From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f43: Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse Date: Thu, 27 Aug 2026 15:01:14 GMT Message-ID: <178784287477.1.13532934934733297342.rpms-curl-37709a140173@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f43 X-Git-Rev: 37709a14017334f6b56c0c6b367a6496cb23f945 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDMKQ29tbWl0IDogMzc3MDlhMTQwMTczMzRmNmI1NmMwYzZiMzY3YTY0OTZjYjIzZjk0NQpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y NlQxNjowNTo1NyswMjowMApTdGF0cyAgOiArNzEvLTAgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0 dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvY3VybC9jLzM3NzA5YTE0MDE3MzM0ZjZi NTZjMGM2YjM2N2E2NDk2Y2IyM2Y5NDU/YnJhbmNoPWY0MwoKTG9nOgpSZXNvbHZlczogQ1ZFLTIw MjYtODI4NiAtIHdyb25nIFNUQVJUVExTIGNvbm5lY3Rpb24gcmV1c2UKCi0tLQpkaWZmIC0tZ2l0 IGEvMDAxNC1jdXJsLTguMTUuMC1DVkUtMjAyNi04Mjg2LnBhdGNoIGIvMDAxNC1jdXJsLTguMTUu MC1DVkUtMjAyNi04Mjg2LnBhdGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LmFkMDkxMGMKLS0tIC9kZXYvbnVsbAorKysgYi8wMDE0LWN1cmwtOC4xNS4wLUNWRS0yMDI2LTgy ODYucGF0Y2gKQEAgLTAsMCArMSw2NyBAQAorRnJvbSBmNDRlZWIyODY1OGI0M2Q2MWViODFkZmFl ZjQ3ZWJhNzA3NzAyODNlIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogU3RlZmFuIEVp c3NpbmcgPHN0ZWZhbkBlaXNzaW5nLm9yZz4KK0RhdGU6IFRodSwgNyBNYXkgMjAyNiAxMDozMDow NyArMDIwMAorU3ViamVjdDogW1BBVENIXSB1cmw6IGZpeCBjb25uZWN0aW9uIHJldXNlIGZvciBz dGFydHRscyBwcm90b2NvbHMKKworV2hlbiBhIGNvbm5lY3Rpb24gaXMgdGVzdGVkIGZvciByZXVz ZSBpbiBhIHRyYW5zZmVyIHRoYXQgKm1heSogdXBncmFkZQordG8gVExTIChjb21tb25seSB2aWEg U1RBUlRUTFMpLCB0aGUgU1NMIGNvbmZpZ3VyYXRpb24gbXVzdCBtYXRjaCB0aGUKK2V4aXN0aW5n IGNvbm5lY3Rpb24uCisKK1JlcG9ydGVkLWJ5OiBBbmRyZXcgTmVzYml0CitDbG9zZXMgIzIxNTIy CisKKyhjaGVycnkgcGlja2VkIGZyb20gY29tbWl0IGE4NmVmZGQ3Y2E1NDMzZGU5MjMxZTY1MGYx ODI0N2RlODMxOWFkMTYpCistLS0KKyBsaWIvdXJsLmMgfCAxNSArKysrKysrKysrKystLS0KKyAx IGZpbGUgY2hhbmdlZCwgMTIgaW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKKworZGlmZiAt