From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f43: Resolves: CVE-2026-8458 - wrong reuse for different services Date: Wed, 09 Sep 2026 08:10:34 GMT Message-ID: <178894143432.1.15843336367766538333.rpms-curl-0951ae1a6027@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f43 X-Git-Rev: 0951ae1a60273ea23d551d74b5ceb5a19a11684e QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDMKQ29tbWl0IDogMDk1MWFlMWE2MDI3M2VhMjNkNTUxZDc0YjVjZWI1YTE5YTExNjg0ZQpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y N1QxODozODoyOSswMjowMApTdGF0cyAgOiArMTI3Ly0wIGluIDIgZmlsZShzKQpVUkwgICAgOiBo dHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2N1cmwvYy8wOTUxYWUxYTYwMjczZWEy M2Q1NTFkNzRiNWNlYjVhMTlhMTE2ODRlP2JyYW5jaD1mNDMKCkxvZzoKUmVzb2x2ZXM6IENWRS0y MDI2LTg0NTggLSB3cm9uZyByZXVzZSBmb3IgZGlmZmVyZW50IHNlcnZpY2VzCgotLS0KZGlmZiAt LWdpdCBhLzAwMjEtY3VybC04LjE1LjAtQ1ZFLTIwMjYtODQ1OC5wYXRjaCBiLzAwMjEtY3VybC04 LjE1LjAtQ1ZFLTIwMjYtODQ1OC5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwLi42ZDdhYzViCi0tLSAvZGV2L251bGwKKysrIGIvMDAyMS1jdXJsLTguMTUuMC1DVkUtMjAy Ni04NDU4LnBhdGNoCkBAIC0wLDAgKzEsMTIzIEBACitGcm9tIGVjYzhlNzM1YTZlZDU2MDJmNWRl NTA4ZDY1MjUxMDlkYTJlMmIxMjYgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBKYW4g TWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KK0RhdGU6IFRodSwgMjcgQXVnIDIwMjYgMTc6MTA6 MDQgKzAyMDAKK1N1YmplY3Q6IFtQQVRDSF0gdXJsOiBhZGQgU0FTTCBzZXJ2aWNlIG5hbWUgdG8g Y29ubmVjdGlvbiByZXVzZSBtYXRjaGluZworCitTdG9yZSB0aGUgU0FTTCBzZXJ2aWNlIG5hbWUg KHNldCB2aWEgQ1VSTE9QVF9TRVJWSUNFX05BTUUgYW5kCitDVVJMT1BUX1BST1hZX1NFUlZJQ0Vf TkFNRSkgb24gdGhlIGNvbm5lY3Rpb24gYW5kIGNvbXBhcmUgaXQgZHVyaW5nCitjb25uZWN0aW9u IHJldXNlIG1hdGNoaW5nIGZvciBOZWdvdGlhdGUgYW5kIE5UTE0gYXV0aGVudGljYXRpb24uCisK K1dpdGhvdXQgdGhpcyBjaGVjaywgbGliY3VybCBjb3VsZCB3cm9uZ2Z1bGx5IHJldXNlIGFuIGV4 aXN0aW5nCitjb25uZWN0aW9uIGF1dGhlbnRpY2F0ZWQgd2l0aCBhIGRpZmZlcmVudCBzZXJ2aWNl IG5hbWUsIHdoZW4gdGhlCitzYW1lIHNlcnZlciwgdXNlcm5hbWUgYW5kIHBhc3N3b3JkIGFyZSB1 