Red Hat Security Advisory

RHSA-2023:5598

curl security update

Released 2023-10-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.7
Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.7, curl-minimal-7.76.1-14.el9_0.7, libcurl-7.76.1-14.el9_0.7 +1

Fixes 2 records

TI-2023-12870 CVE-2023-28322 · GHSA-78jh-p6rf-g59w

Information disclosure in https://github.com/curl/curl

MEDIUM 63

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFI…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02211 Published 2023-05-26 Partial fix CWE-200

TI-2023-12869 CVE-2023-28321 · GHSA-pgq4-vq29-6v5r

Improper certificate validation in https://github.com/curl/curl

MEDIUM 60

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01806 Published 2023-05-26 Partial fix CWE-295