Red Hat Security Advisory

RHSA-2022:6157

curl security update

Released 2022-08-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-14.el9_0.5
Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-14.el9_0.5, curl-minimal-7.76.1-14.el9_0.5, libcurl-7.76.1-14.el9_0.5 +1

Fixes 3 records

TI-2022-13917 CVE-2022-32207 · GHSA-mvxp-vg38-gq5c

Incorrect default permissions in https://github.com/curl/curl

HIGH 82

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12321 Published 2022-07-07 Partial fix CWE-840

TI-2022-13916 CVE-2022-32206 · GHSA-pphv-gw4r-gww8

Resource allocation without limits in https://github.com/curl/curl

MEDIUM 62

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.36348 Published 2022-07-07 Partial fix CWE-770

TI-2022-13918 CVE-2022-32208 · GHSA-gfg8-2cqc-6cmc

Out-of-bounds write in https://github.com/curl/curl

MEDIUM 60

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.08373 Published 2022-07-07 Partial fix CWE-840