From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f44: Resolves: CVE-2026-8458 - wrong reuse for different services Date: Tue, 08 Sep 2026 13:41:14 GMT Message-ID: <178887487499.1.10116545032068687143.rpms-curl-36d783226377@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f44 X-Git-Rev: 36d78322637794048cbf72be708508b2e728daba QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDQKQ29tbWl0IDogMzZkNzgzMjI2Mzc3OTQwNDhjYmY3MmJlNzA4NTA4YjJlNzI4ZGFiYQpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y N1QxNjowMDoxMCswMjowMApTdGF0cyAgOiArMTI4Ly0wIGluIDIgZmlsZShzKQpVUkwgICAgOiBo dHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2N1cmwvYy8zNmQ3ODMyMjYzNzc5NDA0 OGNiZjcyYmU3MDg1MDhiMmU3MjhkYWJhP2JyYW5jaD1mNDQKCkxvZzoKUmVzb2x2ZXM6IENWRS0y MDI2LTg0NTggLSB3cm9uZyByZXVzZSBmb3IgZGlmZmVyZW50IHNlcnZpY2VzCgotLS0KZGlmZiAt LWdpdCBhLzAwMjUtY3VybC04LjE4LjAtQ1ZFLTIwMjYtODQ1OC5wYXRjaCBiLzAwMjUtY3VybC04 LjE4LjAtQ1ZFLTIwMjYtODQ1OC5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwLi4wNzA4YmJjCi0tLSAvZGV2L251bGwKKysrIGIvMDAyNS1jdXJsLTguMTguMC1DVkUtMjAy Ni04NDU4LnBhdGNoCkBAIC0wLDAgKzEsMTI0IEBACitGcm9tIDE3OTc0NjU0NWU1OWQyNDFkZmI5 OTAxNTg4YTYwYmJkMTAwMzk3ZWEgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBTdGVm YW4gRWlzc2luZyA8c3RlZmFuQGVpc3Npbmcub3JnPgorRGF0ZTogV2VkLCAxMyBNYXkgMjAyNiAx MjowMjo0OCArMDIwMAorU3ViamVjdDogW1BBVENIXSBjcmVkczogYWRkIHNhc2wgc2VydmljZSBu YW1lCisKK1RoZSBTQVNMIHNlcnZpY2UgbmFtZSwgdXNlZCBpbiBhdXRoZW50aWNhdGlvbiwgaXMg cGFydCBvZiBjdXJsJ3MgY3JlZGVudGlhbHMKK3doZW4gYXV0aGVudGljYXRpbmcgdG8gYSBzZXJ2 ZXIvcHJveHkuIE1ha2UgaXQgcGFydCBvZiB0aGUgY29ubmVjdGlvbidzCitjcmVkZW50aWFscyBz byB0aGF0IGNvbm5lY3Rpb24gcmV1c2UgaXMgb25seSBhbGxvd2VkIHdoZW4gdGhlIHNlcnZpY2UK K25hbWUgbWF0Y2hlcy4KKworQ2xvc2VzICMyMTU4NQorCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNv bW1pdCA1ZTk5YjczY2Y0NDFkOWMzNjk3NjhiOWNkNDhiNTM4OWI5YTI1MDNkKQorQ28tYXV0aG9y