[AutoPR- Security] Patch curl for CVE-2026-3784, CVE-2026-3783, CVE-2026-1965 [MEDIUM]#16181
Conversation
microsoft-github-policy-service
bot
added
Packaging
3.0-dev
|
Failure Reason: Fix: We have curl of version |
|
Buddy Build after recent changes. |
|
resolved merge conflicts |
PR #16181 Review: [AutoPR-Security] Patch curl for CVE-2026-3784, CVE-2026-3783, CVE-2026-1965 [MEDIUM]PR: #16181 CVE Details
Files Changed (8 files, +475 / -15)
Review Checklist1. SPEC File Changes (
|
| Check | Status | Details |
|---|---|---|
| Release bump | ✅ PASS | Release: 5%{?dist} → Release: 6%{?dist} |
| Patch declarations | ✅ PASS | Patch5: CVE-2026-1965.patch, Patch6: CVE-2026-3783.patch, Patch7: CVE-2026-3784.patch — sequential after existing Patch4 |
| Patch application | ✅ PASS | Uses %autosetup -p1 — patches applied automatically |
| Changelog entry | ✅ PASS | * Thu Mar 12 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.11.1-6 with - Patch for CVE-2026-3784, CVE-2026-3783, CVE-2026-1965 |
| Changelog ordering | error: %changelog not in descending chronological order — pre-existing issue, not introduced by this PR |
2. Patch File Verification
CVE-2026-1965.patch — Negotiate authentication connection reuse fix
| Check | Status | Details |
|---|---|---|
| Upstream reference | ✅ PASS | AI backport of upstream commits 34fa034 and f1a39f2 |
| Patch target | ✅ PASS | lib/url.c — 85 additions, 5 deletions |
| Patch applies cleanly | ✅ PASS | Applied with --fuzz=0 --no-backup-if-mismatch |
Patch content: Adds url_match_auth_nego() function (guarded by USE_SPNEGO) to properly verify Negotiate authentication credentials before reusing connections. Adds want_nego_http and want_proxy_nego_http BIT fields to struct url_conn_match. The function checks user/password match using Curl_timestrcmp (timing-safe comparison) and enforces separate connections for different Negotiate-authenticated users.
Key observations:
- Uses
Curl_timestrcmpfor constant-time credential comparison — good security practice - Properly handles both direct and proxy Negotiate auth
- Includes
#ifndef CURL_DISABLE_PROXYguards for proxy-related code - Falls back to
#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE)whenUSE_SPNEGOis not defined - Also adjusts existing NTLM match code to remove unnecessary parentheses around boolean expressions (cosmetic cleanup)
CVE-2026-3783.patch — Bearer token leak on redirect fix
| Check | Status | Details |
|---|---|---|
| Upstream reference | ✅ PASS | Upstream commit e3d7401 (Daniel Stenberg, closes #20843) |
| Patch target | ✅ PASS | lib/http.c (1 line), tests/data/Makefile.am (1 line), tests/data/test2006 (new test file) |
| Patch applies cleanly | ✅ PASS | Applied with --fuzz=0 --no-backup-if-mismatch |
Patch content: Adds Curl_auth_allowed_to_host(data) check before sending Bearer token in output_auth_headers(). This prevents the bearer token from being sent to a redirected host when .netrc has credentials for the redirect target.
Test suite adaptation (commit 442f2bf): The upstream test2006 originally used crlf="headers" which is a curl v8.19.0+ test framework feature. Since Azure Linux ships curl 8.11.1, the test was correctly refactored to use crlf="yes" which is supported in this version. This was identified by @akhila-guruju and is properly documented in the PR conversation. The <protocol crlf="yes"> and <data crlf="yes"> tags match the v8.11.1 test format spec.
CVE-2026-3784.patch — Proxy auth connection reuse fix
| Check | Status | Details |
|---|---|---|
| Upstream reference | ✅ PASS | AI backport of upstream commit 5f13a76 (closes #20837) |
| Patch target | ✅ PASS | lib/url.c (reformulated), tests/http/test_13_proxy_auth.py (new test), tests/http/testenv/curl.py (url_options support) |
| Patch applies cleanly | ✅ PASS | Applied with --fuzz=0 --no-backup-if-mismatch |
Patch content: Merges proxy credential checking into proxy_info_matches() by adding Curl_timestrcmp user/password comparison directly in the function. This eliminates the separate socks_proxy_info_matches() function (which was the only place doing credential checks for SOCKS proxies) and ensures all proxy types (HTTP and SOCKS) validate credentials before connection reuse. This is a simplification that strengthens security by making credential checks uniform.
