Red Hat Security AdvisoryRHSA-2014:0561
curl security and bug fix update
Released 2014-05-27 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) curl-7.19.7-37.el6_5.3, libcurl-7.19.7-37.el6_5.3
- Red Hat Enterprise Linux Desktop Optional (v. 6) curl-7.19.7-37.el6_5.3, libcurl-devel-7.19.7-37.el6_5.3
- Red Hat Enterprise Linux HPC Node (v. 6) curl-7.19.7-37.el6_5.3, libcurl-7.19.7-37.el6_5.3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) curl-7.19.7-37.el6_5.3, libcurl-devel-7.19.7-37.el6_5.3
- Red Hat Enterprise Linux Server (v. 6) curl-7.19.7-37.el6_5.3, libcurl-7.19.7-37.el6_5.3, libcurl-7.19.7-37.el6_5.3.ppc +2
- Red Hat Enterprise Linux Workstation (v. 6) curl-7.19.7-37.el6_5.3, libcurl-7.19.7-37.el6_5.3, libcurl-devel-7.19.7-37.el6_5.3
Fixes 2 records
Priority LOW 37
The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context…
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.0522 · Published 2014-04-15 · Partial fix CWE-287
Priority LOW 27
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
CVSS 2.0MEDIUM 4.0· Network · No auth · Interaction — · EPSS 0.05599 · Published 2014-02-02 · Partial fix CWE-287