ZWQtYnk6IEN1cnNvciA8Y3Vyc29yYWdlbnRAY3Vyc29yLmNvbT4KKy0tLQorIGxpYi91cmwuYyAg ICAgfCAzNiArKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLS0KKyBsaWIvdXJsZGF0 YS5oIHwgIDIgKysKKyAyIGZpbGVzIGNoYW5nZWQsIDMzIGluc2VydGlvbnMoKyksIDUgZGVsZXRp b25zKC0pCisKK2RpZmYgLS1naXQgYS9saWIvdXJsLmMgYi9saWIvdXJsLmMKK2luZGV4IDkwMGIw ZjczNTIuLmMzZmIxNDM5Y2EgMTAwNjQ0CistLS0gYS9saWIvdXJsLmMKKysrKyBiL2xpYi91cmwu YworQEAgLTUzOCw2ICs1MzgsOCBAQCB2b2lkIEN1cmxfY29ubl9mcmVlKHN0cnVjdCBDdXJsX2Vh c3kgKmRhdGEsIHN0cnVjdCBjb25uZWN0ZGF0YSAqY29ubikKKyAgIEN1cmxfc2FmZWZyZWUoY29u bi0+c2FzbF9hdXRoemlkKTsKKyAgIEN1cmxfc2FmZWZyZWUoY29ubi0+b3B0aW9ucyk7CisgICBD dXJsX3NhZmVmcmVlKGNvbm4tPm9hdXRoX2JlYXJlcik7CisrICBDdXJsX3NhZmVmcmVlKGNvbm4t PnNhc2xfc2VydmljZSk7CisrICBDdXJsX3NhZmVmcmVlKGNvbm4tPnByb3h5X3NlcnZpY2UpOwor ICAgQ3VybF9zYWZlZnJlZShjb25uLT5ob3N0LnJhd2FsbG9jKTsgLyogaG9zdG5hbWUgYnVmZmVy ICovCisgICBDdXJsX3NhZmVmcmVlKGNvbm4tPmNvbm5fdG9faG9zdC5yYXdhbGxvYyk7IC8qIGhv c3RuYW1lIGJ1ZmZlciAqLworICAgQ3VybF9zYWZlZnJlZShjb25uLT5ob3N0bmFtZV9yZXNvbHZl KTsKK0BAIC0xMDMyLDcgKzEwMzQsOCBAQCBzdGF0aWMgYm9vbCB1cmxfbWF0Y2hfYXV0aChzdHJ1 Y3QgY29ubmVjdGRhdGEgKmNvbm4sCisgICAgIGlmKEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUt PnVzZXIsIGNvbm4tPnVzZXIpIHx8CisgICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUt PnBhc3N3ZCwgY29ubi0+cGFzc3dkKSB8fAorICAgICAgICBDdXJsX3RpbWVzdHJjbXAobS0+bmVl ZGxlLT5zYXNsX2F1dGh6aWQsIGNvbm4tPnNhc2xfYXV0aHppZCkgfHwKKy0gICAgICAgQ3VybF90 aW1lc3RyY21wKG0tPm5lZWRsZS0+b2F1dGhfYmVhcmVyLCBjb25uLT5vYXV0aF9iZWFyZXIpKSB7 CisrICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUtPm9hdXRoX2JlYXJlciwgY29ubi0+ b2F1dGhfYmVhcmVyKSB8fAorKyAgICAgICBDdXJsX3RpbWVzdHJjbXAobS0+bmVlZGxlLT5zYXNs X3NlcnZpY2UsIGNvbm4tPnNhc2xfc2VydmljZSkpIHsKKyAgICAgICAvKiBvbmUgb2YgdGhlbSB3 YXMgZGlmZmVyZW50ICovCisgICAgICAgcmV0dXJuIEZBTFNFOworICAgICB9CitAQCAtMTExNCw3 ICsxMTE3LDggQEAgc3RhdGljIGJvb2wgdXJsX21hdGNoX2F1dGhfbnRsbShzdHJ1Y3QgY29ubmVj dGRhdGEgKmNvbm4sCisgICAgICBwYXJ0d2F5IHRocm91Z2ggYSBoYW5kc2hha2UhKSAqLworICAg aWYobS0+d2FudF9udGxtX2h0dHApIHsKKyAgICAgaWYoQ3VybF90aW1lc3RyY21wKG0tPm5lZWRs ZS0+dXNlciwgY29ubi0+dXNlcikgfHwKKy0gICAgICAgQ3VybF90aW1lc3RyY21wKG0tPm5lZWRs ZS0+cGFzc3dkLCBjb25uLT5wYXNzd2QpKSB7CisrICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5u ZWVkbGUtPnBhc3N3ZCwgY29ubi0+cGFzc3dkKSB8fAorKyAgICAgICBDdXJsX3RpbWVzdHJjbXAo bS0+bmVlZGxlLT5zYXNsX3NlcnZpY2UsIGNvbm4tPnNhc2xfc2VydmljZSkpIHsKKyAKKyAgICAg ICAvKiB3ZSBwcmVmZXIgYSBjcmVkZW50aWFsIG1hdGNoLCBidXQgdGhpcyBpcyBhdCBsZWFzdCBh IGNvbm5lY3Rpb24KKyAgICAgICAgICB0aGF0IGNhbiBiZSByZXVzZWQgYW5kICJ1cGdyYWRlZCIg dG8gTlRMTSAqLworQEAgLTExMzksNyArMTE0Myw5IEBAIHN0YXRpYyBib29sIHVybF9tYXRjaF9h dXRoX250bG0oc3RydWN0IGNvbm5lY3RkYXRhICpjb25uLAorICAgICBpZihDdXJsX3RpbWVzdHJj bXAobS0+bmVlZGxlLT5odHRwX3Byb3h5LnVzZXIsCisgICAgICAgICAgICAgICAgICAgICAgICBj b25uLT5odHRwX3Byb3h5LnVzZXIpIHx8CisgICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5uZWVk bGUtPmh0dHBfcHJveHkucGFzc3dkLAorLSAgICAgICAgICAgICAgICAgICAgICAgY29ubi0+aHR0 cF9wcm94eS5wYXNzd2QpKQorKyAgICAgICAgICAgICAgICAgICAgICAgY29ubi0+aHR0cF9wcm94 eS5wYXNzd2QpIHx8CisrICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUtPnByb3h5X3Nl cnZpY2UsCisrICAgICAgICAgICAgICAgICAgICAgICBjb25uLT5wcm94eV9zZXJ2aWNlKSkKKyAg ICAgICByZXR1cm4gRkFMU0U7CisgICB9CisgICBlbHNlIGlmKGNvbm4tPnByb3h5X250bG1fc3Rh dGUgIT0gTlRMTVNUQVRFX05PTkUpIHsKK0BAIC0xMTgwLDcgKzExODYsOCBAQCBzdGF0aWMgYm9v bCB1cmxfbWF0Y2hfYXV0aF9uZWdvKHN0cnVjdCBjb25uZWN0ZGF0YSAqY29ubiwKKyAgICAgIHNv IHRoYXQgd2UgY2FuIHJldXNlIE5lZ290aWF0ZSBjb25uZWN0aW9ucyBpZiBwb3NzaWJsZS4gKi8K KyAgIGlmKG0tPndhbnRfbmVnb19odHRwKSB7CisgICAgIGlmKEN1cmxfdGltZXN0cmNtcChtLT5u ZWVkbGUtPnVzZXIsIGNvbm4tPnVzZXIpIHx8CistICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5u ZWVkbGUtPnBhc3N3ZCwgY29ubi0+cGFzc3dkKSkKKysgICAgICAgQ3VybF90aW1lc3RyY21wKG0t Pm5lZWRsZS0+cGFzc3dkLCBjb25uLT5wYXNzd2QpIHx8CisrICAgICAgIEN1cmxfdGltZXN0cmNt