[SECURITY] [DSA 2398-2] curl regression

2012-03-3119:38:57

lists.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

7.5

Confidence

Low

EPSS

0.006

Percentile

78.8%

JSON

Debian Security Advisory DSA-2398-2 [email protected]
http://www.debian.org/security/ Florian Weimer
March 31, 2012 http://www.debian.org/security/faq

Package : curl
Vulnerability : regression
Debian-specific: no
Debian Bug : 658276

cURL is a command-line tool and library for transferring data with URL
syntax. It was discovered that the countermeasures against the
Dai/Rogaway chosen-plaintext attack on SSL/TLS (CVE-2011-3389,
"BEAST") cause interoperability issues with some server
implementations. This update ads the the CURLOPT_SSL_OPTIONS and
CURLSSLOPT_ALLOW_BEAST options to the library, and the

–ssl-allow-beast option to the "curl" program.

For the stable distribution (squeeze), this problem has been fixed in
version 7.21.0-2.1+squeeze2.

We recommend that you upgrade your curl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6sparcopenjdk-6-demo< 6b18-1.8.10-0+squeeze2openjdk-6-demo_6b18-1.8.10-0+squeeze2_sparc.deb
Debian6kfreebsd-i386libcurl3-gnutls< 7.21.0-2.1+squeeze1libcurl3-gnutls_7.21.0-2.1+squeeze1_kfreebsd-i386.deb
Debian6ia64lighttpd-mod-webdav< 1.4.28-2+squeeze1lighttpd-mod-webdav_1.4.28-2+squeeze1_ia64.deb
Debian5i386lighttpd-mod-webdav< 1.4.19-5+lenny3lighttpd-mod-webdav_1.4.19-5+lenny3_i386.deb
Debian5amd64curl< 7.18.2-8lenny6curl_7.18.2-8lenny6_amd64.deb
Debian8armhfasterisk-voicemail-imapstorage< 1:11.13.1~dfsg-2+deb8u1asterisk-voicemail-imapstorage_1:11.13.1~dfsg-2+deb8u1_armhf.deb
Debian5i386openjdk-6-dbg< 6b18-1.8.10-0~lenny2openjdk-6-dbg_6b18-1.8.10-0~lenny2_i386.deb
Debian8armhfasterisk-dbg< 1:11.13.1~dfsg-2+deb8u1asterisk-dbg_1:11.13.1~dfsg-2+deb8u1_armhf.deb
Debian8kfreebsd-i386asterisk-modules< 1:11.13.1~dfsg-2+deb8u1asterisk-modules_1:11.13.1~dfsg-2+deb8u1_kfreebsd-i386.deb
Debian6ia64curl< 7.21.0-2.1+squeeze1curl_7.21.0-2.1+squeeze1_ia64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	sparc	openjdk-6-demo	< 6b18-1.8.10-0+squeeze2	openjdk-6-demo_6b18-1.8.10-0+squeeze2_sparc.deb
Debian	6	kfreebsd-i386	libcurl3-gnutls	< 7.21.0-2.1+squeeze1	libcurl3-gnutls_7.21.0-2.1+squeeze1_kfreebsd-i386.deb
Debian	6	ia64	lighttpd-mod-webdav	< 1.4.28-2+squeeze1	lighttpd-mod-webdav_1.4.28-2+squeeze1_ia64.deb
Debian	5	i386	lighttpd-mod-webdav	< 1.4.19-5+lenny3	lighttpd-mod-webdav_1.4.19-5+lenny3_i386.deb
Debian	5	amd64	curl	< 7.18.2-8lenny6	curl_7.18.2-8lenny6_amd64.deb
Debian	8	armhf	asterisk-voicemail-imapstorage	< 1:11.13.1~dfsg-2+deb8u1	asterisk-voicemail-imapstorage_1:11.13.1~dfsg-2+deb8u1_armhf.deb
Debian	5	i386	openjdk-6-dbg	< 6b18-1.8.10-0~lenny2	openjdk-6-dbg_6b18-1.8.10-0~lenny2_i386.deb
Debian	8	armhf	asterisk-dbg	< 1:11.13.1~dfsg-2+deb8u1	asterisk-dbg_1:11.13.1~dfsg-2+deb8u1_armhf.deb
Debian	8	kfreebsd-i386	asterisk-modules	< 1:11.13.1~dfsg-2+deb8u1	asterisk-modules_1:11.13.1~dfsg-2+deb8u1_kfreebsd-i386.deb
Debian	6	ia64	curl	< 7.21.0-2.1+squeeze1	curl_7.21.0-2.1+squeeze1_ia64.deb