Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:0066-1

Опубликовано: 08 янв. 2026
Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

  • CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)
  • CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)
  • CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)

Список пакетов

Image SLES12-SP5-Azure-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-SAP-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-SAP-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-Standard-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-EC2-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-EC2-ECS-On-Demand
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-EC2-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-EC2-SAP-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-EC2-SAP-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-GCE-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-GCE-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-GCE-SAP-BYOS
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-GCE-SAP-On-Demand
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
curl-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
curl-8.0.1-11.111.1
libcurl-devel-8.0.1-11.111.1
libcurl4-8.0.1-11.111.1
libcurl4-32bit-8.0.1-11.111.1

Ссылки

Описание

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:curl-8.0.1-11.111.1
Image SLES12-SP5-Azure-BYOS:libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS:curl-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS:libcurl4-8.0.1-11.111.1
Ссылки

Описание

When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:curl-8.0.1-11.111.1
Image SLES12-SP5-Azure-BYOS:libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS:curl-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS:libcurl4-8.0.1-11.111.1
Ссылки

Описание

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:curl-8.0.1-11.111.1
Image SLES12-SP5-Azure-BYOS:libcurl4-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS:curl-8.0.1-11.111.1
Image SLES12-SP5-Azure-HPC-BYOS:libcurl4-8.0.1-11.111.1
Ссылки