Red Hat Security AdvisoryRHSA-2011:0918
curl security update
Released 2011-07-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5.6.z server) curl-7.15.5-9.el5_6.3, curl-7.15.5-9.el5_6.3.i386, curl-7.15.5-9.el5_6.3.ia64 +5
- Red Hat Enterprise Linux AS version 4 curl-7.12.1-17.el4, curl-7.12.1-17.el4.i386, curl-7.12.1-17.el4.ia64 +5
- Red Hat Enterprise Linux Desktop version 4 curl-7.12.1-17.el4, curl-7.12.1-17.el4.i386, curl-devel-7.12.1-17.el4 +1
- Red Hat Enterprise Linux ES version 4 curl-7.12.1-17.el4, curl-7.12.1-17.el4.i386, curl-7.12.1-17.el4.ia64 +3
- Red Hat Enterprise Linux Server (v. 6) curl-7.19.7-26.el6_1.1, libcurl-7.19.7-26.el6_1.1, libcurl-7.19.7-26.el6_1.1.ppc +2
- Red Hat Enterprise Linux WS version 4 curl-7.12.1-17.el4, curl-7.12.1-17.el4.i386, curl-7.12.1-17.el4.ia64 +3
Fixes 1 record
Priority LOW 25
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.02877 · Published 2011-07-07 · Fixed CWE-255
