Debian 10 Buster: DLA-3398-1 Critical: Curl Input Validation Bypass

CVE-2023-27535

An authentication bypass vulnerability exists in libcurl in the FTP
connection reuse feature that can result in wrong credentials being used
during subsequent transfers. Previously created connections are kept in a
connection pool for reuse if they match the current setup. However, certain
FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER,
CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the
configuration match checks, causing them to match too easily. This could
lead to libcurl using the wrong credentials when performing a transfer,
potentially allowing unauthorized access to sensitive information.

CVE-2023-27536

An authentication bypass vulnerability exists in libcurl in the
connection reuse feature which can reuse previously established connections
with incorrect user permissions due to a failure to check for changes in
the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects