cURL - Security Update
Summary
DSA-3232-1: curl - security update. Affects curl versions < 7.26.0-1+wheezy13. Fixed in 7.26.0-1+wheezy13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cURL is an URL transfer library used for making HTTP requests and transferring data. It is widely used in various applications and operating systems. This vulnerability affects the cURL package in Debian 7 (wheezy) and Debian 8 (jessie) distributions.
Vulnerability Detail
The vulnerability (CVE-2015-3143) allows NTLM-authenticated connections to be wrongly reused for requests without any credentials set, resulting in HTTP requests being sent over the connection authenticated as a different user. This can lead to unauthorized access and potential information disclosure. Another vulnerability (CVE-2015-3148) affects HTTP requests using the Negotiate authentication method along with NTLM, where the connection used is not marked as authenticated, allowing requests for one user to be sent over the connection authenticated as a different user.
How To Fix
Minimum fixed version
7.26.0-1+wheezy13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the cURL package to the recommended versions will fix the vulnerabilities and ensure the security of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
cURL is an URL transfer library used for making HTTP requests and transferring data. It is widely used in various applications and operating systems.
The vulnerabilities can lead to unauthorized access and potential information disclosure.
The vulnerabilities affect Debian 7 (wheezy) and Debian 8 (jessie) distributions.
To fix these vulnerabilities, it is recommended to upgrade the cURL package to the specified versions.
The updated package can be obtained from the official Debian repository.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