LWdpdCBhL2xpYi91cmwuYyBiL2xpYi91cmwuYworaW5kZXggZmQzYmI1NzVjNy4uYjA0ZWQ3ZTEw YyAxMDA2NDQKKy0tLSBhL2xpYi91cmwuYworKysrIGIvbGliL3VybC5jCitAQCAtODAzLDcgKzgw MywxMSBAQCBzdHJ1Y3QgdXJsX2Nvbm5fbWF0Y2ggeworICAgQklUKHdhbnRfcHJveHlfbnRsbV9o dHRwKTsKKyAgIEJJVCh3YW50X25lZ29faHR0cCk7CisgICBCSVQod2FudF9wcm94eV9uZWdvX2h0 dHApOworLQorKyAgQklUKG1heV90bHMpOyAvKiBNYXkgdXBncmFkZSBjbGVhci10ZXh0IGNvbm5l Y3Rpb24gdG8gVExTLCBjYW4gb25seSByZXVzZQorKyAgICAgICAgICAgICAgICAgKiBjb25uZWN0 aW9ucyB0aGF0IGhhdmUgbWF0Y2hpbmcgVExTIGNvbmZpZ3VyYXRpb24uCisrICAgICAgICAgICAg ICAgICAqIEFsd2F5cyBUUlVFIGlmIGByZXF1aXJlX3Rsc2AgaXMgVFJVRS4gKi8KKysgIEJJVChy ZXF1aXJlX3Rscyk7IC8qIFJlcXVpcmVzIFRMUyB1c2UgZnJvbSBhIGNsZWFyLXRleHQgc3RhcnQs IGNhbiBvbmx5CisrICAgICAgICAgICAgICAgICAqIHJldXNlIGNvbm5lY3Rpb25zIHRoYXQgaGF2 ZSBUTFMuICovCisgICBCSVQod2FpdF9waXBlKTsKKyAgIEJJVChmb3JjZV9yZXVzZSk7CisgICBC SVQoc2Vlbl9wZW5kaW5nX2Nvbm4pOworQEAgLTk1NCw2ICs5NTgsOSBAQCBzdGF0aWMgYm9vbCB1 cmxfbWF0Y2hfc3NsX3VzZShzdHJ1Y3QgY29ubmVjdGRhdGEgKmNvbm4sCisgICAgIGlmKGdldF9w cm90b2NvbF9mYW1pbHkoY29ubi0+aGFuZGxlcikgIT0gbS0+bmVlZGxlLT5oYW5kbGVyLT5wcm90 b2NvbCkKKyAgICAgICByZXR1cm4gRkFMU0U7CisgICB9CisrICBlbHNlIGlmKG0tPnJlcXVpcmVf dGxzKQorKyAgICAvKiBhIGNsZWFyLXRleHQgU1RBUlRUTFMgcHJvdG9jb2wgd2l0aCByZXF1aXJl ZCBUTFMgKi8KKysgICAgcmV0dXJuIEZBTFNFOworICAgcmV0dXJuIFRSVUU7CisgfQorIAorQEAg LTExNDQsOCArMTE1MSw4IEBAIHN0YXRpYyBib29sIHVybF9tYXRjaF9kZXN0aW5hdGlvbihzdHJ1 Y3QgY29ubmVjdGRhdGEgKmNvbm4sCisgc3RhdGljIGJvb2wgdXJsX21hdGNoX3NzbF9jb25maWco c3RydWN0IGNvbm5lY3RkYXRhICpjb25uLAorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHN0cnVjdCB1cmxfY29ubl9tYXRjaCAqbSkKKyB7CistICAvKiBJZiB0YWxraW5nIFRMUywg Y29ubiBuZWVkcyB0byB1c2UgdGhlIHNhbWUgU1NMIG9wdGlvbnMuICovCistICBpZigobS0+bmVl ZGxlLT5oYW5kbGVyLT5mbGFncyAmIFBST1RPUFRfU1NMKSAmJgorKyAgLyogSWYgdGFsa2luZy91 cGdyYWRpbmcgdG8gVExTLCBjb25uIG5lZWRzIHRvIHVzZSB0aGUgc2FtZSBTU0wgb3B0aW9ucy4g Ki8KKysgIGlmKCgobS0+bmVlZGxlLT5oYW5kbGVyLT5mbGFncyAmIFBST1RPUFRfU1NMKSB8fCBt