Medium ELSA-2022-6159 2 CVEs

Moderate: curl security update (Oracle Linux 8)

Published Aug 24, 2022 · Updated Aug 24, 2022

Ecosystem: Oracle Linux

Summary

[7.61.1-22.el8_6.4]
- fix HTTP compression denial of service (CVE-2022-32206)
- fix FTP-KRB bad message verification (CVE-2022-32208)

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	curl	0:7.61.1-22.el8_6.4
Oracle Linux · 8	libcurl	0:7.61.1-22.el8_6.4
Oracle Linux · 8	libcurl-devel	0:7.61.1-22.el8_6.4
Oracle Linux · 8	libcurl-minimal	0:7.61.1-22.el8_6.4

Vulnerabilities 2

Medium 6.5

CVE-2022-32206 EPSS 36%

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022
Medium 5.9

CVE-2022-32208

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022