Red Hat Security Advisory

RHSA-2021:3582

curl security update

Released 2021-09-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-18.el8_4.1, libcurl-7.61.1-18.el8_4.1, libcurl-devel-7.61.1-18.el8_4.1 +1

Fixes 3 records

TI-2021-05783 CVE-2021-22922 · GHSA-975f-fvhv-8mhx

Improper handling of exceptional conditions in https://github.com/curl/curl

MEDIUM 62

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentf…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.04332 Published 2021-08-05 Partial fix CWE-840

TI-2021-05785 CVE-2021-22924 · GHSA-qhhj-q26m-mrw8

Improper input validation in https://github.com/curl/curl

MEDIUM 51

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into ac…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0627 Published 2021-08-05 Partial fix CWE-20

TI-2021-05784 CVE-2021-22923 · GHSA-89qw-6g6w-269q

Cleartext transmission of sensitive information in https://github.com/curl/curl

LOW 28

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers fr…

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.02002 Published 2021-08-05 Partial fix CWE-319