LT5tYXlfdGxzKSAmJgorICAgICAgIUN1cmxfc3NsX2Nvbm5fY29uZmlnX21hdGNoKG0tPmRhdGEs IGNvbm4sIEZBTFNFKSkgeworICAgICBERUJVR0YoaW5mb2YobS0+ZGF0YSwKKyAgICAgICAgICAg ICAgICAgICJDb25uZWN0aW9uICMlIiBGTVRfT0ZGX1QKK0BAIC0xNDE2LDYgKzE0MjMsOCBAQCBD b25uZWN0aW9uRXhpc3RzKHN0cnVjdCBDdXJsX2Vhc3kgKmRhdGEsCisgICAgIChuZWVkbGUtPmhh bmRsZXItPnByb3RvY29sICYgUFJPVE9fRkFNSUxZX0hUVFApOworICNlbmRpZgorICNlbmRpZgor KyAgbWF0Y2gucmVxdWlyZV90bHMgPSBkYXRhLT5zZXQudXNlX3NzbCA+PSBDVVJMVVNFU1NMX0NP TlRST0w7CisrICBtYXRjaC5tYXlfdGxzID0gZGF0YS0+c2V0LnVzZV9zc2wgPiBDVVJMVVNFU1NM X05PTkU7CisgCisgICAvKiBGaW5kIGEgY29ubmVjdGlvbiBpbiB0aGUgcG9vbCB0aGF0IG1hdGNo ZXMgd2hhdCAiZGF0YSArIG5lZWRsZSIKKyAgICAqIHJlcXVpcmVzLiBJZiBhIHN1aXRhYmxlIGNh bmRpZGF0ZSBpcyBmb3VuZCwgaXQgaXMgYXR0YWNoZWQgdG8gImRhdGEiLiAqLworLS0gCisyLjU1 LjAKKwoKZGlmZiAtLWdpdCBhL2N1cmwuc3BlYyBiL2N1cmwuc3BlYwppbmRleCA3MjVmNjBjLi5m NzRjNDI3IDEwMDY0NAotLS0gYS9jdXJsLnNwZWMKKysrIGIvY3VybC5zcGVjCkBAIC01NSw2ICs1 NSw5IEBAIFBhdGNoMDEyOiAwMDEyLWN1cmwtOC4xNS4wLUNWRS0yMDI2LTg5MjQucGF0Y2gKICMg Zml4IHByb3RvLWRlZmF1bHQgc2tpcHMgU1NIIHZlcmlmaWNhdGlvbiAoQ1ZFLTIwMjYtMTIwNjQp CiBQYXRjaDAxMzogMDAxMy1jdXJsLTguMTUuMC1DVkUtMjAyNi0xMjA2NC5wYXRjaAogCisjIGZp eCB3cm9uZyBTVEFSVFRMUyBjb25uZWN0aW9uIHJldXNlIChDVkUtMjAyNi04Mjg2KQorUGF0Y2gw MTQ6IDAwMTQtY3VybC04LjE1LjAtQ1ZFLTIwMjYtODI4Ni5wYXRjaAorCiAjIHBhdGNoIG1ha2lu ZyBsaWJjdXJsIG11bHRpbGliIHJlYWR5CiBQYXRjaDEwMTogMDEwMS1jdXJsLTcuMzIuMC1tdWx0 aWxpYi5wYXRjaAogCkBAIC00NTYsNiArNDU5LDcgQEAgcm0gLWYgJHtSUE1fQlVJTERfUk9PVH0l e19tYW5kaXJ9L21hbjEvd2N1cmwuMSoKICVjaGFuZ2Vsb2cKICogV2VkIEF1ZyAyNiAyMDI2IEph biBNYWNrdSA8amFtYWNrdUByZWRoYXQuY29tPiAtIDguMTUuMC05CiAtIGZpeCBwcm90by1kZWZh dWx0IHNraXBzIFNTSCB2ZXJpZmljYXRpb24gKENWRS0yMDI2LTEyMDY0KQorLSBmaXggd3Jvbmcg U1RBUlRUTFMgY29ubmVjdGlvbiByZXVzZSAoQ1ZFLTIwMjYtODI4NikKIAogKiBNb24gQXVnIDAz IDIwMjYgSmFuIE1hY2t1IDxqYW1hY2t1QHJlZGhhdC5jb20+IC0gOC4xNS4wLTgKIC0gZml4IGNy b3NzLXByb3h5IERpZ2VzdCBhdXRoIHN0YXRlIGxlYWsgKENWRS0yMDI2LTcxNjgpCg==