173 lines
12 KiB
XML
173 lines
12 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2022-1675</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2022-05-28</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2022-05-28</InitialReleaseDate>
|
|
<CurrentReleaseDate>2022-05-28</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2022-05-28</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">curl security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
|
|
|
|
Security Fix(es):
|
|
|
|
libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and SSH settings were left out from the configuration match checks, making them match too easily.(CVE-2022-27782)
|
|
|
|
A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services (NSS) get stuck in a never-ending busy loop when trying to retrieve that information. This flaw allows an Infinite Loop, affecting system availability.(CVE-2022-27781)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
|
|
|
|
openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Medium</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">curl</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1675</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-27782</URL>
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-27781</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-27782</URL>
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-27781</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="curl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debugsource-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-debugsource-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debuginfo-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-debuginfo-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libcurl-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-devel-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libcurl-devel-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debugsource-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-debugsource-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debuginfo-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-debuginfo-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">libcurl-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-devel-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">libcurl-devel-7.71.1-14.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-7.79.1-6.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debugsource-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-debugsource-7.79.1-6.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debuginfo-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-debuginfo-7.79.1-6.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libcurl-7.79.1-6.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-devel-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libcurl-devel-7.79.1-6.oe2203.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="curl-help-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-help-7.71.1-14.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-help-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-help-7.71.1-14.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-help-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-help-7.79.1-6.oe2203.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="curl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-7.71.1-14.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-7.71.1-14.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-7.79.1-6.oe2203.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="curl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debugsource-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-debugsource-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debuginfo-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">curl-debuginfo-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libcurl-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-devel-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libcurl-devel-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debugsource-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-debugsource-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debuginfo-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">curl-debuginfo-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">libcurl-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-devel-7.71.1-14" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">libcurl-devel-7.71.1-14.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-7.79.1-6.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debugsource-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-debugsource-7.79.1-6.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="curl-debuginfo-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">curl-debuginfo-7.79.1-6.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libcurl-7.79.1-6.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libcurl-devel-7.79.1-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libcurl-devel-7.79.1-6.oe2203.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and SSH settings were left out from the configuration match checks, making them match too easily.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2022-05-28</ReleaseDate>
|
|
<CVE>CVE-2022-27782</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
|
|
<ProductID>openEuler-22.03-LTS</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>Medium</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>6.0</BaseScore>
|
|
<Vector>AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>curl security update</Description>
|
|
<DATE>2022-05-28</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1675</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="2" xml:lang="en">A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services (NSS) get stuck in a never-ending busy loop when trying to retrieve that information. This flaw allows an Infinite Loop, affecting system availability.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2022-05-28</ReleaseDate>
|
|
<CVE>CVE-2022-27781</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
|
|
<ProductID>openEuler-22.03-LTS</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>Medium</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>5.3</BaseScore>
|
|
<Vector>AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>curl security update</Description>
|
|
<DATE>2022-05-28</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1675</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |