Lucene search
RedHatRHSA-2023:2478HistoryMay 09, 2023 - 5:11 a.m.
(RHSA-2023:2478) Low: curl security update
2023-05-0905:11:57
access.redhat.com
34
low severity
curl
libcurl
http
ftp
ldap
cve-2022-35252
cve-2022-43552
use-after-free
control code characters
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
51.4%
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
-
curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)
-
curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 9 | ppc64le | curl-debugsource | < 7.76.1-23.el9 | curl-debugsource-7.76.1-23.el9.ppc64le.rpm |
| RedHat | 9 | s390x | libcurl | < 7.76.1-23.el9 | libcurl-7.76.1-23.el9.s390x.rpm |
| RedHat | 9 | ppc64le | libcurl-minimal | < 7.76.1-23.el9 | libcurl-minimal-7.76.1-23.el9.ppc64le.rpm |
| RedHat | 9 | ppc64le | curl-minimal-debuginfo | < 7.76.1-23.el9 | curl-minimal-debuginfo-7.76.1-23.el9.ppc64le.rpm |
| RedHat | 9 | s390x | libcurl-debuginfo | < 7.76.1-23.el9 | libcurl-debuginfo-7.76.1-23.el9.s390x.rpm |
| RedHat | 9 | s390x | curl-minimal-debuginfo | < 7.76.1-23.el9 | curl-minimal-debuginfo-7.76.1-23.el9.s390x.rpm |
| RedHat | 9 | s390x | libcurl-minimal | < 7.76.1-23.el9 | libcurl-minimal-7.76.1-23.el9.s390x.rpm |
| RedHat | 9 | x86_64 | curl-debuginfo | < 7.76.1-23.el9 | curl-debuginfo-7.76.1-23.el9.x86_64.rpm |
| RedHat | 9 | s390x | curl-debugsource | < 7.76.1-23.el9 | curl-debugsource-7.76.1-23.el9.s390x.rpm |
| RedHat | 9 | i686 | libcurl-minimal-debuginfo | < 7.76.1-23.el9 | libcurl-minimal-debuginfo-7.76.1-23.el9.i686.rpm |
Related
oraclelinux
oraclelinux
curl security and bug fix update
2023-05-24 00:00:00
curl security update
2023-05-15 00:00:00
curl security update
2023-12-12 00:00:00
almalinux
almalinux
Low: curl security update
2023-05-09 00:00:00
Low: curl security and bug fix update
2023-05-16 00:00:00
redhat
redhat
(RHSA-2023:2963) Low: curl security and bug fix update
2023-05-16 05:59:21
(RHSA-2023:7743) Low: curl security update
2023-12-12 16:01:33
(RHSA-2024:0428) Moderate: curl security and bug fix update
2024-01-24 14:40:32
nessus
nessus
AlmaLinux 8 : curl (ALSA-2023:2963)
2023-05-20 00:00:00
CentOS 8 : curl (CESA-2023:2963)
2023-05-17 00:00:00
Oracle Linux 9 : curl (ELSA-2023-2478)
2023-05-15 00:00:00
osv
osv
Low: curl security and bug fix update
2023-05-16 00:00:00
Low: curl security update
2023-05-09 00:00:00
curl - security update
2023-01-28 00:00:00
fedora
fedora
[SECURITY] Fedora 35 Update: curl-7.79.1-6.fc35
2022-09-19 01:21:12
[SECURITY] Fedora 37 Update: curl-7.85.0-1.fc37
2022-09-14 00:23:17
[SECURITY] Fedora 36 Update: curl-7.82.0-8.fc36
2022-09-06 10:05:29
openvas
openvas
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2023-1143)
2023-01-12 00:00:00
openSUSE: Security Advisory for curl (SUSE-SU-2022:3004-1)
2022-09-03 00:00:00
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2023-1186)
2023-01-12 00:00:00
slackware
slackware
[slackware-security] curl
2022-09-01 03:09:16
cvelist
