Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2016:2449-1

Опубликовано: 04 окт. 2016
Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

  • CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389)
  • CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390)
  • CVE-2016-7141: Fixed incorrect reuse of client certificates (bsc#997420).

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
curl-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS
curl-7.19.7-1.61.1
curl-openssl1-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1
libcurl4-openssl1-7.19.7-1.61.1
libcurl4-openssl1-32bit-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-TERADATA
curl-7.19.7-1.61.1
curl-openssl1-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1
libcurl4-openssl1-7.19.7-1.61.1
libcurl4-openssl1-32bit-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP4
curl-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1
libcurl4-x86-7.19.7-1.61.1
SUSE Linux Enterprise Server 11-SECURITY
curl-openssl1-7.19.7-1.61.1
libcurl4-openssl1-7.19.7-1.61.1
libcurl4-openssl1-32bit-7.19.7-1.61.1
libcurl4-openssl1-x86-7.19.7-1.61.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4
curl-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1
libcurl4-x86-7.19.7-1.61.1
SUSE Linux Enterprise Software Development Kit 11 SP4
libcurl-devel-7.19.7-1.61.1
SUSE Manager 2.1
curl-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1
SUSE Manager Proxy 2.1
curl-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1
SUSE OpenStack Cloud 5
curl-7.19.7-1.61.1
libcurl4-7.19.7-1.61.1
libcurl4-32bit-7.19.7-1.61.1

Ссылки

Описание

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.19.7-1.61.1
SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.19.7-1.61.1
Ссылки

Описание

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.19.7-1.61.1
SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.19.7-1.61.1
Ссылки

Описание

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.19.7-1.61.1
SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.19.7-1.61.1
SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.19.7-1.61.1
Ссылки
Уязвимость SUSE-SU-2016:2449-1