[rpms/erlang] f44: Fix for CVE-2026-55953

[Peter Lemenkov <lemenkov@gmail.com>]

            A new commit has been pushed.

            Repo   : rpms/erlang
            Branch : f44
            Commit : 27aac611368eabf6ac4a4db21728ce800d71263b
            Author : Peter Lemenkov <lemenkov@gmail.com>
            Date   : 2026-07-30T17:36:19+02:00
            Stats  : +39/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/erlang/c/27aac611368eabf6ac4a4db21728ce800d71263b?branch=f44

            Log:
            Fix for CVE-2026-55953

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

---
diff --git a/erlang.spec b/erlang.spec
index a3cba5c..34b5120 100644
--- a/erlang.spec
+++ b/erlang.spec
@@ -70,7 +70,7 @@
 
 Name:		erlang
 Version:	26.2.5.21
-Release:	4%{?dist}
+Release:	5%{?dist}
 Summary:	General-purpose programming language and runtime environment
 
 License:	Apache-2.0
@@ -115,6 +115,7 @@ Patch13: otp-0013-Protect-the-output-term-buffer-from-overflow.patch
 Patch14: otp-0014-Fix-extended-data-infinite-loop-in-sftpd.patch
 Patch15: otp-0015-ssl-TLS-Client-hardening.patch
 Patch16: otp-0016-ssl-Add-PSK-parameter-check.patch
+Patch17: otp-0017-ssl-Add-pre-TLS-1.3-client-cipher-suite-check.patch
 # end of autogenerated patch tag list
 
 BuildRequires:	gcc
@@ -1963,6 +1964,9 @@ ERL_TOP=${ERL_TOP} make TARGET=${TARGET} release_tests
 
 
 %changelog
+* Thu Jul 30 2026 Peter Lemenkov <lemenkov@gmail.com> - 26.2.5.21-5
+- Backport fix for CVE-2026-55953
+
 * Fri Jul 10 2026 Peter Lemenkov <lemenkov@gmail.com> - 26.2.5.21-4
 - Backport fix for CVE-2026-48858, CVE-2026-48860, CVE-2026-49759,
   CVE-2026-54886, CVE-2026-54891, CVE-2026-55952

diff --git a/otp-0017-ssl-Add-pre-TLS-1.3-client-cipher-suite-check.patch b/otp-0017-ssl-Add-pre-TLS-1.3-client-cipher-suite-check.patch
new file mode 100644
index 0000000..a24615a
--- /dev/null
+++ b/otp-0017-ssl-Add-pre-TLS-1.3-client-cipher-suite-check.patch
@@ -0,0 +1,34 @@
+From: Ingela Anderton Andin <ingela@erlang.org>
+Date: Tue, 30 Jun 2026 09:07:43 +0200
+Subject: [PATCH] ssl: Add pre TLS-1.3 client cipher suite check
+
+
+diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
+index bc7fc78e20..5b808fda9d 100644
+--- a/lib/ssl/src/ssl_handshake.erl
++++ b/lib/ssl/src/ssl_handshake.erl
+@@ -1524,8 +1524,10 @@ handle_server_hello_extensions(RecordCB, Random, CipherSuite, Compression,
+ 			       #{secure_renegotiate := SecureRenegotation} =
+                                    SslOpts,
+ 			       ConnectionStates0, Renegotiation, IsNew) ->
+-    ConnectionStates = handle_renegotiation_extension(client, RecordCB, Version,  
+-                                                      maps:get(renegotiation_info, Exts, undefined), Random, 
++    AvailableCipherSuites = available_suites(maps:get(ciphers, SslOpts), Version),
++    validate_cipher_suite(CipherSuite, AvailableCipherSuites),
++    ConnectionStates = handle_renegotiation_extension(client, RecordCB, Version,
++                                                      maps:get(renegotiation_info, Exts, undefined), Random,
+ 						      CipherSuite, undefined,
+ 						      Compression, ConnectionStates0,
+ 						      Renegotiation, SecureRenegotation),
+@@ -3480,6 +3482,11 @@ filter_unavailable_ecc_suites(no_curve, Suites) ->
+ filter_unavailable_ecc_suites(_, Suites) ->
+     Suites.
+ %%-------------Extension handling --------------------------------
++validate_cipher_suite(CipherSuite, ClientCipherSuites) ->
++    case lists:member(CipherSuite, ClientCipherSuites) of
++        true -> ok;
++        false -> throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER))
++    end.
+ 
+ handle_renegotiation_extension(Role, RecordCB, Version, Info, Random, NegotiatedCipherSuite, 
+ 			       ClientCipherSuites, Compression,