Summary
[7.61.1-22]
- fix STARTTLS protocol injection via MITM (CVE-2021-22947)
- fix protocol downgrade required TLS bypass (CVE-2021-22946)
[7.61.1-21]
- fix TELNET stack contents disclosure again (CVE-2021-22925)
- fix TELNET stack contents disclosure (CVE-2021-22898)
- fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
- disable metalink support to fix the following vulnerabilities
CVE-2021-22923 - metalink download sends credentials
CVE-2021-22922 - wrong content via metalink not discarded
[7.61.1-20]
- fix a cppchecks false positive in 0029-curl-7.61.1-CVE-2021-22876.patch
[7.61.1-19]
- make curl --head file:// work as expected (#1947493)
- prevent automatic referer from leaking credentials (CVE-2021-22876)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | curl | 0:7.61.1-22.el8 |
| Oracle Linux · 8 | libcurl | 0:7.61.1-22.el8 |
| Oracle Linux · 8 | libcurl-devel | 0:7.61.1-22.el8 |
| Oracle Linux · 8 | libcurl-minimal | 0:7.61.1-22.el8 |
Vulnerabilities 3
-
Medium 5.3
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Act…
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…