Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:3774-1

Опубликовано: 26 окт. 2022
Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

  • CVE-2022-32221: Fixed POST following PUT confusion (bsc#1204383).
  • CVE-2022-35252: Fixed a potential injection of control characters into cookies (bsc#1202593).

Список пакетов

Container caasp/v4/cilium-operator:1.6.6
libcurl4-7.60.0-150000.38.1
Container caasp/v4/cilium:1.6.6
libcurl4-7.60.0-150000.38.1
Container caasp/v4/helm-tiller:2.16.12
libcurl4-7.60.0-150000.38.1
Container suse/sle15:15.0
libcurl4-7.60.0-150000.38.1
Container suse/sle15:15.1
libcurl4-7.60.0-150000.38.1
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
curl-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
curl-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
Image SLES15-SP1-SAPCAL-Azure
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
Image SLES15-SP1-SAPCAL-EC2-HVM
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
Image SLES15-SP1-SAPCAL-GCE
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
SUSE Enterprise Storage 6
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise High Performance Computing 15-LTSS
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise Server 15 SP1-BCL
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise Server 15 SP1-LTSS
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise Server 15-LTSS
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise Server for SAP Applications 15
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
curl-7.60.0-150000.38.1
libcurl-devel-7.60.0-150000.38.1
libcurl4-7.60.0-150000.38.1
libcurl4-32bit-7.60.0-150000.38.1

Ссылки

Описание

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Затронутые продукты
Container caasp/v4/cilium-operator:1.6.6:libcurl4-7.60.0-150000.38.1
Container caasp/v4/cilium:1.6.6:libcurl4-7.60.0-150000.38.1
Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.38.1
Container suse/sle15:15.0:libcurl4-7.60.0-150000.38.1
Ссылки

Описание

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Затронутые продукты
Container caasp/v4/cilium-operator:1.6.6:libcurl4-7.60.0-150000.38.1
Container caasp/v4/cilium:1.6.6:libcurl4-7.60.0-150000.38.1
Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.38.1
Container suse/sle15:15.0:libcurl4-7.60.0-150000.38.1
Ссылки
Уязвимость SUSE-SU-2022:3774-1