Red Hat Security Advisory

RHSA-2023:6292

curl security update

Released 2023-11-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS EUS (v.8.6) curl-7.61.1-22.el8_6.9, libcurl-7.61.1-22.el8_6.9, libcurl-devel-7.61.1-22.el8_6.9 +1

Fixes 2 records

TI-2023-12869 CVE-2023-28321 · GHSA-pgq4-vq29-6v5r

Improper certificate validation in https://github.com/curl/curl

MEDIUM 60

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01806 Published 2023-05-26 Partial fix CWE-295

TI-2023-19923 CVE-2023-38546 · GHSA-x3qx-m3c2-qfhx

This flaw allows an attacker to insert cookies at will into a running program using…

LOW 27

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.05956 Published 2023-10-18 Partial fix · 8.4.0, 7.9.1