c2VkLgorCitUaGlzIGlzIGFuIGFkYXB0ZWQgYmFja3BvcnQgb2YgdXBzdHJlYW0gY29tbWl0IDVl OTliNzNjZjQ0MWQ5YzM2OTc2OGI5Y2QKK3doaWNoIGFkZHMgc2FzbF9zZXJ2aWNlIHRvIHN0cnVj dCBDdXJsX2NyZWRzLiBTaW5jZSBjdXJsIDguMTUuMAorcHJlZGF0ZXMgdGhlIEN1cmxfY3JlZHMg aW5mcmFzdHJ1Y3R1cmUsIHRoaXMgZml4IHN0b3JlcyB0aGUgc2VydmljZQorbmFtZSBkaXJlY3Rs eSBvbiBzdHJ1Y3QgY29ubmVjdGRhdGEgaW5zdGVhZCwgZm9sbG93aW5nIHRoZSBzYW1lCitwYXR0 ZXJuIGFzIHNhc2xfYXV0aHppZCBhbmQgb2F1dGhfYmVhcmVyLgorCisoY2hlcnJ5IHBpY2tlZCBm cm9tIGNvbW1pdCA1ZTk5YjczY2Y0NDFkOWMzNjk3NjhiOWNkKQorQ28tYXV0aG9yZWQtYnk6IEN1 cnNvciA8Y3Vyc29yYWdlbnRAY3Vyc29yLmNvbT4KKy0tLQorIGxpYi91cmwuYyAgICAgfCAzNSAr KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLQorIGxpYi91cmxkYXRhLmggfCAgMiAr KworIDIgZmlsZXMgY2hhbmdlZCwgMzMgaW5zZXJ0aW9ucygrKSwgNCBkZWxldGlvbnMoLSkKKwor ZGlmZiAtLWdpdCBhL2xpYi91cmwuYyBiL2xpYi91cmwuYworaW5kZXggNmE0MjlhMWNlOS4uYTIz M2M5ODMxYiAxMDA2NDQKKy0tLSBhL2xpYi91cmwuYworKysrIGIvbGliL3VybC5jCitAQCAtNTg5 LDYgKzU4OSw4IEBAIHZvaWQgQ3VybF9jb25uX2ZyZWUoc3RydWN0IEN1cmxfZWFzeSAqZGF0YSwg c3RydWN0IGNvbm5lY3RkYXRhICpjb25uKQorICAgQ3VybF9zYWZlZnJlZShjb25uLT5zYXNsX2F1 dGh6aWQpOworICAgQ3VybF9zYWZlZnJlZShjb25uLT5vcHRpb25zKTsKKyAgIEN1cmxfc2FmZWZy ZWUoY29ubi0+b2F1dGhfYmVhcmVyKTsKKysgIEN1cmxfc2FmZWZyZWUoY29ubi0+c2FzbF9zZXJ2 aWNlKTsKKysgIEN1cmxfc2FmZWZyZWUoY29ubi0+cHJveHlfc2FzbF9zZXJ2aWNlKTsKKyAgIEN1 cmxfc2FmZWZyZWUoY29ubi0+aG9zdC5yYXdhbGxvYyk7IC8qIGhvc3RuYW1lIGJ1ZmZlciAqLwor ICAgQ3VybF9zYWZlZnJlZShjb25uLT5jb25uX3RvX2hvc3QucmF3YWxsb2MpOyAvKiBob3N0bmFt ZSBidWZmZXIgKi8KKyAgIEN1cmxfc2FmZWZyZWUoY29ubi0+aG9zdG5hbWVfcmVzb2x2ZSk7CitA QCAtMTE3MCw3ICsxMTcyLDggQEAgc3RhdGljIGJvb2wgdXJsX21hdGNoX2F1dGhfbnRsbShzdHJ1 Y3QgY29ubmVjdGRhdGEgKmNvbm4sCisgICAgICBwYXJ0d2F5IHRocm91Z2ggYSBoYW5kc2hha2Uh KSAqLworICAgaWYobS0+d2FudF9udGxtX2h0dHApIHsKKyAgICAgaWYoQ3VybF90aW1lc3RyY21w KG0tPm5lZWRsZS0+dXNlciwgY29ubi0+dXNlcikgfHwKKy0gICAgICAgQ3VybF90aW1lc3RyY21w