Ubuntu 15.10 USN-2882-1 Critical: Curl Credential Mismanagement

ubuntu

January 27, 2016

curl would incorrectly re-use credentials.

Summary

curl would incorrectly re-use credentials.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Isaac Boukris discovered that curl could incorrectly re-use NTLM proxy

credentials when subsequently connecting to the same host.

Topics Covered

security advisory critical ubuntu curl credential management

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libcurl3                        7.43.0-1ubuntu2.1
  libcurl3-gnutls                 7.43.0-1ubuntu2.1
  libcurl3-nss                    7.43.0-1ubuntu2.1

Ubuntu 15.04:
  libcurl3                        7.38.0-3ubuntu2.3
  libcurl3-gnutls                 7.38.0-3ubuntu2.3
  libcurl3-nss                    7.38.0-3ubuntu2.3

Ubuntu 14.04 LTS:
  libcurl3                        7.35.0-1ubuntu2.6
  libcurl3-gnutls                 7.35.0-1ubuntu2.6
  libcurl3-nss                    7.35.0-1ubuntu2.6

Ubuntu 12.04 LTS:
  libcurl3                        7.22.0-3ubuntu4.15
  libcurl3-gnutls                 7.22.0-3ubuntu4.15
  libcurl3-nss                    7.22.0-3ubuntu4.15

In general, a standard system update will make all the necessary changes.