ELSA-2022-6157 — Moderate: curl security update (Oracle Linux 9)

Summary

[7.76.1-14.el9_0.5]
- fix unpreserved file permissions (CVE-2022-32207)
- fix HTTP compression denial of service (CVE-2022-32206)
- fix FTP-KRB bad message verification (CVE-2022-32208)

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 9	curl	0:7.76.1-14.el9_0.5
Oracle Linux · 9	curl-minimal	0:7.76.1-14.el9_0.5
Oracle Linux · 9	libcurl	0:7.76.1-14.el9_0.5
Oracle Linux · 9	libcurl-devel	0:7.76.1-14.el9_0.5
Oracle Linux · 9	libcurl-minimal	0:7.76.1-14.el9_0.5

Vulnerabilities 3

Critical 9.8

CVE-2022-32207 EPSS 12%

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022
Medium 6.5

CVE-2022-32206 EPSS 36%

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022
Medium 5.9

CVE-2022-32208

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022

Moderate: curl security update (Oracle Linux 9)

Summary

Fixed packages 5

Vulnerabilities 3

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…