Summary
Marc Aldorasi discovered that curl incorrectly handled the libcurl
CURLOPT_CONNECT_ONLY option. This could result in data being sent to the
wrong destination, possibly exposing sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | curl | 7.47.0-1ubuntu2.16 |
| Ubuntu · 18.04 LTS 18.04:LTS | curl | 7.58.0-2ubuntu3.10 |
| Ubuntu · 20.04 LTS 20.04:LTS | curl | 7.68.0-1ubuntu2.2 |
Vulnerabilities 1
-
Unscored —
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
References
-
report
https://ubuntu.com/security/CVE-2020-8231