Read the docs
Red Hat Security Advisory

RHSA-2024:0428

curl security and bug fix update

Released 2024-01-25 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 6 records

TI-2023-12870 CVE-2023-28322 · GHSA-78jh-p6rf-g59w

Information disclosure in https://github.com/curl/curl

Priority MEDIUM 63

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFI…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02211 Published 2023-05-26 Partial fix CWE-200
TI-2023-12260 CVE-2023-27536 · GHSA-4f9f-mpmj-4c52

Authentication bypass in https://github.com/curl/curl

Priority MEDIUM 60

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01758 Published 2023-03-30 Partial fix CWE-305
TI-2023-12259 CVE-2023-27535 · GHSA-q9fm-68jc-87x3

Authentication bypass in https://github.com/curl/curl

Priority MEDIUM 60

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01803 Published 2023-03-30 Partial fix CWE-305
TI-2022-15932 CVE-2022-35252 · GHSA-qc3c-r429-gpgf

Improper input validation in https://github.com/curl/curl

Priority MEDIUM 51

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03845 Published 2022-09-23 Partial fix CWE-20