Ubuntu 2167-1: Moderate Curl Issues Affecting Sensitive Data Exposure

ubuntu

April 14, 2014

Several security issues were fixed in curl.

Summary

Several security issues were fixed in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Steve Holme discovered that libcurl incorrectly reused wrong connections

when using protocols other than HTTP and FTP. This could lead to the use of

unintended credentials, possibly exposing sensitive information.

(CVE-2014-0138)

Richard Moore discovered that libcurl incorrectly validated wildcard SSL

certificates that contain literal IP addresses. An attacker could possibly

exploit this to perform a man in the middle attack to view sensitive

information or alter encrypted communications. (CVE-2014-0139)

Topics Covered

security advisory security issue update Ubuntu information exposure curl sensitive data

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libcurl3                        7.32.0-1ubuntu1.4
  libcurl3-gnutls                 7.32.0-1ubuntu1.4
  libcurl3-nss                    7.32.0-1ubuntu1.4

Ubuntu 12.10:
  libcurl3                        7.27.0-1ubuntu1.9
  libcurl3-gnutls                 7.27.0-1ubuntu1.9
  libcurl3-nss                    7.27.0-1ubuntu1.9

Ubuntu 12.04 LTS:
  libcurl3                        7.22.0-3ubuntu4.8
  libcurl3-gnutls                 7.22.0-3ubuntu4.8
  libcurl3-nss                    7.22.0-3ubuntu4.8

Ubuntu 10.04 LTS:
  libcurl3                        7.19.7-1ubuntu1.7
  libcurl3-gnutls                 7.19.7-1ubuntu1.7

In general, a standard system update will make all the necessary changes.