An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2022-1506
Final
1.0
1.0
2022-01-28
Initial
2022-01-28
2022-01-28
openEuler SA Tool V1.0
2022-01-28
curl security update
An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3.
Curl is used in command lines or scripts to transfer data.
Security Fix(es):
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.(CVE-2021-22923)
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.(CVE-2021-22922)
An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3.
openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
Medium
curl
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1506
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-22923
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-22922
https://nvd.nist.gov/vuln/detail/CVE-2021-22923
https://nvd.nist.gov/vuln/detail/CVE-2021-22922
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP2
openEuler-20.03-LTS-SP3
curl-7.71.1-12.oe1.aarch64.rpm
curl-debuginfo-7.71.1-12.oe1.aarch64.rpm
libcurl-devel-7.71.1-12.oe1.aarch64.rpm
curl-debugsource-7.71.1-12.oe1.aarch64.rpm
libcurl-7.71.1-12.oe1.aarch64.rpm
curl-debuginfo-7.71.1-12.oe1.aarch64.rpm
curl-7.71.1-12.oe1.aarch64.rpm
libcurl-7.71.1-12.oe1.aarch64.rpm
libcurl-devel-7.71.1-12.oe1.aarch64.rpm
curl-debugsource-7.71.1-12.oe1.aarch64.rpm
libcurl-devel-7.71.1-12.oe1.aarch64.rpm
curl-debuginfo-7.71.1-12.oe1.aarch64.rpm
curl-7.71.1-12.oe1.aarch64.rpm
curl-debugsource-7.71.1-12.oe1.aarch64.rpm
libcurl-7.71.1-12.oe1.aarch64.rpm
curl-help-7.71.1-12.oe1.noarch.rpm
curl-help-7.71.1-12.oe1.noarch.rpm
curl-help-7.71.1-12.oe1.noarch.rpm
curl-7.71.1-12.oe1.src.rpm
curl-7.71.1-12.oe1.src.rpm
curl-7.71.1-12.oe1.src.rpm
libcurl-7.71.1-12.oe1.x86_64.rpm
curl-debuginfo-7.71.1-12.oe1.x86_64.rpm
curl-debugsource-7.71.1-12.oe1.x86_64.rpm
libcurl-devel-7.71.1-12.oe1.x86_64.rpm
curl-7.71.1-12.oe1.x86_64.rpm
libcurl-7.71.1-12.oe1.x86_64.rpm
curl-debuginfo-7.71.1-12.oe1.x86_64.rpm
curl-debugsource-7.71.1-12.oe1.x86_64.rpm
libcurl-devel-7.71.1-12.oe1.x86_64.rpm
curl-7.71.1-12.oe1.x86_64.rpm
curl-debuginfo-7.71.1-12.oe1.x86_64.rpm
libcurl-devel-7.71.1-12.oe1.x86_64.rpm
curl-debugsource-7.71.1-12.oe1.x86_64.rpm
curl-7.71.1-12.oe1.x86_64.rpm
libcurl-7.71.1-12.oe1.x86_64.rpm
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user s expectations and intentions and without telling the user it happened.
2022-01-28
CVE-2021-22923
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP2
openEuler-20.03-LTS-SP3
Medium
5.3
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
curl security update
2022-01-28
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1506
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
2022-01-28
CVE-2021-22922
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP2
openEuler-20.03-LTS-SP3
Medium
5.7
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
curl security update
2022-01-28
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1506