KG0tPm5lZWRsZS0+cGFzc3dkLCBjb25uLT5wYXNzd2QpKSB7CisrICAgICAgIEN1cmxfdGltZXN0 cmNtcChtLT5uZWVkbGUtPnBhc3N3ZCwgY29ubi0+cGFzc3dkKSB8fAorKyAgICAgICBDdXJsX3Rp bWVzdHJjbXAobS0+bmVlZGxlLT5zYXNsX3NlcnZpY2UsIGNvbm4tPnNhc2xfc2VydmljZSkpIHsK KyAKKyAgICAgICAvKiB3ZSBwcmVmZXIgYSBjcmVkZW50aWFsIG1hdGNoLCBidXQgdGhpcyBpcyBh dCBsZWFzdCBhIGNvbm5lY3Rpb24KKyAgICAgICAgICB0aGF0IGNhbiBiZSByZXVzZWQgYW5kICJ1 cGdyYWRlZCIgdG8gTlRMTSAqLworQEAgLTExOTUsNyArMTE5OCw5IEBAIHN0YXRpYyBib29sIHVy bF9tYXRjaF9hdXRoX250bG0oc3RydWN0IGNvbm5lY3RkYXRhICpjb25uLAorICAgICBpZihDdXJs X3RpbWVzdHJjbXAobS0+bmVlZGxlLT5odHRwX3Byb3h5LnVzZXIsCisgICAgICAgICAgICAgICAg ICAgICAgICBjb25uLT5odHRwX3Byb3h5LnVzZXIpIHx8CisgICAgICAgIEN1cmxfdGltZXN0cmNt cChtLT5uZWVkbGUtPmh0dHBfcHJveHkucGFzc3dkLAorLSAgICAgICAgICAgICAgICAgICAgICAg Y29ubi0+aHR0cF9wcm94eS5wYXNzd2QpKQorKyAgICAgICAgICAgICAgICAgICAgICAgY29ubi0+ aHR0cF9wcm94eS5wYXNzd2QpIHx8CisrICAgICAgIEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUt PnByb3h5X3Nhc2xfc2VydmljZSwKKysgICAgICAgICAgICAgICAgICAgICAgIGNvbm4tPnByb3h5 X3Nhc2xfc2VydmljZSkpCisgICAgICAgcmV0dXJuIEZBTFNFOworICAgfQorICAgZWxzZSBpZihj b25uLT5wcm94eV9udGxtX3N0YXRlICE9IE5UTE1TVEFURV9OT05FKSB7CitAQCAtMTIzNiw3ICsx MjQxLDggQEAgc3RhdGljIGJvb2wgdXJsX21hdGNoX2F1dGhfbmVnbyhzdHJ1Y3QgY29ubmVjdGRh dGEgKmNvbm4sCisgICAgICBzbyB0aGF0IHdlIGNhbiByZXVzZSBOZWdvdGlhdGUgY29ubmVjdGlv bnMgaWYgcG9zc2libGUuICovCisgICBpZihtLT53YW50X25lZ29faHR0cCkgeworICAgICBpZihD dXJsX3RpbWVzdHJjbXAobS0+bmVlZGxlLT51c2VyLCBjb25uLT51c2VyKSB8fAorLSAgICAgICBD dXJsX3RpbWVzdHJjbXAobS0+bmVlZGxlLT5wYXNzd2QsIGNvbm4tPnBhc3N3ZCkpCisrICAgICAg IEN1cmxfdGltZXN0cmNtcChtLT5uZWVkbGUtPnBhc3N3ZCwgY29ubi0+cGFzc3dkKSB8fAorKyAg ICAgICBDdXJsX3RpbWVzdHJjbXAobS0+bmVlZGxlLT5zYXNsX3NlcnZpY2UsIGNvbm4tPnNhc2xf c2VydmljZSkpCisgICAgICAgcmV0dXJuIEZBTFNFOworICAgfQorICAgZWxzZSBpZihjb25uLT5o dHRwX25lZ290aWF0ZV9zdGF0ZSAhPSBHU1NfQVVUSE5PTkUpIHsKK0BAIC0xMjU1LDcgKzEyNjEs OSBAQCBzdGF0aWMgYm9vbCB1cmxfbWF0Y2hfYXV0aF9uZWdvKHN0cnVjdCBjb25uZWN0ZGF0YSAq