Red Hat Security Advisory

RHSA-2023:4139

curl security update

Released 2023-07-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.6
Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.6, curl-minimal-7.76.1-14.el9_0.6, libcurl-7.76.1-14.el9_0.6 +1

Fixes 2 records

TI-2022-13930 CVE-2022-32221 · GHSA-grfr-78m7-q35q

Information disclosure in https://github.com/curl/curl

HIGH 82

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was us…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05092 Published 2022-12-05 Fixed CWE-200

TI-2023-09714 CVE-2023-23916 · GHSA-v8vq-prc2-j6gx

Resource allocation without limits in https://github.com/curl/curl

MEDIUM 62

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potent…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01742 Published 2023-02-23 Partial fix CWE-770