Red Hat Security Advisory

RHSA-2021:3903

curl security update

Released 2021-10-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS EUS (v. 8.2) curl-7.61.1-12.el8_2.3, libcurl-7.61.1-12.el8_2.3, libcurl-devel-7.61.1-12.el8_2.3 +1

Fixes 2 records

TI-2021-05783 CVE-2021-22922 · GHSA-975f-fvhv-8mhx

Improper handling of exceptional conditions in https://github.com/curl/curl

MEDIUM 62

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentf…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.04332 Published 2021-08-05 Partial fix CWE-840

TI-2021-05784 CVE-2021-22923 · GHSA-89qw-6g6w-269q

Cleartext transmission of sensitive information in https://github.com/curl/curl

LOW 28

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers fr…

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.02002 Published 2021-08-05 Partial fix CWE-319