Red Hat Security Advisory

RHSA-2024:1601

curl security and bug fix update

Released 2024-04-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-33.el8_9.5, libcurl-7.61.1-33.el8_9.5, libcurl-devel-7.61.1-33.el8_9.5 +1

Fixes 3 records

TI-2023-24845 CVE-2023-46218 · GHSA-59mm-6rr4-j9p2

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then…

HIGH 68

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01685 Published 2023-12-07 Partial fix · 7.46.0 CWE-178

TI-2023-12870 CVE-2023-28322 · GHSA-78jh-p6rf-g59w

Information disclosure in https://github.com/curl/curl

MEDIUM 63

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFI…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02211 Published 2023-05-26 Partial fix CWE-200

TI-2023-19923 CVE-2023-38546 · GHSA-x3qx-m3c2-qfhx

This flaw allows an attacker to insert cookies at will into a running program using…

LOW 27

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.05956 Published 2023-10-18 Partial fix · 8.4.0, 7.9.1