Ubuntu 22.10: USN-5964-1 Critical: Exploits In Curl Input Handling

ubuntu

March 20, 2023

Several security issues were fixed in curl.

Summary

Several security issues were fixed in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Harry Sintonen discovered that curl incorrectly handled certain TELNET

connection options. Due to lack of proper input scrubbing, curl could pass

on user name and telnet options to the server as provided, contrary to

expectations. (CVE-2023-27533)

Harry Sintonen discovered that curl incorrectly handled special tilde

characters when used with SFTP paths. A remote attacker could possibly use

this issue to circumvent filtering. (CVE-2023-27534)

Harry Sintonen discovered that curl incorrectly reused certain FTP

connections. This could lead to the wrong credentials being reused,

contrary to expectations. (CVE-2023-27535)

Harry Sintonen discovered that curl incorrectly reused connections when the

GSS delegation option had been changed. This could lead to the option being

reused, contrary to expectations. (CVE-2023-27536)

Harry...

Read the Full Advisory

Topics Covered

security advisory critical remote access ubuntu curl input handling credentials reuse

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   curl                            7.85.0-1ubuntu0.5
   libcurl3-gnutls                 7.85.0-1ubuntu0.5
   libcurl3-nss                    7.85.0-1ubuntu0.5
   libcurl4                        7.85.0-1ubuntu0.5

Ubuntu 22.04 LTS:
   curl                            7.81.0-1ubuntu1.10
   libcurl3-gnutls                 7.81.0-1ubuntu1.10
   libcurl3-nss                    7.81.0-1ubuntu1.10
   libcurl4                        7.81.0-1ubuntu1.10

Ubuntu 20.04 LTS:
   curl                            7.68.0-1ubuntu2.18
   libcurl3-gnutls                 7.68.0-1ubuntu2.18
   libcurl3-nss                    7.68.0-1ubuntu2.18
   libcurl4                        7.68.0-1ubuntu2.18

Ubuntu 18.04 LTS:
   curl                            7.58.0-2ubuntu3.24
   libcurl3-gnutls                 7.58.0-2ubuntu3.24
   libcurl3-nss                    7.58.0-2ubuntu3.24
   libcurl4                        7.58.0-2ubuntu3.24

In general, a standard system update will make all the necessary changes.