An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2022-1506 Final 1.0 1.0 2022-01-28 Initial 2022-01-28 2022-01-28 openEuler SA Tool V1.0 2022-01-28 curl security update An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3. Curl is used in command lines or scripts to transfer data. Security Fix(es): When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.(CVE-2021-22923) When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.(CVE-2021-22922) An update for curl is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium curl https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1506 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-22923 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-22922 https://nvd.nist.gov/vuln/detail/CVE-2021-22923 https://nvd.nist.gov/vuln/detail/CVE-2021-22922 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP2 openEuler-20.03-LTS-SP3 curl-7.71.1-12.oe1.aarch64.rpm curl-debuginfo-7.71.1-12.oe1.aarch64.rpm libcurl-devel-7.71.1-12.oe1.aarch64.rpm curl-debugsource-7.71.1-12.oe1.aarch64.rpm libcurl-7.71.1-12.oe1.aarch64.rpm curl-debuginfo-7.71.1-12.oe1.aarch64.rpm curl-7.71.1-12.oe1.aarch64.rpm libcurl-7.71.1-12.oe1.aarch64.rpm libcurl-devel-7.71.1-12.oe1.aarch64.rpm curl-debugsource-7.71.1-12.oe1.aarch64.rpm libcurl-devel-7.71.1-12.oe1.aarch64.rpm curl-debuginfo-7.71.1-12.oe1.aarch64.rpm curl-7.71.1-12.oe1.aarch64.rpm curl-debugsource-7.71.1-12.oe1.aarch64.rpm libcurl-7.71.1-12.oe1.aarch64.rpm curl-help-7.71.1-12.oe1.noarch.rpm curl-help-7.71.1-12.oe1.noarch.rpm curl-help-7.71.1-12.oe1.noarch.rpm curl-7.71.1-12.oe1.src.rpm curl-7.71.1-12.oe1.src.rpm curl-7.71.1-12.oe1.src.rpm libcurl-7.71.1-12.oe1.x86_64.rpm curl-debuginfo-7.71.1-12.oe1.x86_64.rpm curl-debugsource-7.71.1-12.oe1.x86_64.rpm libcurl-devel-7.71.1-12.oe1.x86_64.rpm curl-7.71.1-12.oe1.x86_64.rpm libcurl-7.71.1-12.oe1.x86_64.rpm curl-debuginfo-7.71.1-12.oe1.x86_64.rpm curl-debugsource-7.71.1-12.oe1.x86_64.rpm libcurl-devel-7.71.1-12.oe1.x86_64.rpm curl-7.71.1-12.oe1.x86_64.rpm curl-debuginfo-7.71.1-12.oe1.x86_64.rpm libcurl-devel-7.71.1-12.oe1.x86_64.rpm curl-debugsource-7.71.1-12.oe1.x86_64.rpm curl-7.71.1-12.oe1.x86_64.rpm libcurl-7.71.1-12.oe1.x86_64.rpm When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user s expectations and intentions and without telling the user it happened. 2022-01-28 CVE-2021-22923 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP2 openEuler-20.03-LTS-SP3 Medium 5.3 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N curl security update 2022-01-28 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1506 When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk. 2022-01-28 CVE-2021-22922 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP2 openEuler-20.03-LTS-SP3 Medium 5.7 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N curl security update 2022-01-28 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1506