Description
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | curl | 7.19.7-53 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | curl +2 | 7.19.7-53.el6_9 | RHSA-2017:0847 |
Advisories 1
- RHSA-2017:0847 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2017:0847 vendor-advisory
- 97187 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1422464