Red Hat Security AdvisoryRHSA-2018:3157
curl and nss-pem security and bug fix update
Released 2018-10-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) curl-7.29.0-51.el7, libcurl-7.29.0-51.el7, nss-pem-1.0.3-5.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel-7.29.0-51.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) curl-7.29.0-51.el7, libcurl-7.29.0-51.el7, nss-pem-1.0.3-5.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel-7.29.0-51.el7
- Red Hat Enterprise Linux Server (v. 7) curl-7.29.0-51.el7, libcurl-7.29.0-51.el7, libcurl-7.29.0-51.el7.ppc +4
- Red Hat Enterprise Linux Workstation (v. 7) curl-7.29.0-51.el7, libcurl-7.29.0-51.el7, libcurl-devel-7.29.0-51.el7 +1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) curl-7.29.0-51.el7, libcurl-7.29.0-51.el7, libcurl-devel-7.29.0-51.el7 +1
Fixes 5 records
Priority MEDIUM 56
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.11608 · Published 2018-03-14 · Partial fix CWE-787
Priority MEDIUM 54
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0581 · Published 2018-05-24 · Partial fix CWE-125
Priority MEDIUM 54
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09906 · Published 2018-01-24 · Partial fix
Priority MEDIUM 51
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.09039 · Published 2018-03-14 · Partial fix CWE-125
Priority MEDIUM 45
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.09205 · Published 2018-03-14 · Partial fix CWE-476
THREATIST.IORead the docs