Summary
[7.61.1-18]
- http: send payload when (proxy) authentication is done (#1918692)
- curl: Inferior OCSP verification (CVE-2020-8286)
- libcurl: FTP wildcard stack overflow (CVE-2020-8285)
- curl: trusting FTP PASV responses (CVE-2020-8284)
[7.61.1-17]
- validate an ssl connection using an intermediate certificate (#1895355)
[7.61.1-16]
- fix multiarch conflicts in libcurl-minimal (#1895391)
[7.61.1-15]
- do not crash when HTTPS_PROXY and NO_PROXY are used together (#1873327)
- libcurl: wrong connect-only connection (CVE-2020-8231)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | curl | 0:7.61.1-18.el8 |
| Oracle Linux · 8 | libcurl | 0:7.61.1-18.el8 |
| Oracle Linux · 8 | libcurl-devel | 0:7.61.1-18.el8 |
| Oracle Linux · 8 | libcurl-minimal | 0:7.61.1-18.el8 |
Vulnerabilities 4
-
High 7.5
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildca…
-
Low 3.7
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP ad…
-
Unscored —
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
-
Unscored —
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…