Summary
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: HTTP/2 push headers memory-leak (CVE-2024-2398)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | curl | 7.61.1-34.el8_10.2 |
| AlmaLinux · 8 | libcurl | 7.61.1-34.el8_10.2 |
| AlmaLinux · 8 | libcurl-devel | 7.61.1-34.el8_10.2 |
| AlmaLinux · 8 | libcurl-minimal | 7.61.1-34.el8_10.2 |
Vulnerabilities 1
-
High 8.6CVE-2024-2398 EPSS 36%
HTTP/2 push headers memory-leak
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…