Moderate: curl security and bug fix update
Summary
ALSA-2021:4511: Moderate: curl security and bug fix update. Affects curl versions < 7.61.1-22.el8. Fixed in 7.61.1-22.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. These packages are commonly used in software applications to facilitate network communication and data transfer.
Vulnerability Detail
The curl packages are affected by multiple security vulnerabilities:
-
CVE-2021-22876: This vulnerability allows an attacker to leak authentication credentials in the URL via automatic Referer. This could lead to unauthorized access to sensitive information.
-
CVE-2021-22898: This vulnerability exposes the contents of the TELNET stack, potentially disclosing sensitive data.
-
CVE-2021-22925: This vulnerability is an incorrect fix for CVE-2021-22898, which also allows disclosure of TELNET stack contents.
These vulnerabilities can have various impacts, including unauthorized access, information disclosure, and potential compromise of sensitive data.
How To Fix
Minimum fixed version
7.61.1-22.el8
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security updates as soon as possible to mitigate the risks.
Conclusion
The curl packages in AlmaLinux 8 are affected by multiple security vulnerabilities. It is crucial to update these packages to the recommended version to mitigate the risks associated with unauthorized access, information disclosure, and potential compromise of sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
These vulnerabilities can lead to unauthorized access, information disclosure, and potential compromise of sensitive data.
To fix these vulnerabilities, update the curl packages to version 7.61.1-22.el8 or later.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security updates.
The curl, libcurl, libcurl-devel, and libcurl-minimal packages in AlmaLinux 8 are affected.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
