Описание
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:5071-1
- E-Mail link for SUSE-SU-2026:5071-1
- SUSE Security Ratings
- SUSE Bug 1268414
- SUSE Bug 1268426
- SUSE Bug 1268427
- SUSE Bug 1277478
- SUSE Bug 1285010
- SUSE Bug 1285013
- SUSE Bug 1285015
- SUSE Bug 1285016
- SUSE Bug 1285021
- SUSE Bug 1285026
- SUSE Bug 1285030
- SUSE Bug 1285031
- SUSE CVE CVE-2026-11856 page
- SUSE CVE CVE-2026-12064 page
- SUSE CVE CVE-2026-19931 page
- SUSE CVE CVE-2026-8458 page
- SUSE CVE CVE-2026-86409 page
Описание
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
Затронутые продукты
Ссылки
- CVE-2026-11856
- SUSE Bug 1268426
Описание
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
Затронутые продукты
Ссылки
- CVE-2026-12064
- SUSE Bug 1268427
- SUSE Bug 1285030
Описание
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Затронутые продукты
Ссылки
- CVE-2026-19931
- SUSE Bug 1277478
Описание
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
Затронутые продукты
Ссылки
- CVE-2026-8458
- SUSE Bug 1268407
Описание
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.
Затронутые продукты
Ссылки
- CVE-2026-86409
- SUSE Bug 1285031
Описание
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
Затронутые продукты
Ссылки
- CVE-2026-86410
- SUSE Bug 1285030
Описание
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.
Затронутые продукты
Ссылки
- CVE-2026-86414
- SUSE Bug 1285026
Описание
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
Затронутые продукты
Ссылки
- CVE-2026-87864
- SUSE Bug 1285021
Описание
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Затронутые продукты
Ссылки
- CVE-2026-8932
- SUSE Bug 1268414
Описание
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Затронутые продукты
Ссылки
- CVE-2026-92388
- SUSE Bug 1285016
Описание
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
Затронутые продукты
Ссылки
- CVE-2026-92389
- SUSE Bug 1285015
Описание
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.
Затронутые продукты
Ссылки
- CVE-2026-92391
- SUSE Bug 1285013
Описание
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
Затронутые продукты
Ссылки
- CVE-2026-94266
- SUSE Bug 1285010