Описание
ELSA-2026-55450: curl security update (IMPORTANT)
[8.12.1-4.4]
- fix proxy environment variable change detection (CVE-2026-8927)
[8.12.1-4.el10_2.3]
- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- fix proxy connection reuse with wrong credentials (CVE-2026-3784)
[8.12.1-4.2]
- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix schemeless URL handling with --proto-default (CVE-2026-12064)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)
[8.12.1-4.1]
- openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
curl
8.12.1-4.el10_2.4
libcurl
8.12.1-4.el10_2.4
libcurl-devel
8.12.1-4.el10_2.4
libcurl-minimal
8.12.1-4.el10_2.4
Oracle Linux x86_64
curl
8.12.1-4.el10_2.4
libcurl
8.12.1-4.el10_2.4
libcurl-devel
8.12.1-4.el10_2.4
libcurl-minimal
8.12.1-4.el10_2.4
Ссылки на источники
Связанные уязвимости
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
When doing TLS related transfers with reused easy or multi handles and ...