An update for curl is now available for openEuler-22.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1124 Final 1.0 1.0 2023-02-24 Initial 2023-02-24 2023-02-24 openEuler SA Tool V1.0 2023-02-24 curl security update An update for curl is now available for openEuler-22.03-LTS. cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): A flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity.(CVE-2023-23915) A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity.(CVE-2023-23914) curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.(CVE-2023-23916) An update for curl is now available for openEuler-22.03-LTS. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium curl https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1124 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-23915 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-23914 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-23916 https://nvd.nist.gov/vuln/detail/CVE-2023-23915 https://nvd.nist.gov/vuln/detail/CVE-2023-23914 https://nvd.nist.gov/vuln/detail/CVE-2023-23916 openEuler-22.03-LTS libcurl-7.79.1-14.oe2203.aarch64.rpm curl-debugsource-7.79.1-14.oe2203.aarch64.rpm curl-7.79.1-14.oe2203.aarch64.rpm curl-debuginfo-7.79.1-14.oe2203.aarch64.rpm libcurl-devel-7.79.1-14.oe2203.aarch64.rpm curl-help-7.79.1-14.oe2203.noarch.rpm curl-7.79.1-14.oe2203.src.rpm curl-7.79.1-14.oe2203.x86_64.rpm libcurl-devel-7.79.1-14.oe2203.x86_64.rpm curl-debuginfo-7.79.1-14.oe2203.x86_64.rpm libcurl-7.79.1-14.oe2203.x86_64.rpm curl-debugsource-7.79.1-14.oe2203.x86_64.rpm A flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity. 2023-02-24 CVE-2023-23915 openEuler-22.03-LTS Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N curl security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1124 A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity. 2023-02-24 CVE-2023-23914 openEuler-22.03-LTS Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N curl security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1124 curl supports chained HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable links in this decompression chain was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers. The use of such a decompression chain could result in a malloc bomb , making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. 2023-02-24 CVE-2023-23916 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H curl security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1124