ELSA-2021-3582 — Moderate: curl security update (Oracle Linux 8)

Summary

[7.61.1-18.el8_4.1]
- fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
- disable metalink support to fix the following vulnerabilities
CVE-2021-22923 - metalink download sends credentials
CVE-2021-22922 - wrong content via metalink not discarded

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	curl	0:7.61.1-18.el8_4.1
Oracle Linux · 8	libcurl	0:7.61.1-18.el8_4.1
Oracle Linux · 8	libcurl-devel	0:7.61.1-18.el8_4.1
Oracle Linux · 8	libcurl-minimal	0:7.61.1-18.el8_4.1

Vulnerabilities 3

Medium 6.5

CVE-2021-22922

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…

curl curl curl Debian Azure Linux Alpine

Aug 5, 2021
Low 3.7

CVE-2021-22924 Public exploit

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Aug 5, 2021
Unscored —

CVE-2021-22923

When curl is instructed to get content using the metalink feature, and a user name and password are used to download th…

curl curl curl Debian Azure Linux Alpine

Aug 5, 2021

Moderate: curl security update (Oracle Linux 8)

Summary

Fixed packages 4

Vulnerabilities 3

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…

When curl is instructed to get content using the metalink feature, and a user name and password are used to download th…