ALT-PU-2016-1895

Высокий

ALT-PU-2016-1895: package curl update to version 7.50.1-alt1

Источник

errata.altlinux.org

Дата публикации

26.08.2016

Дата обновления

26.08.2016

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades curl to version 7.50.1-alt1.

Устраненные уязвимости3

CVE-2016-5419

Высокий 7.5

Дата публикации: 10.08.2016

CWE-310

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

CVSS 3.0

Высокий 7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS 2.0

Средний 5

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

CVE-2016-5419 https://nvd.nist.gov/vuln/detail/CVE-2016-5419

Ссылки1

ALT-PU-2016-1895 https://errata.altlinux.org/ALT-PU-2016-1895

Связанные уязвимости

openSUSE-SU-2016:2379-1

suse-cvrf

около 10 лет назад

Security update for curl

SUSE-SU-2016:2330-1

suse-cvrf

около 10 лет назад

Security update for curl

SUSE-SU-2016:2449-1

suse-cvrf

около 10 лет назад

Security update for curl

ELSA-2016-2575

oracle-oval

около 10 лет назад

ELSA-2016-2575: curl security, bug fix, and enhancement update (MODERATE)

CVE-2016-5419

CVSS3: 7.5

ubuntu

около 10 лет назад

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.