Red Hat Security Advisory

RHSA-2023:2963

curl security and bug fix update

Released 2023-05-16 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-30.el8, libcurl-7.61.1-30.el8, libcurl-devel-7.61.1-30.el8 +1

Fixes 2 records

TI-2022-15932 CVE-2022-35252 · GHSA-qc3c-r429-gpgf

Improper input validation in https://github.com/curl/curl

MEDIUM 51

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03845 Published 2022-09-23 Partial fix CWE-20

TI-2022-21332 CVE-2022-43552 · GHSA-6342-4x32-pp8v

Use after free in https://github.com/curl/curl

LOW 32

A use after free vulnerability exists in curl <7.87.0.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02714 Published 2023-02-09 Partial fix CWE-416