Read the docs
Red Hat Security Advisory

RHSA-2022:1354

rh-dotnet31-curl security update

Released 2022-04-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2021-05807 CVE-2021-22946 · GHSA-3cmq-42w4-c529

Cleartext transmission of sensitive information in https://github.com/curl/curl

Priority HIGH 72

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLU…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04539 Published 2021-09-29 Partial fix CWE-325
TI-2021-05737 CVE-2021-22876 · GHSA-jjr6-2g8j-hmwr

Information disclosure in https://github.com/curl/curl

Priority MEDIUM 63

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05301 Published 2021-04-01 Partial fix CWE-359
TI-2021-05808 CVE-2021-22947 · GHSA-94jh-wwgf-cmmc

Cryptographic flaw in https://github.com/curl/curl

Priority MEDIUM 60

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03009 Published 2021-09-29 Partial fix CWE-310
TI-2021-05785 CVE-2021-22924 · GHSA-qhhj-q26m-mrw8

Improper input validation in https://github.com/curl/curl

Priority MEDIUM 51

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into ac…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0627 Published 2021-08-05 Partial fix CWE-20