From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f44: Resolves: CVE-2026-7009 - OCSP stapling bypass with Apple SecTrust Date: Fri, 31 Jul 2026 10:22:18 GMT Message-ID: <178549333889.1.8302963911750345384.rpms-curl-48da6db314ce@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f44 X-Git-Rev: 48da6db314ceab6c7e59d22adb938a77bea7e1e2 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDQKQ29tbWl0IDogNDhkYTZkYjMxNGNlYWI2YzdlNTlkMjJhZGI5MzhhNzdiZWE3ZTFlMgpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wNy0z MVQwODo1NDozMiswMjowMApTdGF0cyAgOiArNTUvLTAgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0 dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvY3VybC9jLzQ4ZGE2ZGIzMTRjZWFiNmM3 ZTU5ZDIyYWRiOTM4YTc3YmVhN2UxZTI/YnJhbmNoPWY0NAoKTG9nOgpSZXNvbHZlczogQ1ZFLTIw MjYtNzAwOSAtIE9DU1Agc3RhcGxpbmcgYnlwYXNzIHdpdGggQXBwbGUgU2VjVHJ1c3QKCi0tLQpk aWZmIC0tZ2l0IGEvMDAxMi1jdXJsLTguMTguMC1DVkUtMjAyNi03MDA5LnBhdGNoIGIvMDAxMi1j dXJsLTguMTguMC1DVkUtMjAyNi03MDA5LnBhdGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4 IDAwMDAwMDAuLmQzMmQxMjQKLS0tIC9kZXYvbnVsbAorKysgYi8wMDEyLWN1cmwtOC4xOC4wLUNW RS0yMDI2LTcwMDkucGF0Y2gKQEAgLTAsMCArMSw1MSBAQAorRnJvbSA0NTBlMjVlOWVlN2M2Nzlh MWM3ODJmMzFlZDgwODVkMDFjZmQwZTZkIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTog U3RlZmFuIEVpc3NpbmcgPHN0ZWZhbkBlaXNzaW5nLm9yZz4KK0RhdGU6IFNhdCwgMjUgQXByIDIw MjYgMTA6MzQ6MDYgKzAyMDAKK1N1YmplY3Q6IFtQQVRDSF0gc2VjdHJ1c3Q6IGZhaWwgb24gbWlz c2luZyBPQ1NQIHN0YXBsaW5nCisKK1doZW4gdXNpbmcgQXBwbGUgU2VjVHJ1c3QsIHJlcXVpcmlu ZyB0aGUgc2VydmVyIHRvIHNlbmQKK2FuIE9DU1AgcmVzcG9uc2UgYW5kIGRvZXMgbm90LCBmYWls IGNvcnJlY3RseS4KKworUmVwb3J0ZWQtYnk6IENhcmxvcyBDYXJyaWxsbworQ2xvc2VzICMyMTQ0 NAorCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCA1MTkwNTY3MWUwN2YwODdlMjhlNTc0MTA2 MzY0NmMzNzlmZTE3ZDg5KQorLS0tCisgbGliL3Z0bHMvb3BlbnNzbC5jIHwgMTIgKysrKysrKysr KystCisgMSBmaWxlIGNoYW5nZWQsIDExIGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKKwor ZGlmZiAtLWdpdCBhL2xpYi92dGxzL29wZW5zc2wuYyBiL2xpYi92dGxzL29wZW5zc2wuYworaW5k ZXggZWJlNTgzMTU0Zi4uZjA0NGMxMGUxNCAxMDA2NDQKKy0tLSBhL2xpYi92dGxzL29wZW5zc2wu YworKysrIGIvbGliL3Z0bHMvb3BlbnNzbC5jCitAQCAtNDcwOCwxNiArNDcwOCwyNiBAQCBzdGF0 aWMgQ1VSTGNvZGUgb3NzbF9hcHBsZV92ZXJpZnkoc3RydWN0IEN1cmxfY2ZpbHRlciAqY2YsCisg ICAgIHVuc2lnbmVkIGNoYXIgKm9jc3BfZGF0YSA9IE5VTEw7CisgI2VuZGlmCisgICAgIGxvbmcg b2NzcF9sZW4gPSAwOworKyAgICBib29sIG9jc3BfbWlzc2luZyA9IEZBTFNFOworICAgICBpZihj b25uX2NvbmZpZy0+dmVyaWZ5c3RhdHVzICYmICFvY3R4LT5yZXVzZWRfc2Vzc2lvbikKKyAgICAg