ROS-20221108-01

A vulnerability in the cURL command line utility is related to an error in parsing URLs with
IDN characters that are replaced by ASCII analogs during IDN conversion. Exploitation of the vulnerability
could allow an attacker acting remotely to bypass curl’s HSTS inspection and force it to
Use the unencrypted HTTP protocol

The cURL command line utility vulnerability involves a boundary error in the processing of non-200 HTTP responses to the
proxies for the following schemes: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, telnet. Exploitation
vulnerability could allow an attacker acting remotely to cause a bug by forcing an application to
connect to resources that are not allowed by the configured proxy server