OESA-2022-1675

Dashboard / Vulnerabilities / OESA-2022-1675

OESA-2022-1675

Summary: curl security update

Details: cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and SSH settings were left out from the configuration match checks, making them match too easily.(CVE-2022-27782) A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services (NSS) get stuck in a never-ending busy loop when trying to retrieve that information. This flaw allows an Infinite Loop, affecting system availability.(CVE-2022-27781)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1675, https://nvd.nist.gov/vuln/detail/CVE-2022-27782, https://nvd.nist.gov/vuln/detail/CVE-2022-27781