Описание
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1262633
- SUSE Bug 1263440
- SUSE Bug 1268412
- SUSE Bug 1277476
- SUSE Bug 1277479
- SUSE Bug 1277480
- SUSE CVE CVE-2026-13608 page
- SUSE CVE CVE-2026-5773 page
- SUSE CVE CVE-2026-7168 page
- SUSE CVE CVE-2026-80229 page
- SUSE CVE CVE-2026-80230 page
- SUSE CVE CVE-2026-8926 page
Описание
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
Затронутые продукты
Ссылки
- CVE-2026-13608
- SUSE Bug 1277476
Описание
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.
Затронутые продукты
Ссылки
- CVE-2026-5773
- SUSE Bug 1262633
Описание
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
Затронутые продукты
Ссылки
- CVE-2026-7168
- SUSE Bug 1263440
- SUSE Bug 1268413
- SUSE Bug 1268426
Описание
When performing transfers via libcurl's multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
Затронутые продукты
Ссылки
- CVE-2026-80229
- SUSE Bug 1277479
Описание
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
Затронутые продукты
Ссылки
- CVE-2026-80230
- SUSE Bug 1277480
Описание
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
Затронутые продукты
Ссылки
- CVE-2026-8926
- SUSE Bug 1268412