ELSA-2024-1601 — Moderate: curl security and bug fix update (Oracle Linux 8)

Summary

[7.61.1-33.5]
- cap SFTP packet size sent (RHEL-5485)
- when keyboard-interactive auth fails, try password (#2229800)
- unify the upload/method handling (CVE-2023-28322)
- fix cookie injection with none file (CVE-2023-38546)
- lowercase the domain names before PSL checks (CVE-2023-46218)

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	curl	0:7.61.1-33.el8_9.5
Oracle Linux · 8	libcurl	0:7.61.1-33.el8_9.5
Oracle Linux · 8	libcurl-devel	0:7.61.1-33.el8_9.5
Oracle Linux · 8	libcurl-minimal	0:7.61.1-33.el8_9.5

Vulnerabilities 3

Medium 6.5

CVE-2023-46218

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …

curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

Dec 7, 2023
Medium 5.3

CVE-2023-28322

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine

May 26, 2023
Unscored —

CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …

curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

Oct 18, 2023

Moderate: curl security and bug fix update (Oracle Linux 8)

Summary

Fixed packages 4

Vulnerabilities 3

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …