--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/curl/patches/007-CVE-2016-5419.patch	Tue Oct 25 14:43:21 2016 -0700
@@ -0,0 +1,79 @@
+From 416ad90afc50d9cbcb50ba4ab28f88d260774f6d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <[email protected]>
+Date: Fri, 1 Jul 2016 13:32:31 +0200
+Subject: [PATCH] TLS: switch off SSL session id when client cert is used
+
+CVE-2016-5419
+Bug: https://curl.haxx.se/docs/adv_20160803A.html
+Reported-by: Bru Rom
+Contributions-by: Eric Rescorla and Ray Satiro
+---
+ lib/url.c       |  1 +
+ lib/urldata.h   |  1 +
+ lib/vtls/vtls.c | 10 ++++++++++
+ 3 files changed, 12 insertions(+)
+
+--- lib/url.c
++++ lib/url.c
+@@ -6121,10 +6121,11 @@ static CURLcode create_conn(struct Curl_easy *data,
+   data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
+   data->set.ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
+   data->set.ssl.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
+   data->set.ssl.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
+   data->set.ssl.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
++  data->set.ssl.clientcert = data->set.str[STRING_CERT];
+ #ifdef USE_TLS_SRP
+   data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
+   data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
+ #endif
+ 
+--- lib/urldata.h
++++ lib/urldata.h
+@@ -349,10 +349,11 @@ struct ssl_config_data {
+   bool verifystatus;     /* set TRUE if certificate status must be checked */
+   char *CApath;          /* certificate dir (doesn't work on windows) */
+   char *CAfile;          /* certificate to verify peer against */
+   const char *CRLfile;   /* CRL to check certificate revocation */
+   const char *issuercert;/* optional issuer certificate filename */
++  char *clientcert;
+   char *random_file;     /* path to file containing "random" data */
+   char *egdsocket;       /* path to file containing the EGD daemon socket */
+   char *cipher_list;     /* list of ciphers to use */
+   size_t max_ssl_sessions; /* SSL session id cache size */
+   curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
+--- lib/vtls/vtls.c
++++ lib/vtls/vtls.c
+@@ -154,20 +154,30 @@ Curl_clone_ssl_config(struct ssl_config_data *source,
+       return FALSE;
+   }
+   else
+     dest->random_file = NULL;
+ 
++  if(source->clientcert) {
++    dest->clientcert = strdup(source->clientcert);
++    if(!dest->clientcert)
++      return FALSE;
++    dest->sessionid = FALSE;
++  }
++  else
++    dest->clientcert = NULL;
++
+   return TRUE;
+ }
+ 
+ void Curl_free_ssl_config(struct ssl_config_data* sslc)
+ {
+   Curl_safefree(sslc->CAfile);
+   Curl_safefree(sslc->CApath);
+   Curl_safefree(sslc->cipher_list);
+   Curl_safefree(sslc->egdsocket);
+   Curl_safefree(sslc->random_file);
++  Curl_safefree(sslc->clientcert);
+ }
+ 
+ 
+ /*
+  * Curl_rand() returns a random unsigned integer, 32bit.
+-- 
+2.8.1
+