cChtLT5uZWVkbGUtPnNhc2xfc2VydmljZSwgY29ubi0+c2FzbF9zZXJ2aWNlKSkKKyAgICAgICBy ZXR1cm4gRkFMU0U7CisgICB9CisgICBlbHNlIGlmKGNvbm4tPmh0dHBfbmVnb3RpYXRlX3N0YXRl ICE9IEdTU19BVVRITk9ORSkgeworQEAgLTExOTksNyArMTIwNiw5IEBAIHN0YXRpYyBib29sIHVy bF9tYXRjaF9hdXRoX25lZ28oc3RydWN0IGNvbm5lY3RkYXRhICpjb25uLAorICAgICBpZihDdXJs X3RpbWVzdHJjbXAobS0+bmVlZGxlLT5odHRwX3Byb3h5LnVzZXIsCisgICAgICAgICAgICAgICAg ICAgICAgICBjb25uLT5odHRwX3Byb3h5LnVzZXIpIHx8CisgICAgICAgIEN1cmxfdGltZXN0cmNt cChtLT5uZWVkbGUtPmh0dHBfcHJveHkucGFzc3dkLAorLSAgICAgICAgICAgICAgICAgICAgICAg Y29ubi0+aHR0cF9wcm94eS5wYXNzd2QpKQorKyAgICAgICAgICAgICAgICAgICAgICAgY29ubi0+ aHR0cF9wcm94eS5wYXNzd2QpIHx8CisrICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUt PnByb3h5X3NlcnZpY2UsCisrICAgICAgICAgICAgICAgICAgICAgICBjb25uLT5wcm94eV9zZXJ2 aWNlKSkKKyAgICAgICByZXR1cm4gRkFMU0U7CisgICB9CisgICBlbHNlIGlmKGNvbm4tPnByb3h5 X25lZ290aWF0ZV9zdGF0ZSAhPSBHU1NfQVVUSE5PTkUpIHsKK0BAIC0zNTA1LDYgKzM1MTQsMjMg QEAgc3RhdGljIENVUkxjb2RlIGNyZWF0ZV9jb25uKHN0cnVjdCBDdXJsX2Vhc3kgKmRhdGEsCisg ICAgIH0KKyAgIH0KKyAKKysgIGlmKGRhdGEtPnNldC5zdHJbU1RSSU5HX1NFUlZJQ0VfTkFNRV0p IHsKKysgICAgY29ubi0+c2FzbF9zZXJ2aWNlID0gY3VybHhfc3RyZHVwKGRhdGEtPnNldC5zdHJb U1RSSU5HX1NFUlZJQ0VfTkFNRV0pOworKyAgICBpZighY29ubi0+c2FzbF9zZXJ2aWNlKSB7Cisr ICAgICAgcmVzdWx0ID0gQ1VSTEVfT1VUX09GX01FTU9SWTsKKysgICAgICBnb3RvIG91dDsKKysg ICAgfQorKyAgfQorKworKyAgaWYoZGF0YS0+c2V0LnN0cltTVFJJTkdfUFJPWFlfU0VSVklDRV9O QU1FXSkgeworKyAgICBjb25uLT5wcm94eV9zZXJ2aWNlID0KKysgICAgICBjdXJseF9zdHJkdXAo ZGF0YS0+c2V0LnN0cltTVFJJTkdfUFJPWFlfU0VSVklDRV9OQU1FXSk7CisrICAgIGlmKCFjb25u LT5wcm94eV9zZXJ2aWNlKSB7CisrICAgICAgcmVzdWx0ID0gQ1VSTEVfT1VUX09GX01FTU9SWTsK KysgICAgICBnb3RvIG91dDsKKysgICAgfQorKyAgfQorKworICNpZmRlZiBVU0VfVU5JWF9TT0NL RVRTCisgICBpZihkYXRhLT5zZXQuc3RyW1NUUklOR19VTklYX1NPQ0tFVF9QQVRIXSkgeworICAg ICBjb25uLT51bml4X2RvbWFpbl9zb2NrZXQgPQorZGlmZiAtLWdpdCBhL2xpYi91cmxkYXRhLmgg Yi9saWIvdXJsZGF0YS5oCitpbmRleCA3ZTM2Y2MyMzM2Li4zMThkZmRiODRjIDEwMDY0NAorLS0t IGEvbGliL3VybGRhdGEuaAorKysrIGIvbGliL3VybGRhdGEuaAorQEAgLTYzNyw2ICs2MzcsOCBA QCBzdHJ1Y3QgY29ubmVjdGRhdGEgeworICAgY2hhciAqb3B0aW9uczsgLyogb3B0aW9ucyBzdHJp bmcsIGFsbG9jYXRlZCAqLworICAgY2hhciAqc2FzbF9hdXRoemlkOyAgICAgLyogYXV0aG9yaXph dGlvbiBpZGVudGl0eSBzdHJpbmcsIGFsbG9jYXRlZCAqLworICAgY2hhciAqb2F1dGhfYmVhcmVy OyAvKiBPQVVUSDIgYmVhcmVyLCBhbGxvY2F0ZWQgKi8KKysgIGNoYXIgKnNhc2xfc2VydmljZTsg LyogU0FTTCBzZXJ2aWNlIG5hbWUsIGFsbG9jYXRlZCAqLworKyAgY2hhciAqcHJveHlfc2Vydmlj ZTsgLyogcHJveHkgU0FTTCBzZXJ2aWNlIG5hbWUsIGFsbG9jYXRlZCAqLworICAgc3RydWN0IGN1 cmx0aW1lIGNyZWF0ZWQ7IC8qIGNyZWF0aW9uIHRpbWUgKi8KKyAgIHN0cnVjdCBjdXJsdGltZSBs YXN0dXNlZDsgLyogd2hlbiByZXR1cm5lZCB0byB0aGUgY29ubmVjdGlvbiBwb29sYXMgaWRsZSAq LworIAorLS0gCisyLjU1LjAKKwoKZGlmZiAtLWdpdCBhL2N1cmwuc3BlYyBiL2N1cmwuc3BlYwpp bmRleCA2Zjg0ZmM0Li5kMzk4Nzg1IDEwMDY0NAotLS0gYS9jdXJsLnNwZWMKKysrIGIvY3VybC5z cGVjCkBAIC05Niw2ICs5Niw5IEBAIFBhdGNoMDIzOiAwMDIzLWN1cmwtOC4xOC4wLUNWRS0yMDI2 LTExNTY0LnBhdGNoCiAjIEZpeCBzdGFsZSBwcm94eSBwYXNzd29yZCBsZWFrIChDVkUtMjAyNi05 MDc5KQogUGF0Y2gwMjQ6IDAwMjQtY3VybC04LjE4LjAtQ1ZFLTIwMjYtOTA3OS5wYXRjaAogCisj IEZpeCB3cm9uZyByZXVzZSBmb3IgZGlmZmVyZW50IHNlcnZpY2VzIChDVkUtMjAyNi04NDU4KQor UGF0Y2gwMjU6IDAwMjUtY3VybC04LjE4LjAtQ1ZFLTIwMjYtODQ1OC5wYXRjaAorCiAjIHBhdGNo IG1ha2luZyBsaWJjdXJsIG11bHRpbGliIHJlYWR5CiBQYXRjaDEwMTogMDEwMS1jdXJsLTcuMzIu MC1tdWx0aWxpYi5wYXRjaAogCkBAIC01MjYsNiArNTI5LDcgQEAgcm0gLWYgJHtSUE1fQlVJTERf Uk9PVH0le19tYW5kaXJ9L21hbjEvd2N1cmwuMSoKIC0gRml4IEhUVFAvMiBzdHJlYW0tZGVwZW5k ZW5jeSB0cmVlIFVBRiAoQ1ZFLTIwMjYtMTA1MzYpCiAtIEZpeCBOYXRpdmUgQ0EgdHJ1c3QgcGVy c2lzdCAoQ1ZFLTIwMjYtMTE1NjQpCiAtIEZpeCBzdGFsZSBwcm94eSBwYXNzd29yZCBsZWFrIChD VkUtMjAyNi05MDc5KQorLSBGaXggd3JvbmcgcmV1c2UgZm9yIGRpZmZlcmVudCBzZXJ2aWNlcyAo Q1ZFLTIwMjYtODQ1OCkKIAogKiBNb24gQXVnIDI0IDIwMjYgSmFuIE1hY2t1IDxqYW1hY2t1QHJl ZGhhdC5jb20+IC0gOC4xOC4wLTkKIC0gRml4IFFVSUMgemVyby1sZW5ndGggVURQIGRhdGFncmFt cyBidXN5LWxvb3AgKENWRS0yMDI2LTExMzUyKQo=