Red Hat Security AdvisoryRHSA-2020:0594
curl security update
Released 2020-02-25 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server AUS (v. 7.4) curl-7.29.0-42.el7_4.2, libcurl-7.29.0-42.el7_4.2, libcurl-devel-7.29.0-42.el7_4.2
- Red Hat Enterprise Linux Server E4S (v. 7.4) curl-7.29.0-42.el7_4.2, libcurl-7.29.0-42.el7_4.2, libcurl-devel-7.29.0-42.el7_4.2
- Red Hat Enterprise Linux Server TUS (v. 7.4) curl-7.29.0-42.el7_4.2, libcurl-7.29.0-42.el7_4.2, libcurl-devel-7.29.0-42.el7_4.2
Fixes 5 records
Priority MEDIUM 56
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.11608 · Published 2018-03-14 · Partial fix CWE-787
Priority MEDIUM 54
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0581 · Published 2018-05-24 · Partial fix CWE-125
Priority MEDIUM 54
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09906 · Published 2018-01-24 · Partial fix
Priority MEDIUM 51
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.09039 · Published 2018-03-14 · Partial fix CWE-125
Priority MEDIUM 45
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.09205 · Published 2018-03-14 · Partial fix CWE-476
THREATIST.IORead the docs