ICBvY3NwX2xlbiA9IChsb25nKVNTTF9nZXRfdGxzZXh0X3N0YXR1c19vY3NwX3Jlc3Aob2N0eC0+ c3NsLCAmb2NzcF9kYXRhKTsKKyAKKyAgICAgLyogU1NMX2dldF90bHNleHRfc3RhdHVzX29jc3Bf cmVzcCgpIHJldHVybnMgdGhlIGxlbmd0aCBvZiB0aGUgT0NTUAorICAgICAgICByZXNwb25zZSBk YXRhIG9yIC0xIGlmIHRoZXJlIGlzIG5vIE9DU1AgcmVzcG9uc2UgZGF0YS4gKi8KKy0gICAgaWYo b2NzcF9sZW4gPCAwKQorKyAgICBpZihvY3NwX2xlbiA8IDApIHsKKyAgICAgICBvY3NwX2xlbiA9 IDA7IC8qIG5vIGRhdGEgYXZhaWxhYmxlICovCisrICAgICAgb2NzcF9taXNzaW5nID0gVFJVRTsK KysgICAgfQorICAgICByZXN1bHQgPSBDdXJsX3Z0bHNfYXBwbGVfdmVyaWZ5KGNmLCBkYXRhLCBw ZWVyLCBjaGFpbi5udW1fY2VydHMsCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgb3NzbF9jaGFpbl9nZXRfZGVyLCAmY2hhaW4sCisgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgb2NzcF9kYXRhLCBvY3NwX2xlbik7CisrICAgIGlmKCFyZXN1bHQgJiYgb2Nz cF9taXNzaW5nICYmIGNvbm5fY29uZmlnLT52ZXJpZnlzdGF0dXMgJiYKKysgICAgICAgIW9jdHgt PnJldXNlZF9zZXNzaW9uKSB7CisrICAgICAgLyogdmVyaWZpZWQsIGJ1dCBPQ1NQIHN0YXBsaW5n IGlzIHJlcXVpcmVkIGFuZCBzZXJ2ZXIgc2VudCBub25lICovCisrICAgICAgKnB2ZXJpZmllZCA9 IFRSVUU7CisrICAgICAgZmFpbGYoZGF0YSwgIk5vIE9DU1AgcmVzcG9uc2UgcmVjZWl2ZWQiKTsK KysgICAgICByZXR1cm4gQ1VSTEVfU1NMX0lOVkFMSURDRVJUU1RBVFVTOworKyAgICB9CisgICB9 CisgICAqcHZlcmlmaWVkID0gIXJlc3VsdDsKKyAgIHJldHVybiByZXN1bHQ7CistLSAKKzIuNTUu MAorCgpkaWZmIC0tZ2l0IGEvY3VybC5zcGVjIGIvY3VybC5zcGVjCmluZGV4IDcwZDI2NmQuLjVm ZjI3ZTEgMTAwNjQ0Ci0tLSBhL2N1cmwuc3BlYworKysgYi9jdXJsLnNwZWMKQEAgLTU3LDYgKzU3 LDkgQEAgUGF0Y2gwMTA6IDAwMTAtY3VybC04LjE4LjAtQ1ZFLTIwMjYtMTE4NTYucGF0Y2gKICMg Rml4IGNyb3NzLXByb3h5IERpZ2VzdCBhdXRoIHN0YXRlIGxlYWsgKENWRS0yMDI2LTcxNjgpCiBQ YXRjaDAxMTogMDAxMS1jdXJsLTguMTguMC1DVkUtMjAyNi03MTY4LnBhdGNoCiAKKyMgRml4IE9D U1Agc3RhcGxpbmcgYnlwYXNzIHdpdGggQXBwbGUgU2VjVHJ1c3QgKENWRS0yMDI2LTcwMDkpCitQ YXRjaDAxMjogMDAxMi1jdXJsLTguMTguMC1DVkUtMjAyNi03MDA5LnBhdGNoCisKICMgcGF0Y2gg bWFraW5nIGxpYmN1cmwgbXVsdGlsaWIgcmVhZHkKIFBhdGNoMTAxOiAwMTAxLWN1cmwtNy4zMi4w LW11bHRpbGliLnBhdGNoCiAKQEAgLTQ4Niw2ICs0ODksNyBAQCBybSAtZiAke1JQTV9CVUlMRF9S T09UfSV7X21hbmRpcn0vbWFuMS93Y3VybC4xKgogLSBGaXggcGFzc3dvcmQgbGVhayB3aXRoIG5l dHJjIGFuZCB1c2VyIGluIFVSTCAoQ1ZFLTIwMjYtODkyNikKIC0gRml4IGNyb3NzLW9yaWdpbiBE aWdlc3QgYXV0aCBzdGF0ZSBsZWFrIChDVkUtMjAyNi0xMTg1NikKIC0gRml4IGNyb3NzLXByb3h5 IERpZ2VzdCBhdXRoIHN0YXRlIGxlYWsgKENWRS0yMDI2LTcxNjgpCistIEZpeCBPQ1NQIHN0YXBs aW5nIGJ5cGFzcyB3aXRoIEFwcGxlIFNlY1RydXN0IChDVkUtMjAyNi03MDA5KQogCiAqIE1vbiBK dWwgMjAgMjAyNiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4gLSA4LjE4LjAtNwogLSBl eHBsaWNpdGx5IGRpc2FibGUgSFRUUC8zIHN1cHBvcnQgaW4gdGhlIG1pbmltYWwgYnVpbGQK