Advisory ROSA-SA-2023-2221

Software: curl 7.61.1
OS: ROSA Virtualization 2.1

package_evr_string: curl-7.61.1-30.rv3.2c.src.rpm

CVE-ID: CVE-2022-32206
BDU-ID: 2022-06918
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the CURL server communication software tool is related to the allocation of unlimited memory. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update curl command

CVE-ID: CVE-2022-43552
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: Usage after a free vulnerability exists in curl <7.87.0. Curl can be asked to “tunnel” almost all protocols it supports through HTTP proxies. HTTP proxies can (and often do) block such tunneling operations. Having been denied tunneling certain SMB or TELNET protocols, curl will use the structure allocated in the heap, once released, in its transmission termination code path.
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update curl command

CVE-ID: CVE-2023-23916
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: Unconstrained resource allocation or regulatory vulnerability exists in curl