Fedora: 2020-ad05132742 Urgent: mingw-curl Password Leak and File Overwrite

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS,

DICT, TELNET and TFTP servers, using any of the supported protocols.

cURL is designed to work without user interaction or any kind of

interactivity. cURL offers many useful capabilities, like proxy

support, user authentication, FTP upload, HTTP post, and file transfer

resume.

This is the MinGW cross-compiled Windows library.

Major update includes security fixes.

* Fri Jul 24 2020 Michael Cronenworth - 7.71.1-1

- Update to 7.71.1, which fixes the following vulnerabilities

CVE-2020-8169 - curl: Partial password leak over DNS on HTTP redirect

CVE-2020-8177 - curl: overwrite local file with -J

[ 1 ] Bug #1851427 - CVE-2020-8177 mingw-curl: curl: command line arguments lead to local file overwrite [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1851427

[ 2 ] Bug #1851436 - CVE-2020-8169 mingw-curl: libcurl: partial password leak over DNS on HTTP redirect [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1851436

su -c 'dnf upgrade --advisory FEDORA-2020-ad05132742' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/