From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f44: Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse Date: Mon, 24 Aug 2026 14:03:15 GMT Message-ID: <178758019520.1.4890806068235155136.rpms-curl-4323d18a8ae8@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f44 X-Git-Rev: 4323d18a8ae8db5a58eb6b2f0c35a21267e0cc05 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDQKQ29tbWl0IDogNDMyM2QxOGE4YWU4ZGI1YTU4ZWI2YjJmMGMzNWEyMTI2N2UwY2MwNQpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y NFQxMjo1Njo0MyswMjowMApTdGF0cyAgOiArODEvLTAgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0 dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvY3VybC9jLzQzMjNkMThhOGFlOGRiNWE1 OGViNmIyZjBjMzVhMjEyNjdlMGNjMDU/YnJhbmNoPWY0NAoKTG9nOgpSZXNvbHZlczogQ1ZFLTIw MjYtODI4NiAtIHdyb25nIFNUQVJUVExTIGNvbm5lY3Rpb24gcmV1c2UKCi0tLQpkaWZmIC0tZ2l0 IGEvMDAxNi1jdXJsLTguMTguMC1DVkUtMjAyNi04Mjg2LnBhdGNoIGIvMDAxNi1jdXJsLTguMTgu MC1DVkUtMjAyNi04Mjg2LnBhdGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LjJlYjBiYzkKLS0tIC9kZXYvbnVsbAorKysgYi8wMDE2LWN1cmwtOC4xOC4wLUNWRS0yMDI2LTgy ODYucGF0Y2gKQEAgLTAsMCArMSw3NyBAQAorRnJvbSA5MjNhYzQ4YWEwMWQ1OTU3NzIxMWQzZmE2 MTdhY2I1YTE1MDY4NWJhIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogRGFuaWVsIFN0 ZW5iZXJnIDxkYW5pZWxAaGF4eC5zZT4KK0RhdGU6IFR1ZSwgMjQgTWFyIDIwMjYgMDg6MzU6MDgg KzAxMDAKK1N1YmplY3Q6IFtQQVRDSF0gQ1ZFLTIwMjYtODI4NgorCit1cmw6IGRvIG5vdCByZXVz ZSBhIG5vbi10bHMgc3RhcnR0bHMgY29ubmVjdGlvbiBpZiBuZXcgcmVxdWlyZXMgVExTCisKK1Jl cG9ydGVkLWJ5OiBBcmthZGkgVmFpbmJyYW5kCisKK0Nsb3NlcyAjMjEwODIKKworKGNoZXJyeSBw aWNrZWQgZnJvbSBjb21taXQgNTA3ZTdiZTU3M2IwYTc2ZmNhNTk3Yjc1ZmY3Y2IyN2E2NmU3ZDg2 NSkKKwordXJsOiBmaXggY29ubmVjdGlvbiByZXVzZSBmb3Igc3RhcnR0bHMgcHJvdG9jb2xzCisK K1doZW4gYSBjb25uZWN0aW9uIGlzIHRlc3RlZCBmb3IgcmV1c2UgaW4gYSB0cmFuc2ZlciB0aGF0 ICptYXkqIHVwZ3JhZGUKK3RvIFRMUyAoY29tbW9ubHkgdmlhIFNUQVJUVExTKSwgdGhlIFNTTCBj b25maWd1cmF0aW9uIG11c3QgbWF0Y2ggdGhlCitleGlzdGluZyBjb25uZWN0aW9uLgorCitSZXBv cnRlZC1ieTogQW5kcmV3IE5lc2JpdAorQ2xvc2VzICMyMTUyMgorCisoY2hlcnJ5IHBpY2tlZCBm