curl: cookie injection with none file

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met...

Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

curl: information disclosure by exploiting a mixed case flaw

A flaw was found in curl that verifies a given cookie domain against the Public Suffix List. This issue could allow a malicious HTTP server to set "super cookies" in curl that are passed back to more origins than what is otherwise allowed or possible...

curl: more POST-after-PUT confusion

A use-after-free flaw was found in the Curl package. This issue may lead to unintended information disclosure by the application...

Exploit for Server-Side Request Forgery in Kubernetes Apiserver

CVE-2022-3172 demo Run poc.sh create...

Low: curl

Issue Overview: A flaw was found in Curl, where it inadvertently kept the SSL session ID for connections in its cache even when the verify status, OCSP stapling test, failed. A subsequent transfer to the same hostname could succeed if the session ID cache were still fresh, which then skips the...

ALSA-2024:1601 Moderate: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: information disclosure by exploiting a mixed case flaw CVE-2023-46218 curl: more POST-after-PUT confusion...

Moderate: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: information disclosure by exploiting a mixed case flaw CVE-2023-46218 curl: more POST-after-PUT confusion...

Low: curl

Issue Overview: A flaw was found in Curl, where it inadvertently kept the SSL session ID for connections in its cache even when the verify status, OCSP stapling test, failed. A subsequent transfer to the same hostname could succeed if the session ID cache were still fresh, which then skips the...

RHEL 8 : curl (RHSA-2024:1601)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1601 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

The vulnerability of the cURL command-line utility lies in the lack of protection for service data, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the command-line tool cURL relates to the installation of “superbug files” in Curl, which are then transmitted back to a larger number of sources. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of the protected informati...

MGASA-2024-0099 Updated curl packages fix security vulnerabilities

CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak A memory leak coul...

Updated curl packages fix security vulnerabilities

CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak A memory leak coul...

SUSE CVE-2024-2004

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been...

Curl 8.5.0 < 8.7.0 TLS Certificate Check Bypass (CVE-2024-2466)

The version of Curl installed on the remote host is between 8.5.0 and prior to 8.7.0. It is, therefore, affected by a certificate check bypass vulnerability. libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcu...

Curl 7.85.0 < 8.7.0 Input Misinterpretation (CVE-2024-2004)

The version of Curl installed on the remote host is between 7.85.0 and prior to 8.7.0. It is, therefore, affected by an input misinterpretation vulnerability. When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the...

Curl 7.44.0 < 8.7.0 HTTP/2 Push Headers Memory-leak (CVE-2024-2398)

The version of Curl installed on the remote host is between 7.44.0 and prior to 8.7.0. It is, therefore, affected by a memory-leak vulnerability. When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed...

Curl 8.6.0 < 8.7.0 QUIC Certificate Check Bypass (CVE-2024-2379)

The version of Curl installed on the remote host is between 8.6.0 and prior to 8.7.0. It is, therefore, affected by a certificate check bypass vulnerability. libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an...

Slackware: Security Advisory (SSA:2024-087-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-6718-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...