Red Hat Security Advisory

RHSA-2024:0585

curl security and bug fix update

Released 2024-01-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS EUS (v.8.8) curl-7.61.1-30.el8_8.9, libcurl-7.61.1-30.el8_8.9, libcurl-devel-7.61.1-30.el8_8.9 +1

Fixes 2 records

TI-2023-24845 CVE-2023-46218 · GHSA-59mm-6rr4-j9p2

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then…

HIGH 68

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01685 Published 2023-12-07 Partial fix · 7.46.0 CWE-178

TI-2023-12870 CVE-2023-28322 · GHSA-78jh-p6rf-g59w

Information disclosure in https://github.com/curl/curl

MEDIUM 63

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFI…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02211 Published 2023-05-26 Partial fix CWE-200