An update for curl is now available for openEuler-20.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2022-2039 Final 1.0 1.0 2022-11-04 Initial 2022-11-04 2022-11-04 openEuler SA Tool V1.0 2022-11-04 curl security update An update for curl is now available for openEuler-20.03-LTS-SP1. CURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set if it previously used the same handle to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request.(CVE-2022-32221) An update for curl is now available for openEuler-20.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium curl https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2039 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-32221 https://nvd.nist.gov/vuln/detail/CVE-2022-32221 openEuler-20.03-LTS-SP1 libcurl-devel-7.71.1-19.oe1.aarch64.rpm curl-debuginfo-7.71.1-19.oe1.aarch64.rpm libcurl-7.71.1-19.oe1.aarch64.rpm curl-debugsource-7.71.1-19.oe1.aarch64.rpm curl-7.71.1-19.oe1.aarch64.rpm curl-help-7.71.1-19.oe1.noarch.rpm curl-7.71.1-19.oe1.src.rpm curl-debuginfo-7.71.1-19.oe1.x86_64.rpm libcurl-devel-7.71.1-19.oe1.x86_64.rpm curl-7.71.1-19.oe1.x86_64.rpm curl-debugsource-7.71.1-19.oe1.x86_64.rpm libcurl-7.71.1-19.oe1.x86_64.rpm A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set if it previously used the same handle to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. 2022-11-04 CVE-2022-32221 openEuler-20.03-LTS-SP1 Medium 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N curl security update 2022-11-04 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2039