mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libcurl: security bump to version 8.19.0

Browse Source 
https://curl.se/ch/8.19.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:

CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection

Switch to sha256 tarball hash provided by upstream.

Updated license hash due to copyright year bump:
e83c82f05f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Bernd Kuhls
2026-03-12 17:44:56 +01:00
committed by Julien Olivain
parent bcabcf7f9c
commit 3a5e071e4f
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
package/libcurl/libcurl.hash
View File

@@ -1,5 +1,7 @@
# Locally calculated after checking pgp signature
# https://curl.se/download/curl-8.18.0.tar.xz.asc
# From https://github.com/curl/curl/releases/tag/curl-8_19_0
# after checking pgp signature:
# https://curl.se/download/curl-8.19.0.tar.xz.asc
# signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2
sha256 40df79166e74aa20149365e11ee4c798a46ad57c34e4f68fd13100e2c9a91946 curl-8.18.0.tar.xz
sha256 e18f1989333b70044b2adfb7dc2f905d0119dbdcac3bc9f4bc9d540e3a29de5b COPYING
sha256 4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d333f11df curl-8.19.0.tar.xz
# Locally computed
sha256 82f2f4427d6545ee5aaac4f0b80428da6cc8ba41c2cf5da3a03680ec327b9681 COPYING

2
package/libcurl/libcurl.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
LIBCURL_VERSION = 8.18.0
LIBCURL_VERSION = 8.19.0
LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz
LIBCURL_SITE = https://curl.se/download
LIBCURL_DEPENDENCIES = host-pkgconf \