Package: release.debian.org Control: affects -1 + src:curl X-Debbugs-Cc: [email protected] User: [email protected] Usertags: pu Tags: trixie Severity: normal
[ Reason ] Two changes: 1) The patch for CVE-2026-3784, added in 8.14.1-2+deb13u4, has a line with trailing whitespace. This makes "make checksrc" fail, which in turn makes the upstream-event-based-tests-* autopkgtests fail. 2) OpenSSL engine support is broken in trixie (#1137539): the engine is loaded successfully but curl still bails out with "engine not found", because the result code is never set to CURLE_OK on the success path. Broken upstream since f2ce6c46 (predates 8.14.0), so this is a regression from bookworm. [ Impact ] The curl autopkgtests keep failing in trixie, and users of OpenSSL engines (pkcs11, HSMs, smartcards) have no way of using them. [ Tests ] The autopkgtests (which run upstream's test suite, including "make checksrc") pass again with this upload. The engine fix is an upstream commit, first released in curl 8.15.0, and has been in unstable/testing since 8.15.0-1 (August 2025) with no known fallout. [ Risks ] Low. The first change does not alter the resulting source at all apart from dropping a trailing space, so the built binaries are unaffected. The second change is 3 lines and only sets the return code on the success path of engine loading. It can only affect users of OpenSSL engines, for whom things are already broken today. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] * d/p/CVE-2026-3784.patch: Reworked the hunk so it no longer introduces a line with trailing whitespace. Purely cosmetic, the patched source is otherwise identical; this only unbreaks "make checksrc" and thus the autopkgtests. * d/p/openssl_fix_openssl_engines.patch: New patch cherry-picked from upstream (17f2a220, curl/curl#17618), returning CURLE_OK when an OpenSSL engine has been loaded successfully. Closes: #1137539. [ Other info ] More CVE fixes are coming in a future trixie upload, but I'm sending this one now in case I don't get them ready in time for the next point release, and so that the reporters of #1137539 can test the fix from p-u in the meantime. -- Samuel Henrique <samueloph>
diff -Nru curl-8.14.1/debian/changelog curl-8.14.1/debian/changelog --- curl-8.14.1/debian/changelog 2026-05-07 18:36:52.000000000 -0700 +++ curl-8.14.1/debian/changelog 2026-07-12 14:17:22.000000000 -0700 @@ -1,3 +1,14 @@ +curl (8.14.1-2+deb13u5) trixie; urgency=medium + + [ Carlos Henrique Lima Melara ] + * d/p/CVE-2026-3784.patch: remove trailing whitespace from patch + + [ Samuel Henrique ] + * d/p/openssl_fix_openssl_engines.patch: New patch to fix engine support + (closes: #1137539) + + -- Samuel Henrique <[email protected]> Sun, 12 Jul 2026 14:17:22 -0700 + curl (8.14.1-2+deb13u4) trixie; urgency=medium * Import upstream patches for 13 CVE fixes: diff -Nru curl-8.14.1/debian/patches/CVE-2026-3784.patch curl-8.14.1/debian/patches/CVE-2026-3784.patch --- curl-8.14.1/debian/patches/CVE-2026-3784.patch 2026-05-07 18:36:52.000000000 -0700 +++ curl-8.14.1/debian/patches/CVE-2026-3784.patch 2026-07-12 14:17:22.000000000 -0700 @@ -15,7 +15,7 @@ 3 files changed, 42 insertions(+), 26 deletions(-) diff --git a/lib/url.c b/lib/url.c -index 0c9b878..efd50a0 100644 +index 0c9b878..4eeb316 100644 --- a/lib/url.c +++ b/lib/url.c @@ -640,34 +640,19 @@ proxy_info_matches(const struct proxy_info *data, @@ -23,13 +23,13 @@ if((data->proxytype == needle->proxytype) && (data->port == needle->port) && - strcasecompare(data->host.name, needle->host.name)) +- return TRUE; + curl_strequal(data->host.name, needle->host.name)) { -+ + + if(Curl_timestrcmp(data->user, needle->user) || + Curl_timestrcmp(data->passwd, needle->passwd)) + return FALSE; - return TRUE; -- ++ return TRUE; + } return FALSE; } diff -Nru curl-8.14.1/debian/patches/openssl_fix_openssl_engines.patch curl-8.14.1/debian/patches/openssl_fix_openssl_engines.patch --- curl-8.14.1/debian/patches/openssl_fix_openssl_engines.patch 1969-12-31 16:00:00.000000000 -0800 +++ curl-8.14.1/debian/patches/openssl_fix_openssl_engines.patch 2026-07-12 14:17:22.000000000 -0700 @@ -0,0 +1,37 @@ +From 17f2a220a99db30bacd66df4df677dfb0a18b405 Mon Sep 17 00:00:00 2001 +From: "Theodore A. Roth" <[email protected]> +Date: Thu, 12 Jun 2025 11:36:02 -0600 +Subject: [PATCH] openssl: Fix openssl engines + +- Return CURLE_OK if the engine successfully loaded. + +Prior to this change: + +When loading an openssl engine, the result code is initialized to +CURLE_SSL_ENGINE_NOTFOUND, but is never set to CURLE_OK when the engine +was successfully loaded. This causes curl to error out, falsely stating +engine not found when it actually was. + +Broken since f2ce6c46 (precedes 8.14.0) which added support for using +engines and providers at the same time. + +Fixes https://github.com/curl/curl/issues/17617 +Closes https://github.com/curl/curl/pull/17618 +--- + lib/vtls/openssl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 69cde17c2c5f..a32307c05bdf 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -1907,6 +1907,9 @@ static CURLcode ossl_set_engine(struct Curl_easy *data, const char *name) + result = CURLE_SSL_ENGINE_INITFAILED; + e = NULL; + } ++ else { ++ result = CURLE_OK; ++ } + data->state.engine = e; + return result; + } diff -Nru curl-8.14.1/debian/patches/series curl-8.14.1/debian/patches/series --- curl-8.14.1/debian/patches/series 2026-05-07 18:36:52.000000000 -0700 +++ curl-8.14.1/debian/patches/series 2026-07-12 14:17:22.000000000 -0700 @@ -24,3 +24,4 @@ CVE-2026-6276.patch CVE-2026-7168.patch CVE-2026-6429.patch +openssl_fix_openssl_engines.patch
