Red Hat Security Advisory

RHSA-2023:2478

curl security update

Released 2023-05-09 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-23.el9
Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-23.el9, curl-minimal-7.76.1-23.el9, libcurl-7.76.1-23.el9 +1

Fixes 2 records

TI-2022-15932 CVE-2022-35252 · GHSA-qc3c-r429-gpgf

Improper input validation in https://github.com/curl/curl

MEDIUM 51

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03845 Published 2022-09-23 Partial fix CWE-20

TI-2022-21332 CVE-2022-43552 · GHSA-6342-4x32-pp8v

Use after free in https://github.com/curl/curl

LOW 32

A use after free vulnerability exists in curl <7.87.0.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02714 Published 2023-02-09 Partial fix CWE-416