco6+CpgviDZKYwIhVJEGQeNEAnoVw?= =?us-ascii?Q?tKfCpJ8HJZiaTFGJY9iTZITpC5rsYVVYhF62R5zPJxsTsrdhUl3Imz0R0kYB?= =?us-ascii?Q?6x+qj22Ht+0M+odCUGtuhJ/DjWjyNGfj12fZUVD2iS2zhmzRJ+whGhjKgP9J?= =?us-ascii?Q?eyWAtEKQWepDWoXlvAtOssx53W9LMCJo38w0MGqG8ID+npY3aqRQQNDwVaOZ?= =?us-ascii?Q?jFqZNoauVtfHRbR5ume8ZRrdm6DaEYIf33z5PrMWfJM9UdQJ7C0bOOFSxk6d?= =?us-ascii?Q?eBnwIMb5yDf0maXBiJSozv7ZOdGq2ICVOj2tkt6uu4htLOz337Ag7+TTpafB?= =?us-ascii?Q?MddSzIITNRQRtu2I0ygTQobdHI9DNhd0A5hGBCxI9t6CdYndAXenVDbTWUwZ?= =?us-ascii?Q?7WKvHWNRibOImBbiZoiqmrffLWl5JBJo+pUOm/qh1dbXg5gxhVSgTJt31hqU?= =?us-ascii?Q?/bwFzmA7nOWPjpN682Kme1snu6PPKSh/KqHD+c4KLV1PhduX9F4fMjXLp6DT?= =?us-ascii?Q?VbDgPHCReJgbB++d0zr3ldu4E30wbjbWOp7kRhAozxm5WsEPrH865cqwzrQj?= =?us-ascii?Q?sVeW3NiMBIJvcditXoWZO6xnRXYvZCG0d5mLFt5ly55N5tYB0xD8SYbEZI9a?= =?us-ascii?Q?PdM2U1B9fO1q8lq7kcobr7O+17EBmNCC3lrEMHVEybtRecjxQuAsVa6blJcu?= =?us-ascii?Q?8sSHzvawQAYDvB60ImpGVfyE9ygw3BeitocYR1nmerFJ2K2lzmLQRilwgKkU?= =?us-ascii?Q?f87tU3XuG9U9kBc28v3JunaJFTUBNmFRuk1Y+zYQKIVTBQF7yGEm2o3Ett3t?= =?us-ascii?Q?fMr3WFmx8vhIjbCtuSKxQ+mVInyR6ULApSIt9mIGLQ9OEfsTOwCyQ5b4FwuD?= =?us-ascii?Q?7wCqXrO7pPbWCLkGfvR3W+2MQScPY9ioEEdStZSst3aQ5rSZIs3Iodjrit6T?= =?us-ascii?Q?oEzmohic0nI6B1N6P7+lfFlQbN6OttM=3D?= X-OriginatorOrg: t2data.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7aeeeb26-a7e1-4caf-3afb-08df0d0011d2 X-MS-Exchange-CrossTenant-AuthSource: DB9P251MB0618.EURP251.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 16:50:06.1948 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 27928da5-aacd-4ba1-9566-c748a6863e6c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6vVJP8MHKBWH9L7RzqMW3Kbe6TaH+12gA5gJpeA3tcVahRShccbHRForfuuXC82hsc65plDWY7lkHg1g7yWn9p4EcU5ZIStpRNXFi3tebqM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P251MB0312 X-Rspamd-Server: mx1 X-Stat-Signature: mydn47mcixsrpbwqzjcdsc1e8gb1g7ti X-Rspamd-Queue-Id: E824D200A43 X-Spamd-Result: default: False [-3.50 / 15.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; ARC_ALLOW(-1.00)[microsoft.com:s=arcselector10001:i=1]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[t2data.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2a01:111:f403:c000::/51]; R_DKIM_ALLOW(-0.20)[t2datacom.onmicrosoft.com:s=selector1-t2datacom-onmicrosoft-com]; MIME_GOOD(-0.10)[text/plain]; TO_MATCH_ENVRCPT_ALL(0.00)[]; ASN(0.00)[asn:8075, ipnet:2a01:111:f000::/36, country:US]; RCPT_COUNT_ONE(0.00)[1]; MIME_TRACE(0.00)[0:+]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; NEURAL_HAM(-0.00)[-1.000]; RCVD_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[2a01:111:f403:c20f::7:from]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[t2datacom.onmicrosoft.com:+] X-Rspamd-Action: no action Subject: [ptxdist] [PATCH 1/2] libcurl: Version bump. 8.21.0 -> 8.22.0 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false A bunch of security fixes and bug fixes as usual. https://curl.se/ch/8.22.0.html Plugs CVEs: CVE-2026-82209: domain-scoped PSL domain cookie CVE-2026-82208: wolfSSL CA-cache hit overrides callback CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-80231: native CA store conn reuse CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-18924: HTTP/2 server push UAF CVE-2026-13608: OpenLDAP SASL authentication bypass * Pin down a few options. I also disabled the new RFC9421 http message signatures, but someone might actually be interested in it. Maybe wire it up to a separate config option? Signed-off-by: Christian Melki --- rules/libcurl.make | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rules/libcurl.make b/rules/libcurl.make index 3c5b00adb..12507eeb0 100644 --- a/rules/libcurl.make +++ b/rules/libcurl.make @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl # # Paths and names # -LIBCURL_VERSION := 8.21.0 -LIBCURL_SHA256 := aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6 +LIBCURL_VERSION := 8.22.0 +LIBCURL_SHA256 := f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7 LIBCURL := curl-$(LIBCURL_VERSION) LIBCURL_SUFFIX := tar.xz LIBCURL_URL := https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX) @@ -69,8 +69,10 @@ LIBCURL_CONF_OPT := \ --enable-libcurl-option \ --disable-libgcc \ $(GLOBAL_IPV6_OPTION) \ + --disable-gssapi-apple \ --enable-openssl-auto-load-config \ --disable-versioned-symbols \ + --disable-apple-fast-udp \ --disable-windows-unicode \ --$(call ptx/disen, PTXCONF_LIBCURL_C_ARES)-threaded-resolver \ --$(call ptx/endis, PTXCONF_LIBCURL_VERBOSE)-verbose \ @@ -81,8 +83,8 @@ LIBCURL_CONF_OPT := \ --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-kerberos-auth \ --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-negotiate-auth \ --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-aws \ + --disable-httpsig \ --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-ntlm \ - --enable-tls-srp \ --enable-unix-sockets \ --$(call ptx/endis, PTXCONF_LIBCURL_COOKIES)-cookies \ --enable-socketpair \ -- 2.43.0