cm9tIGNvbW1pdCBhODZlZmRkN2NhNTQzM2RlOTIzMWU2NTBmMTgyNDdkZTgzMTlhZDE2KQorLS0t CisgbGliL3VybC5jIHwgMTUgKysrKysrKysrKysrLS0tCisgMSBmaWxlIGNoYW5nZWQsIDEyIGlu c2VydGlvbnMoKyksIDMgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1naXQgYS9saWIvdXJsLmMgYi9s aWIvdXJsLmMKK2luZGV4IDVhNzVmZTcxZGEuLjYwM2ZlYzY4YjYgMTAwNjQ0CistLS0gYS9saWIv dXJsLmMKKysrKyBiL2xpYi91cmwuYworQEAgLTc0Niw3ICs3NDYsMTEgQEAgc3RydWN0IHVybF9j b25uX21hdGNoIHsKKyAgIEJJVCh3YW50X3Byb3h5X250bG1faHR0cCk7CisgICBCSVQod2FudF9u ZWdvX2h0dHApOworICAgQklUKHdhbnRfcHJveHlfbmVnb19odHRwKTsKKy0KKysgIEJJVChtYXlf dGxzKTsgLyogTWF5IHVwZ3JhZGUgY2xlYXItdGV4dCBjb25uZWN0aW9uIHRvIFRMUywgY2FuIG9u bHkgcmV1c2UKKysgICAgICAgICAgICAgICAgICogY29ubmVjdGlvbnMgdGhhdCBoYXZlIG1hdGNo aW5nIFRMUyBjb25maWd1cmF0aW9uLgorKyAgICAgICAgICAgICAgICAgKiBBbHdheXMgVFJVRSBp ZiBgcmVxX3Rsc2AgaXMgVFJVRS4gKi8KKysgIEJJVChyZXF1aXJlX3Rscyk7IC8qIFJlcXVpcmVz IFRMUyB1c2UgZnJvbSBhIGNsZWFyLXRleHQgc3RhcnQsIGNhbiBvbmx5CisrICAgICAgICAgICAg ICAgICAqIHJldXNlIGNvbm5lY3Rpb25zIHRoYXQgaGF2ZSBUTFMuICovCisgICBCSVQod2FpdF9w aXBlKTsKKyAgIEJJVChmb3JjZV9yZXVzZSk7CisgICBCSVQoc2Vlbl9wZW5kaW5nX2Nvbm4pOwor QEAgLTg5OCw2ICs5MDIsOSBAQCBzdGF0aWMgYm9vbCB1cmxfbWF0Y2hfc3NsX3VzZShzdHJ1Y3Qg Y29ubmVjdGRhdGEgKmNvbm4sCisgICAgICAgIChnZXRfcHJvdG9jb2xfZmFtaWx5KGNvbm4tPmhh bmRsZXIpICE9IG0tPm5lZWRsZS0+aGFuZGxlci0+cHJvdG9jb2wpKQorICAgICAgIHJldHVybiBG QUxTRTsKKyAgIH0KKysgIGVsc2UgaWYobS0+cmVxdWlyZV90bHMpCisrICAgIC8qIGEgY2xlYXIt dGV4dCBTVEFSVFRMUyBwcm90b2NvbCB3aXRoIHJlcXVpcmVkIFRMUyAqLworKyAgICByZXR1cm4g RkFMU0U7CisgICByZXR1cm4gVFJVRTsKKyB9CisgCitAQCAtMTA4OCw4ICsxMDk1LDggQEAgc3Rh dGljIGJvb2wgdXJsX21hdGNoX2Rlc3RpbmF0aW9uKHN0cnVjdCBjb25uZWN0ZGF0YSAqY29ubiwK KyBzdGF0aWMgYm9vbCB1cmxfbWF0Y2hfc3NsX2NvbmZpZyhzdHJ1Y3QgY29ubmVjdGRhdGEgKmNv bm4sCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3RydWN0IHVybF9jb25uX21h dGNoICptKQorIHsKKy0gIC8qIElmIHRhbGtpbmcgVExTLCBjb25uIG5lZWRzIHRvIHVzZSB0aGUg c2FtZSBTU0wgb3B0aW9ucy4gKi8KKy0gIGlmKChtLT5uZWVkbGUtPmhhbmRsZXItPmZsYWdzICYg UFJPVE9QVF9TU0wpICYmCisrICAvKiBJZiB0YWxraW5nL3VwZ3JhZGluZyB0byBUTFMsIGNvbm4g bmVlZHMgdG8gdXNlIHRoZSBzYW1lIFNTTCBvcHRpb25zLiAqLworKyAgaWYoKChtLT5uZWVkbGUt