Red Hat Security Advisory

RHSA-2022:6159

curl security update

Released 2022-08-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-22.el8_6.4, libcurl-7.61.1-22.el8_6.4, libcurl-devel-7.61.1-22.el8_6.4 +1

Fixes 2 records

TI-2022-13916 CVE-2022-32206 · GHSA-pphv-gw4r-gww8

Resource allocation without limits in https://github.com/curl/curl

MEDIUM 62

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.36348 Published 2022-07-07 Partial fix CWE-770

TI-2022-13918 CVE-2022-32208 · GHSA-gfg8-2cqc-6cmc

Out-of-bounds write in https://github.com/curl/curl

MEDIUM 60

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.08373 Published 2022-07-07 Partial fix CWE-840