Summary
[7.76.1-35.el9_7.3]
- http: fix crash in rate-limited upload (RHEL-129493)
[7.76.1-35.el9_7.2]
- openssl: respect system crypto policy for TLS max version (RHEL-128921)
[7.76.1-35.el9_7.1]
- rebuild for rhel-9.7.0 z-stream (RHEL-121659)
[7.76.1-35]
- cookie: don't treat the leading slash as trailing (CVE-2025-9086)
Resolves: RHEL-121659
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | curl | 0:7.76.1-35.el9_7.3 |
| Oracle Linux · 9 | curl-minimal | 0:7.76.1-35.el9_7.3 |
| Oracle Linux · 9 | libcurl | 0:7.76.1-35.el9_7.3 |
| Oracle Linux · 9 | libcurl-devel | 0:7.76.1-35.el9_7.3 |
| Oracle Linux · 9 | libcurl-minimal | 0:7.76.1-35.el9_7.3 |
Vulnerabilities 1
-
High 7.5
Out of bounds read for cookie path
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…