Y29ubiwKKyAgICAgaWYoQ3VybF90aW1lc3RyY21wKG0tPm5lZWRsZS0+aHR0cF9wcm94eS51c2Vy LAorICAgICAgICAgICAgICAgICAgICAgICAgY29ubi0+aHR0cF9wcm94eS51c2VyKSB8fAorICAg ICAgICBDdXJsX3RpbWVzdHJjbXAobS0+bmVlZGxlLT5odHRwX3Byb3h5LnBhc3N3ZCwKKy0gICAg ICAgICAgICAgICAgICAgICAgIGNvbm4tPmh0dHBfcHJveHkucGFzc3dkKSkKKysgICAgICAgICAg ICAgICAgICAgICAgIGNvbm4tPmh0dHBfcHJveHkucGFzc3dkKSB8fAorKyAgICAgICBDdXJsX3Rp bWVzdHJjbXAobS0+bmVlZGxlLT5wcm94eV9zYXNsX3NlcnZpY2UsCisrICAgICAgICAgICAgICAg ICAgICAgICBjb25uLT5wcm94eV9zYXNsX3NlcnZpY2UpKQorICAgICAgIHJldHVybiBGQUxTRTsK KyAgIH0KKyAgIGVsc2UgaWYoY29ubi0+cHJveHlfbmVnb3RpYXRlX3N0YXRlICE9IEdTU19BVVRI Tk9ORSkgeworQEAgLTM1OTYsNiArMzYwNCwyNSBAQCBzdGF0aWMgQ1VSTGNvZGUgY3JlYXRlX2Nv bm4oc3RydWN0IEN1cmxfZWFzeSAqZGF0YSwKKyAgICAgfQorICAgfQorIAorKyAgaWYoZGF0YS0+ c2V0LnN0cltTVFJJTkdfU0VSVklDRV9OQU1FXSkgeworKyAgICBjb25uLT5zYXNsX3NlcnZpY2Ug PSBzdHJkdXAoZGF0YS0+c2V0LnN0cltTVFJJTkdfU0VSVklDRV9OQU1FXSk7CisrICAgIGlmKCFj b25uLT5zYXNsX3NlcnZpY2UpIHsKKysgICAgICByZXN1bHQgPSBDVVJMRV9PVVRfT0ZfTUVNT1JZ OworKyAgICAgIGdvdG8gb3V0OworKyAgICB9CisrICB9CisrCisrI2lmbmRlZiBDVVJMX0RJU0FC TEVfUFJPWFkKKysgIGlmKGRhdGEtPnNldC5zdHJbU1RSSU5HX1BST1hZX1NFUlZJQ0VfTkFNRV0p IHsKKysgICAgY29ubi0+cHJveHlfc2FzbF9zZXJ2aWNlID0KKysgICAgICBzdHJkdXAoZGF0YS0+ c2V0LnN0cltTVFJJTkdfUFJPWFlfU0VSVklDRV9OQU1FXSk7CisrICAgIGlmKCFjb25uLT5wcm94 eV9zYXNsX3NlcnZpY2UpIHsKKysgICAgICByZXN1bHQgPSBDVVJMRV9PVVRfT0ZfTUVNT1JZOwor KyAgICAgIGdvdG8gb3V0OworKyAgICB9CisrICB9CisrI2VuZGlmCisrCisgI2lmZGVmIFVTRV9V TklYX1NPQ0tFVFMKKyAgIGlmKGRhdGEtPnNldC5zdHJbU1RSSU5HX1VOSVhfU09DS0VUX1BBVEhd KSB7CisgICAgIGNvbm4tPnVuaXhfZG9tYWluX3NvY2tldCA9IHN0cmR1cChkYXRhLT5zZXQuc3Ry W1NUUklOR19VTklYX1NPQ0tFVF9QQVRIXSk7CitkaWZmIC0tZ2l0IGEvbGliL3VybGRhdGEuaCBi L2xpYi91cmxkYXRhLmgKK2luZGV4IDk1ZjJlZmM1NWUuLjEyODgzYjg2YzAgMTAwNjQ0CistLS0g YS9saWIvdXJsZGF0YS5oCisrKysgYi9saWIvdXJsZGF0YS5oCitAQCAtNjg3LDYgKzY4Nyw4IEBA IHN0cnVjdCBjb25uZWN0ZGF0YSB7CisgICBjaGFyICpvcHRpb25zOyAvKiBvcHRpb25zIHN0cmlu ZywgYWxsb2NhdGVkICovCisgICBjaGFyICpzYXNsX2F1dGh6aWQ7ICAgICAvKiBhdXRob3JpemF0 aW9uIGlkZW50aXR5IHN0cmluZywgYWxsb2NhdGVkICovCisgICBjaGFyICpvYXV0aF9iZWFyZXI7 IC8qIE9BVVRIMiBiZWFyZXIsIGFsbG9jYXRlZCAqLworKyAgY2hhciAqc2FzbF9zZXJ2aWNlOyAv KiBTQVNMIHNlcnZpY2UgbmFtZSBmb3IgYXV0aCwgYWxsb2NhdGVkICovCisrICBjaGFyICpwcm94 eV9zYXNsX3NlcnZpY2U7IC8qIFNBU0wgc2VydmljZSBuYW1lIGZvciBwcm94eSBhdXRoLCBhbGxv Y2F0ZWQgKi8KKyAgIHN0cnVjdCBjdXJsdGltZSBjcmVhdGVkOyAvKiBjcmVhdGlvbiB0aW1lICov CisgICBzdHJ1Y3QgY3VybHRpbWUgbGFzdHVzZWQ7IC8qIHdoZW4gcmV0dXJuZWQgdG8gdGhlIGNv bm5lY3Rpb24gcG9vbGFzIGlkbGUgKi8KKyAgIGN1cmxfc29ja2V0X3Qgc29ja1syXTsgLyogdHdv IHNvY2tldHMsIHRoZSBzZWNvbmQgaXMgdXNlZCBmb3IgdGhlIGRhdGEKKy0tIAorMi41NS4wCisK CmRpZmYgLS1naXQgYS9jdXJsLnNwZWMgYi9jdXJsLnNwZWMKaW5kZXggMjYzMDJmZC4uY2EyOTMy YyAxMDA2NDQKLS0tIGEvY3VybC5zcGVjCisrKyBiL2N1cmwuc3BlYwpAQCAtNzYsNiArNzYsOSBA QCBQYXRjaDAxOTogMDAxOS1jdXJsLTguMTUuMC1DVkUtMjAyNi0xMDUzNi5wYXRjaAogIyBmaXgg c3RhbGUgcHJveHkgcGFzc3dvcmQgbGVhayAoQ1ZFLTIwMjYtOTA3OSkKIFBhdGNoMDIwOiAwMDIw LWN1cmwtOC4xNS4wLUNWRS0yMDI2LTkwNzkucGF0Y2gKIAorIyBmaXggd3JvbmcgcmV1c2UgZm9y IGRpZmZlcmVudCBzZXJ2aWNlcyAoQ1ZFLTIwMjYtODQ1OCkKK1BhdGNoMDIxOiAwMDIxLWN1cmwt OC4xNS4wLUNWRS0yMDI2LTg0NTgucGF0Y2gKKwogIyBwYXRjaCBtYWtpbmcgbGliY3VybCBtdWx0 aWxpYiByZWFkeQogUGF0Y2gxMDE6IDAxMDEtY3VybC03LjMyLjAtbXVsdGlsaWIucGF0Y2gKIApA QCAtNDgxLDYgKzQ4NCw3IEBAIHJtIC1mICR7UlBNX0JVSUxEX1JPT1R9JXtfbWFuZGlyfS9tYW4x L3djdXJsLjEqCiAqIFR1ZSBTZXAgMDggMjAyNiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNv bT4gLSA4LjE1LjAtMTAKIC0gZml4IEhUVFAvMiBzdHJlYW0tZGVwZW5kZW5jeSB0cmVlIFVBRiAo Q1ZFLTIwMjYtMTA1MzYpCiAtIGZpeCBzdGFsZSBwcm94eSBwYXNzd29yZCBsZWFrIChDVkUtMjAy Ni05MDc5KQorLSBmaXggd3JvbmcgcmV1c2UgZm9yIGRpZmZlcmVudCBzZXJ2aWNlcyAoQ1ZFLTIw MjYtODQ1OCkKIAogKiBXZWQgQXVnIDI2IDIwMjYgSmFuIE1hY2t1IDxqYW1hY2t1QHJlZGhhdC5j b20+IC0gOC4xNS4wLTkKIC0gZml4IHByb3RvLWRlZmF1bHQgc2tpcHMgU1NIIHZlcmlmaWNhdGlv biAoQ1ZFLTIwMjYtMTIwNjQpCg==