cvelist
CVE-2022-35252
2022-09-23 00:00:00
CVE-2022-43552
2023-02-09 00:00:00
hackerone
hackerone
curl: CVE-2022-35252: control code in cookie denial of service
2022-06-26 08:46:53
curl: CVE-2022-43552: HTTP Proxy deny use-after-free
2022-11-07 16:45:50
ubuntu
ubuntu
curl vulnerability
2022-09-01 00:00:00
curl vulnerabilities
2023-01-05 00:00:00
curl vulnerabilities
2023-02-27 00:00:00
ubuntucve
ubuntucve
CVE-2022-35252
2022-08-31 00:00:00
CVE-2022-43552
2022-12-21 00:00:00
ibm
ibm
alpinelinux
alpinelinux
CVE-2022-35252
2022-09-23 14:15:12
CVE-2022-43552
2023-02-09 20:15:10
veracode
veracode
Denial Of Service (DoS)
2022-09-01 05:02:48
Use-After-Free
2022-12-23 19:14:50
redos
redos
ROS-20221007-01
2022-10-07 00:00:00
ROS-20230414-04
2023-04-14 00:00:00
cloudfoundry
cloudfoundry
USN-5587-1: curl vulnerability | Cloud Foundry
2022-09-29 00:00:00
USN-5788-1: curl vulnerabilities | Cloud Foundry
2023-01-26 00:00:00
suse
suse
Security update for curl (low)
2022-09-02 00:00:00
Security update for curl (low)
2022-09-02 00:00:00
mageia
mageia
Updated curl packages fix security vulnerability
2022-09-16 22:39:55
Updated curl packages fix security vulnerability
2022-12-31 01:39:00
cbl_mariner
cbl_mariner
CVE-2022-35252 affecting package curl for versions less than 7.86.0-1
2022-11-16 02:26:15
CVE-2022-43552 affecting package mysql for versions less than 8.0.33-1
2023-05-03 16:24:32
CVE-2022-43552 affecting package cmake for versions less than 3.28.2-1
2024-03-19 17:21:46
nvd
nvd
CVE-2022-35252
2022-09-23 14:15:12
CVE-2022-43552
2023-02-09 20:15:10
debian
debian
[SECURITY] [DLA 3288-1] curl security update
2023-01-28 21:19:47
redhatcve
redhatcve
CVE-2022-43552
2022-12-21 09:36:44
CVE-2022-35252
2022-08-31 19:59:52
prion
prion
Path traversal
2023-02-09 20:15:00
Design/Logic Flaw
2022-09-23 14:15:00
debiancve
debiancve
CVE-2022-35252
2022-09-23 14:15:12
CVE-2022-43552
2023-02-09 20:15:10
cve
cve
CVE-2022-35252
2022-09-23 14:15:12
CVE-2022-43552
2023-02-09 20:15:10
kaspersky
kaspersky
KLA48562 ACE vulnerability in Microsoft Windows
2023-02-10 00:00:00
KLA48563 ACE vulnerability in Microsoft Mariner
2023-02-10 00:00:00
cgr
cgr
CVE-2022-43552 vulnerabilities
2024-05-19 03:07:16
centos
centos
curl, libcurl security update
2024-01-12 19:12:33
vulnrichment
vulnrichment
CVE-2022-43552
2023-02-09 00:00:00
wolfi
wolfi
CVE-2022-43552 vulnerabilities
2024-09-10 03:19:18
f5
f5
K000133092: cURL vulnerability CVE-2022-43552
2023-03-21 00:00:00
mscve
mscve
Open Source Curl Remote Code Execution Vulnerability
2023-02-10 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0240
2022-09-05 00:00:00
Important Photon OS Security Update - PHSA-2022-0304
2022-12-21 00:00:00
Important Photon OS Security Update - PHSA-2022-3.0-0508
2022-12-22 00:00:00
ics
ics
Siemens SINEC NMS Third-Party
2023-05-11 12:00:00
amazon
amazon
Medium: curl
2023-01-30 16:02:00
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
51.4%
Related for RHSA-2023:2478