Stay Secure with the Latest Linux Advisories

security advisorycriticalremote access

Ubuntu 22.10: USN-5964-1 Critical: Exploits In Curl Input Handling

Several security issues were fixed in curl.. =========================================================================Ubuntu Security Notice USN-5964-1 March 20, 2023 curl vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in curl. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: Harry Sintonen discovered that curl incorrectly handled certain TELNET connection options. Due to lack of proper input scrubbing, curl could pass on user name and telnet options to the server as provided, contrary to expectations. (CVE-2023-27533) Harry Sintonen discovered that curl incorrectly handled special tilde characters when used with SFTP paths. A remote attacker could possibly use this issue to circumvent filtering. (CVE-2023-27534) Harry Sintonen discovered that curl incorrectly reused certain FTP connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27535) Harry Sintonen discovered that curl incorrectly reused connections when the GSS delegation option had been changed. This could lead to the option being reused, contrary to expectations. (CVE-2023-27536) Harry Sintonen discovered that curl incorrectly reused certain SSH connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27538) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.10: curl 7.85.0-1ubuntu0.5 libcurl3-gnutls 7.85.0-1ubuntu0.5 libcurl3-nss 7.85.0-1ubuntu0.5 libcurl4 7.85.0-1ubuntu0.5 Ubuntu 22.04 LTS: curl 7.81.0-1ubuntu1.10 libcurl3-gnutls 7.81.0-1ubuntu1.10 libcurl3-nss 7.81.0-1ubuntu1.10 libcurl4 7.81.0-1ubuntu1.10 Ubuntu 20.04 LTS: curl 7.68.0-1ubuntu2.18 libcurl3-gnutls 7.68.0-1ubuntu2.18 libcurl3-nss 7.68.0-1ubuntu2.18 libcurl4 7.68.0-1ubuntu2.18 Ubuntu 18.04 LTS: curl 7.58.0-2ubuntu3.24 libcurl3-gnutls 7.58.0-2ubuntu3.24 libcurl3-nss 7.58.0-2ubuntu3.24 libcurl4 7.58.0-2ubuntu3.24 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5964-1 CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538 Package Information: https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.5 https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.10 https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.18 https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.24 . Numerous security flaws affecting wget have been patched across various Debian versions, enhancing secure communication and safeguarding user information.. curl Vulnerabilities, Ubuntu Security Notice, Credential Reuse Risks. . Severity: Critical. LinuxSecurity.com Team

Mar 20, 2023 •Critical Ubuntu