RHSA-2024:0428MediumCVSS 5.9

Red Hat Security Advisory: curl security and bug fix update

Published
January 25, 2024
Last Modified
October 15, 2026

🔗 CVE IDs covered (6)

CVE-2022-35252 →CVE-2022-43552 →CVE-2023-27535 →CVE-2023-27536 →CVE-2023-28322 →CVE-2023-46218 →

📋 Description

CVE-2022-35252 — curl: Incorrect handling of control code characters in cookies CVE-2022-43552 — curl: Use-after-free triggered by an HTTP proxy deny response CVE-2023-27535 — curl: FTP too eager connection reuse CVE-2023-27536 — curl: GSS delegation too eager connection re-use CVE-2023-28322 — curl: more POST-after-PUT confusion CVE-2023-46218 — curl: information disclosure by exploiting a mixed case flaw

🎯 Affected products46

  • Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-0:7.61.1-22.el8_6.12.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-0:7.61.1-22.el8_6.12.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-0:7.61.1-22.el8_6.12.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-0:7.61.1-22.el8_6.12.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-0:7.61.1-22.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debuginfo-0:7.61.1-22.el8_6.12.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debuginfo-0:7.61.1-22.el8_6.12.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debuginfo-0:7.61.1-22.el8_6.12.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debuginfo-0:7.61.1-22.el8_6.12.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debuginfo-0:7.61.1-22.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debugsource-0:7.61.1-22.el8_6.12.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debugsource-0:7.61.1-22.el8_6.12.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debugsource-0:7.61.1-22.el8_6.12.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debugsource-0:7.61.1-22.el8_6.12.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-debugsource-0:7.61.1-22.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-minimal-debuginfo-0:7.61.1-22.el8_6.12.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-minimal-debuginfo-0:7.61.1-22.el8_6.12.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-minimal-debuginfo-0:7.61.1-22.el8_6.12.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-minimal-debuginfo-0:7.61.1-22.el8_6.12.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • curl-minimal-debuginfo-0:7.61.1-22.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-0:7.61.1-22.el8_6.12.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-0:7.61.1-22.el8_6.12.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-0:7.61.1-22.el8_6.12.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-0:7.61.1-22.el8_6.12.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-0:7.61.1-22.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-debuginfo-0:7.61.1-22.el8_6.12.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-debuginfo-0:7.61.1-22.el8_6.12.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-debuginfo-0:7.61.1-22.el8_6.12.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libcurl-debuginfo-0:7.61.1-22.el8_6.12.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • +16 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Avoid using the SMB and TELNET protocols.

🔗 References (9)