Summary
[7.76.1-26]
- unify the upload/method handling (CVE-2023-28322)
- fix host name wildcard checking (CVE-2023-28321)
[7.76.1-25]
- adapt the fix of CVE-2023-27535 for RHEL 9 curl
[7.76.1-24]
- fix SSH connection too eager reuse still (CVE-2023-27538)
- fix GSS delegation too eager connection re-use (CVE-2023-27536)
- fix FTP too eager connection reuse (CVE-2023-27535)
- fix SFTP path ~ resolving discrepancy (CVE-2023-27534)
- fix TELNET option IAC injection (CVE-2023-27533)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | curl | 0:7.76.1-26.el9 |
| Oracle Linux · 9 | curl-minimal | 0:7.76.1-26.el9 |
| Oracle Linux · 9 | libcurl | 0:7.76.1-26.el9 |
| Oracle Linux · 9 | libcurl-devel | 0:7.76.1-26.el9 |
| Oracle Linux · 9 | libcurl-minimal | 0:7.76.1-26.el9 |
Vulnerabilities 4
-
Critical 9.8
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an att…
-
High 8.8
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly r…
-
High 7.7
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH c…
-
Medium 5.9
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously…