• [SECURITY] [DSA 4881-1] curl security update

    From Alessandro Ghedini@21:1/5 to All on Wed Mar 31 11:40:02 2021
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-4881-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini
    March 30, 2021 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : curl
    CVE ID : CVE-2020-8169 CVE-2020-8177 CVE-2020-8231 CVE-2020-8284
    CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 Debian Bug : 965280 965281 968831 977161 977162 977163

    Multiple vulnerabilities were discovered in cURL, an URL transfer library:


    Marek Szlagor reported that libcurl could be tricked into prepending
    a part of the password to the host name before it resolves it,
    potentially leaking the partial password over the network and to the
    DNS server(s).


    sn reported that curl could be tricked by a malicious server into
    overwriting a local file when using th -J (--remote-header-name) and
    -i (--include) options in the same command line.


    Marc Aldorasi reported that libcurl might use the wrong connection
    when an application using libcurl's multi API sets the option
    CURLOPT_CONNECT_ONLY, which could lead to information leaks.


    Varnavas Papaioannou reported that a malicious server could use the
    PASV response to trick curl into connecting back to an arbitrary IP
    address and port, potentially making curl extract information about
    services that are otherwise private and not disclosed.


    xnynx reported that libcurl could run out of stack space when using
    tha FTP wildcard matching functionality (CURLOPT_CHUNK_BGN_FUNCTION).


    It was reported that libcurl didn't verify that an OCSP response
    actually matches the certificate it is intended to.


    Viktor Szakats reported that libcurl does not strip off user
    credentials from the URL when automatically populating the Referer
    HTTP request header field in outgoing HTTP requests.


    Mingtao Yang reported that, when using an HTTPS proxy and TLS 1.3,
    libcurl could confuse session tickets arriving from the HTTPS proxy
    as if they arrived from the remote server instead. This could allow
    an HTTPS proxy to trick libcurl into using the wrong session ticket
    for the host and thereby circumvent the server TLS certificate check.

    For the stable distribution (buster), these problems have been fixed in
    version 7.64.0-4+deb10u2.

    We recommend that you upgrade your curl packages.

    For the detailed security status of curl please refer to
    its security tracker page at:

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

    iQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAmBkQCoACgkQbwzL4CFi Ryg6Gg/+LqhhJ8+D7skevVkYzxHzdH2yT/XMeoYp0D37yHmEfH9PyjXwfplG+XEw /xwFRBK8qxD1ja+rQddYyeTvi1OMnMgMS3UsRHlfeMnLxh2+oHnvHDYG848npUEZ Rq4YFoc/n9YTAJZP/G4oiuBeXqH2Sqa5hSNT6VrYfRciCxkYnzA78b85KpI8aYyR lhfiJMNpwrqDbt/QzblpELBkGMIV402VeiqDwHfcVzm2E810xXQNLvPMbWtvDYkA TSrNsdqfuFr1tuQSZY6CGSWEyXtB/tOo8+pvUixlJMBWJMl5TXEcJkD5ckehx0yb C3n9yapfklxHiG9lD4zwwIJDqd3Y4SxdDiSlUC4OhdvpwniMygX0S3ICaPA4iac/ cWanml0Fop3OmRy+vQURTd3sADoT5HoRSUXZVU+HdTrRaEt2xs5okZkWSd3yr4Ux i+HgjUAFkkk8DLRB68Bbpx1LGxFGQT7L8yd4wsWINXlzASIP1A5dnNfE5w0VWOHG 3KDq47wNfjuiZC8GXW+HQCxz5MijnS8Y/Egl0OozNFDwEitNBZEsIjpZaZBdZIwi UFfcK7+u/y/TRY54rA4erkdcHFwpYW5EZVGdb7Z+WPWVlzw0ImXrM68LSAhHQaqW 1Hx4VwwwTsMIPnrx2kriRiiDPOW1r5Kip3yHa+QZLedSRGibQWk=
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)