Summary
[7.29.0-35]
- fix incorrect use of a previously loaded certificate from file
(related to CVE-2016-5420)
[7.29.0-34]
- acknowledge the --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option
(required by the fix for CVE-2016-5419)
[7.29.0-33]
- fix re-using connections with wrong client cert (CVE-2016-5420)
- fix TLS session resumption client cert bypass (CVE-2016-5419)
[7.29.0-32]
- configure: improve detection of GCC's -fvisibility= flag
[7.29.0-31]
- prevent curl_multi_wait() from missing an event (#1347904)
[7.29.0-30]
- curl.1: --disable-{eprt,epsv} are ignored for IPv6 hosts (#1305974)
[7.29.0-29]
- SSH: make CURLOPT_SSH_PUBLIC_KEYFILE treat '' as NULL (#1275769)
[7.29.0-28]
- prevent NSS from incorrectly re-using a session (#1269855)
- call PR_Cleanup() in the upstream test-suite if NSPR is used (#1243324)
- disable unreliable upstream test-case 2032 (#1241168)
[7.29.0-27]
- SSH: do not require public key file for user authentication (#1275769)
[7.29.0-26]
- implement 'curl --unix-socket' and CURLOPT_UNIX_SOCKET_PATH (#1263318)
- improve parsing of URL-encoded user name and password (#1260178)
- prevent test46 from failing due to expired cookie (#1258834)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | curl | 0:7.29.0-35.el7 |
| Oracle Linux · 7 | libcurl | 0:7.29.0-35.el7 |
| Oracle Linux · 7 | libcurl-devel | 0:7.29.0-35.el7 |
Vulnerabilities 3
-
Unscored —CVE-2016-5419 EPSS 15%
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which all…
-
Unscored —CVE-2016-5420 EPSS 15%
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which mig…
-
Unscored —
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote …