[rpms/curl] f44: Resolves: CVE-2026-7009 - OCSP stapling bypass with Apple SecTrust

[Jan Macku <jamacku@redhat.com>]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : 48da6db314ceab6c7e59d22adb938a77bea7e1e2
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-07-31T08:54:32+02:00
Stats  : +55/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/48da6db314ceab6c7e59d22adb938a77bea7e1e2?branch=f44

Log:
Resolves: CVE-2026-7009 - OCSP stapling bypass with Apple SecTrust

---
diff --git a/0012-curl-8.18.0-CVE-2026-7009.patch b/0012-curl-8.18.0-CVE-2026-7009.patch
new file mode 100644
index 0000000..d32d124
--- /dev/null
+++ b/0012-curl-8.18.0-CVE-2026-7009.patch
@@ -0,0 +1,51 @@
+From 450e25e9ee7c679a1c782f31ed8085d01cfd0e6d Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Sat, 25 Apr 2026 10:34:06 +0200
+Subject: [PATCH] sectrust: fail on missing OCSP stapling
+
+When using Apple SecTrust, requiring the server to send
+an OCSP response and does not, fail correctly.
+
+Reported-by: Carlos Carrillo
+Closes #21444
+
+(cherry picked from commit 51905671e07f087e28e5741063646c379fe17d89)
+---
+ lib/vtls/openssl.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index ebe583154f..f044c10e14 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -4708,16 +4708,26 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
+     unsigned char *ocsp_data = NULL;
+ #endif
+     long ocsp_len = 0;
++    bool ocsp_missing = FALSE;
+     if(conn_config->verifystatus && !octx->reused_session)
+       ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
+ 
+     /* SSL_get_tlsext_status_ocsp_resp() returns the length of the OCSP
+        response data or -1 if there is no OCSP response data. */
+-    if(ocsp_len < 0)
++    if(ocsp_len < 0) {
+       ocsp_len = 0; /* no data available */
++      ocsp_missing = TRUE;
++    }
+     result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
+                                     ossl_chain_get_der, &chain,
+                                     ocsp_data, ocsp_len);
++    if(!result && ocsp_missing && conn_config->verifystatus &&
++       !octx->reused_session) {
++      /* verified, but OCSP stapling is required and server sent none */
++      *pverified = TRUE;
++      failf(data, "No OCSP response received");
++      return CURLE_SSL_INVALIDCERTSTATUS;
++    }
+   }
+   *pverified = !result;
+   return result;
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 70d266d..5ff27e1 100644
--- a/curl.spec
+++ b/curl.spec
@@ -57,6 +57,9 @@ Patch010: 0010-curl-8.18.0-CVE-2026-11856.patch
 # Fix cross-proxy Digest auth state leak (CVE-2026-7168)
 Patch011: 0011-curl-8.18.0-CVE-2026-7168.patch
 
+# Fix OCSP stapling bypass with Apple SecTrust (CVE-2026-7009)
+Patch012: 0012-curl-8.18.0-CVE-2026-7009.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -486,6 +489,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - Fix password leak with netrc and user in URL (CVE-2026-8926)
 - Fix cross-origin Digest auth state leak (CVE-2026-11856)
 - Fix cross-proxy Digest auth state leak (CVE-2026-7168)
+- Fix OCSP stapling bypass with Apple SecTrust (CVE-2026-7009)
 
 * Mon Jul 20 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-7
 - explicitly disable HTTP/3 support in the minimal build