PmhhbmRsZXItPmZsYWdzICYgUFJPVE9QVF9TU0wpIHx8IG0tPm1heV90bHMpICYmCisgICAgICAh Q3VybF9zc2xfY29ubl9jb25maWdfbWF0Y2gobS0+ZGF0YSwgY29ubiwgRkFMU0UpKSB7CisgICAg IERFQlVHRihpbmZvZihtLT5kYXRhLAorICAgICAgICAgICAgICAgICAgIkNvbm5lY3Rpb24gIyUi IEZNVF9PRkZfVAorQEAgLTEzNjAsNiArMTM2Nyw4IEBAIHN0YXRpYyBib29sIENvbm5lY3Rpb25F eGlzdHMoc3RydWN0IEN1cmxfZWFzeSAqZGF0YSwKKyAgICAgKG5lZWRsZS0+aGFuZGxlci0+cHJv dG9jb2wgJiBQUk9UT19GQU1JTFlfSFRUUCk7CisgI2VuZGlmCisgI2VuZGlmCisrICBtYXRjaC5y ZXF1aXJlX3RscyA9IGRhdGEtPnNldC51c2Vfc3NsID49IENVUkxVU0VTU0xfQ09OVFJPTDsKKysg IG1hdGNoLm1heV90bHMgPSBkYXRhLT5zZXQudXNlX3NzbCA+IENVUkxVU0VTU0xfTk9ORTsKKyAK KyAgIC8qIEZpbmQgYSBjb25uZWN0aW9uIGluIHRoZSBwb29sIHRoYXQgbWF0Y2hlcyB3aGF0ICJk YXRhICsgbmVlZGxlIgorICAgICogcmVxdWlyZXMuIElmIGEgc3VpdGFibGUgY2FuZGlkYXRlIGlz IGZvdW5kLCBpdCBpcyBhdHRhY2hlZCB0byAiZGF0YSIuICovCistLSAKKzIuNTUuMAorCgpkaWZm IC0tZ2l0IGEvY3VybC5zcGVjIGIvY3VybC5zcGVjCmluZGV4IDk0ZGM3MzguLjljNDIzMjQgMTAw NjQ0Ci0tLSBhL2N1cmwuc3BlYworKysgYi9jdXJsLnNwZWMKQEAgLTY5LDYgKzY5LDkgQEAgUGF0 Y2gwMTQ6IDAwMTQtY3VybC04LjE4LjAtQ1ZFLTIwMjYtMTE1ODYucGF0Y2gKICMgRml4IHByb3Rv LWRlZmF1bHQgc2tpcHMgU1NIIHZlcmlmaWNhdGlvbiAoQ1ZFLTIwMjYtMTIwNjQpCiBQYXRjaDAx NTogMDAxNS1jdXJsLTguMTguMC1DVkUtMjAyNi0xMjA2NC5wYXRjaAogCisjIEZpeCB3cm9uZyBT VEFSVFRMUyBjb25uZWN0aW9uIHJldXNlIChDVkUtMjAyNi04Mjg2KQorUGF0Y2gwMTY6IDAwMTYt Y3VybC04LjE4LjAtQ1ZFLTIwMjYtODI4Ni5wYXRjaAorCiAjIHBhdGNoIG1ha2luZyBsaWJjdXJs IG11bHRpbGliIHJlYWR5CiBQYXRjaDEwMTogMDEwMS1jdXJsLTcuMzIuMC1tdWx0aWxpYi5wYXRj aAogCkBAIC00OTYsNiArNDk5LDcgQEAgcm0gLWYgJHtSUE1fQlVJTERfUk9PVH0le19tYW5kaXJ9 L21hbjEvd2N1cmwuMSoKIC0gRml4IFFVSUMgemVyby1sZW5ndGggVURQIGRhdGFncmFtcyBidXN5 LWxvb3AgKENWRS0yMDI2LTExMzUyKQogLSBGaXggV1MgQXV0by1QT05HIG1lbW9yeSBleGhhdXN0 aW9uIChDVkUtMjAyNi0xMTU4NikKIC0gRml4IHByb3RvLWRlZmF1bHQgc2tpcHMgU1NIIHZlcmlm aWNhdGlvbiAoQ1ZFLTIwMjYtMTIwNjQpCistIEZpeCB3cm9uZyBTVEFSVFRMUyBjb25uZWN0aW9u IHJldXNlIChDVkUtMjAyNi04Mjg2KQogCiAqIFdlZCBKdWwgMjkgMjAyNiBKYW4gTWFja3UgPGph bWFja3VAcmVkaGF0LmNvbT4gLSA4LjE4LjAtOAogLSBGaXggdHJhaWxpbmcgZG90IGRvbWFpbiBz dXBlciBjb29raWUgKENWRS0yMDI2LTg5MjQpCg==