Red Hat Security Advisory: curl security and bug fix update

Fixed packages 9

Vulnerabilities 6

• Medium 6.5
  CVE-2023-46218

  This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …

  curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 7, 2023
• Medium 5.9
  CVE-2022-43552

  A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…

  mysql curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 9, 2023
• Medium 5.9
  CVE-2023-27535

  An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in …

  mysql curl curl curl Debian Ubuntu Azure Linux Alpine
  Mar 30, 2023
• Medium 5.9
  CVE-2023-27536

  An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously…

  mysql curl curl curl Debian Ubuntu Azure Linux Alpine
  Mar 30, 2023
• Medium 5.3
  CVE-2023-28322

  An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …

  curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine
  May 26, 2023
• Low 3.7
  CVE-2022-35252

  When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …

  curl curl curl curl Debian Ubuntu Azure Linux Alpine
  Sep 23, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120718
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2152652
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2179073
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2179092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196793
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252030
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0428.json
• report
  https://access.redhat.com/security/cve/CVE-2022-35252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-35252
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-35252
• report
  https://access.redhat.com/security/cve/CVE-2022-43552
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-43552
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-43552
• article
  https://curl.se/docs/CVE-2022-43552.html
• report
  https://access.redhat.com/security/cve/CVE-2023-27535
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-27535
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-27535
• article
  https://curl.se/docs/CVE-2023-27535.html
• report
  https://access.redhat.com/security/cve/CVE-2023-27536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-27536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-27536
• article
  https://curl.se/docs/CVE-2023-27536.html
• report
  https://access.redhat.com/security/cve/CVE-2023-28322
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28322
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28322
• article
  https://curl.se/docs/CVE-2023-28322.html
• report
  https://access.redhat.com/security/cve/CVE-2023-46218
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46218
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46218
• article
  https://curl.se/docs/CVE-2023-46218.html