Low ELSA-2023-2478 2 CVEs

Low: curl security update (Oracle Linux 9)

Published May 15, 2023 · Updated May 15, 2023

Ecosystem: Oracle Linux

Summary

[7.76.1-23]
- fix HTTP multi-header compression denial of service (CVE-2023-23916)

[7.76.1-22]
- smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552)

[7.76.1-21]
- fix POST following PUT confusion (CVE-2022-32221)

[7.76.1-20]
- control code in cookie denial of service (CVE-2022-35252)

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 9	curl	0:7.76.1-23.el9
Oracle Linux · 9	curl-minimal	0:7.76.1-23.el9
Oracle Linux · 9	libcurl	0:7.76.1-23.el9
Oracle Linux · 9	libcurl-devel	0:7.76.1-23.el9
Oracle Linux · 9	libcurl-minimal	0:7.76.1-23.el9

Vulnerabilities 2

Medium 5.9

CVE-2022-43552

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…

mysql curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

Feb 9, 2023
Low 3.7

CVE-2022-35252

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Sep 23, 2022