Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 41: FEDORA-2024-a94430d221 critical: curl HSTS cache issue

fedora
Calendar Grey January 9, 2025
Dist Fedora Esm H88
Fedora 41 rolls out an upgrade for curl addressing serious HSTS cache vulnerabilities; for in-depth insights and upgrade guidance, read further.
fix HSTS subdomain overwrites parent cache entry (CVE-2024-9681)

Summary

curl is a command line tool for transferring data with URL syntax, supporting

FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,

SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP

uploading, HTTP form based upload, proxies, cookies, user+password

authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer

resume, proxy tunneling and a busload of other useful tricks.

Update Information:

fix HSTS subdomain overwrites parent cache entry (CVE-2024-9681)

Topics%20covered

Topics Covered

security advisory Fedora curl cache issue HSTS remote file transfer

Change Log

* Thu Dec 12 2024 Jan Macku - 8.9.1-3 - fix HSTS subdomain overwrites parent cache entry (CVE-2024-9681)

References


[ 1 ] Bug #2326407 - CVE-2024-9681 curl: HSTS subdomain overwrites parent cache entry [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2326407

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-a94430d221' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: curl
Product: Fedora 41
Version: 8.9.1
Release: 3.fc41
URL: https://curl.se/
Summary: A utility for getting files from remote servers (FTP, HTTP, and others)

Topics%20covered

Topics Covered

security advisory Fedora curl cache issue HSTS remote file transfer

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here