Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 503
Alerts This Week
Warning Icon 1 503

Ubuntu 22.04 LTS USN-5788-1 Critical: Curl DoS Attack Details

ubuntu
Calendar Grey January 5, 2023
Dist Ubuntu Esm H88
Numerous vulnerabilities in curl impact various Ubuntu versions. Guidance on how to update is provided.
Several security issues were fixed in curl.

Summary

Several security issues were fixed in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Hiroki Kurosawa discovered that curl incorrectly handled HSTS support

when certain hostnames included IDN characters. A remote attacker could

possibly use this issue to cause curl to use unencrypted connections. This

issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-43551)

It was discovered that curl incorrectly handled denials when using HTTP

proxies. A remote attacker could use this issue to cause curl to crash,

resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2022-43552)

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu curl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   curl                            7.85.0-1ubuntu0.2
   libcurl3-gnutls                 7.85.0-1ubuntu0.2
   libcurl3-nss                    7.85.0-1ubuntu0.2
   libcurl4                        7.85.0-1ubuntu0.2

Ubuntu 22.04 LTS:
   curl                            7.81.0-1ubuntu1.7
   libcurl3-gnutls                 7.81.0-1ubuntu1.7
   libcurl3-nss                    7.81.0-1ubuntu1.7
   libcurl4                        7.81.0-1ubuntu1.7

Ubuntu 20.04 LTS:
   curl                            7.68.0-1ubuntu2.15
   libcurl3-gnutls                 7.68.0-1ubuntu2.15
   libcurl3-nss                    7.68.0-1ubuntu2.15
   libcurl4                        7.68.0-1ubuntu2.15

Ubuntu 18.04 LTS:
   curl                            7.58.0-2ubuntu3.22
   libcurl3-gnutls                 7.58.0-2ubuntu3.22
   libcurl3-nss                    7.58.0-2ubuntu3.22
   libcurl4                        7.58.0-2ubuntu3.22

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5788-1

CVE-2022-43551, CVE-2022-43552

Severity
critical
Lowest
Low
Medium
High
Critical

January 05, 2023

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu curl

Package Information

https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.7
https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.15

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.