Skip to content
OpenAdvisories
Low ELSA-2022-8299 1 CVE

Low: curl security update (Oracle Linux 9)

Published Nov 22, 2022 · Updated Nov 22, 2022

Summary

[7.76.1-19]
- fix unpreserved file permissions (CVE-2022-32207)
- fix HTTP compression denial of service (CVE-2022-32206)
- fix FTP-KRB bad message verification (CVE-2022-32208)

[7.76.1-18]
- fix too eager reuse of TLS and SSH connections (CVE-2022-27782)

[7.76.1-17]
- fix leak of SRP credentials in redirects (CVE-2022-27774)

[7.76.1-16]
- add missing tests to Makefile

[7.76.1-15]
- fix credential leak on redirect (CVE-2022-27774)
- fix auth/cookie leak on redirect (CVE-2022-27776)
- fix bad local IPv6 connection reuse (CVE-2022-27775)
- fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 curl 0:7.76.1-19.el9
Oracle Linux · 9 curl-minimal 0:7.76.1-19.el9
Oracle Linux · 9 libcurl 0:7.76.1-19.el9
Oracle Linux · 9 libcurl-devel 0:7.76.1-19.el9
Oracle Linux · 9 libcurl-minimal 0:7.76.1-19.el9

Vulnerabilities 1