Key changes:
proxy_info_matches()now checks user/password (using timing-safeCurl_timestrcmp)- Removes
socks_proxy_info_matches()— its logic is now subsumed url_match_conn()usesproxy_info_matches()for SOCKS proxies instead of the removed function- Adds
test_13_10_tunnels_mixed_authtest validating correct behavior with mixed proxy credentials - Extends
CurlClientwithurl_optionsparameter for per-URL argument support
3. Patch Ordering and Dependencies
| Check | Status | Details |
|---|---|---|
| Patch ordering | ✅ PASS | CVE-2026-1965 (Patch5) → CVE-2026-3783 (Patch6) → CVE-2026-3784 (Patch7) |
| Patch dependencies | ✅ PASS | CVE-2026-1965 modifies lib/url.c (index 436edd8→d62eefa), CVE-2026-3784 builds on that (index d62eefa→88f559a) — correct chaining |
| No conflicts between patches | ✅ PASS | Patches target different sections: CVE-2026-1965 (Negotiate auth matching), CVE-2026-3783 (HTTP bearer output), CVE-2026-3784 (proxy matching) |
4. Manifest Updates
| Check | Status | Details |
|---|---|---|
pkggen_core_aarch64.txt |
✅ PASS | curl, curl-devel, curl-libs: 8.11.1-5 → 8.11.1-6 |
pkggen_core_x86_64.txt |
✅ PASS | curl, curl-devel, curl-libs: 8.11.1-5 → 8.11.1-6 |
toolchain_aarch64.txt |
✅ PASS | curl, curl-debuginfo, curl-devel, curl-libs: 8.11.1-5 → 8.11.1-6 |
toolchain_x86_64.txt |
✅ PASS | curl, curl-debuginfo, curl-devel, curl-libs: 8.11.1-5 → 8.11.1-6 |
5. PR Description
| Check | Status | Details |
|---|---|---|
| Summary | ✅ PASS | CVE descriptions and links provided |
| Change Log | ✅ PASS | All three CVEs referenced |
| Links to CVEs | ✅ PASS | NVD links provided for all three CVEs |
| Test Methodology | ✅ PASS | Buddy build URL provided (buildId=1068310 initial, 1071437 after fix) |
| Failure analysis documented | ✅ PASS | @akhila-guruju documented the crlf="headers" compatibility issue and fix |
6. Build Verification (Build ID: 1071437)
AMD64 (x86_64)
| Check | Status | Details |
|---|---|---|
| Build result | ✅ PASS | Built (curl-8.11.1-6.azl3.src.rpm) -> [curl, curl-debuginfo, curl-devel, curl-libs] |
| Patches applied cleanly | ✅ PASS | All 8 patches (Patch0-Patch7) applied via %autosetup -p1 with --fuzz=0 --no-backup-if-mismatch |
| Compilation | ✅ PASS | No errors or new warnings from patched files |
| Test suite | ✅ PASS | 1447 out of 1447 tests reported OK: 100% (1746 total considered, rest skipped due to missing server capabilities) |
| Test 2006 | ✅ PASS | test 2006...OK (new test for CVE-2026-3783 bearer token fix) |
| Package test | ✅ PASS | pkgtest: Pass (482s execution time) |
| License check | ✅ PASS | "No license issues found" |
Skipped server types (expected in chroot, not failures):
- SSH server, SMB server, HTTP/2 server — not available in build environment
Produced RPMs:
curl-8.11.1-6.azl3.x86_64.rpmcurl-debuginfo-8.11.1-6.azl3.x86_64.rpmcurl-devel-8.11.1-6.azl3.x86_64.rpmcurl-libs-8.11.1-6.azl3.x86_64.rpm
ARM64 (aarch64)
| Check | Status | Details |
|---|---|---|
| Build result | ✅ PASS | Built (curl-8.11.1-6.azl3.src.rpm) -> [curl, curl-debuginfo, curl-devel, curl-libs] |
| Patches applied cleanly | ✅ PASS | All patches applied without issues |
| Test suite | ✅ PASS | 1447 out of 1447 tests reported OK: 100% |
| Package test | ✅ PASS | pkgtest: Pass (522s execution time) |
Produced RPMs:
curl-8.11.1-6.azl3.aarch64.rpmcurl-debuginfo-8.11.1-6.azl3.aarch64.rpmcurl-devel-8.11.1-6.azl3.aarch64.rpmcurl-libs-8.11.1-6.azl3.aarch64.rpm
7. Additional Checks
| Check | Status | Details |
|---|---|---|
| Signatures file | N/A | Not visible in PR diff — may need verification |
| Branch targeting | ✅ PASS | 3.0-dev appropriate for MEDIUM severity CVEs |
| Severity label | ✅ PASS | [MEDIUM] in title matches all three CVE CVSS scores |
| Dependent package rebuilds | ✅ PASS | curl is a shared library — no static-link dependents requiring release bumps |
| Merge conflicts | ✅ PASS | Resolved (noted in PR conversation by @akhila-guruju) |
Summary
| Category | Result |
|---|---|
| SPEC file changes | ✅ PASS |
| CVE-2026-1965 patch | ✅ PASS |
| CVE-2026-3783 patch | ✅ PASS (with test adaptation for v8.11.1) |
| CVE-2026-3784 patch | ✅ PASS |
| Patch ordering/dependencies | ✅ PASS |
| Manifest updates | ✅ PASS |
| PR description | ✅ PASS |
| AMD64 build + tests | ✅ PASS (100% test pass rate) |
| ARM64 build + tests | ✅ PASS (100% test pass rate) |
Overall: LGTM — All three patches address genuine connection-reuse security vulnerabilities in curl. Patches reference upstream commits, apply cleanly without fuzz, and the full test suite passes at 100% on both architectures. The crlf="headers" → crlf="yes" adaptation for test2006 is correctly done for the v8.11.1 test framework.
suresh-thelkar
left a comment
suresh-thelkar
left a comment
There was a problem hiding this comment.
Code changes look good to me. There are some PR checks failing. Please look into it and fix them if they are valid issues. In case if they are known issues, please add a brief description about them.
Kanishk-Bansal
added
the
ready-for-stable-review
kgodara912
left a comment
kgodara912
left a comment
There was a problem hiding this comment.
All the patches match with respective upstream reference except there are minor name changes in higher upstream version, those variable name changes are inferred from the removed code lines and kept in backport. Buddy build is successful. LGTM.
…16181) Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
5 participants
Auto Patch curl for CVE-2026-3784, CVE-2026-3783, CVE-2026-1965.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1068254&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology