Summary
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284)
* curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285)
* curl: Inferior OCSP verification (CVE-2020-8286)
* curl: Expired pointer dereference via multi API with CURLOPT_CONNECT_ONLY option set (CVE-2020-8231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | curl | 0:7.61.1-18.el8 |
Vulnerabilities 4
-
High 7.5
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildca…
-
Low 3.7
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP ad…
-
Unscored —
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
-
Unscored —
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1868032
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1873327
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1895391
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1902667
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1902687
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1906096
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1918692